Function at 0x100033c9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xc0
xor esi, esi
xor r12d, r12d
xor ebp, ebp
and qword [rax - 0x60], rsi
and qword [rax - 0x58], rsi
and qword [rax - 0x70], rsi
mov r13, r9
mov rdi, rcx
mov qword [rax - 0x50], r12
mov qword [rax - 0x68], rsi
mov dword [rax - 0x78], ebp
test rdx, rdx
jne 0x100033e45
test r8, r8
jne 0x100033e45
mov rdx, qword [rsp + 0x118]
test rdx, rdx
jne 0x100033e52
lea rdx, [0x10000d3f0]
call fcn.1000b5684
test eax, eax
je 0x100033d27
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100033d27
and eax, 0x10
test al, al
je 0x100033e92
lea rdx, [0x10000d3f0]
mov rcx, rdi
call fcn.1000b5684
test eax, eax
jne 0x100033da2
mov r8, qword [rsp + reloc.certcli.dll_Ordinal_256]
lea rax, [rsp + 0xe8]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdx, r13
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x128]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], esi
and qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rsi
call fcn.100033234
mov ebx, eax
test eax, eax
je 0x100033fcc
mov edx, 0x996012e
jmp 0x100033fba
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.1000baec0
xor ecx, ecx
mov ebx, eax
test eax, eax
je 0x100033dd7
xor r9d, r9d
mov r8d, eax
mov edx, 0x99b012e
call fcn.1000b51b8
mov r12, qword [rsp + 0x88]
jmp 0x100034070
mov r12, qword [rsp + 0x88]
mov r9, qword [rsp + reloc.certcli.dll_Ordinal_256]
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov r8, r13
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x128]
mov rdx, r12
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], esi
and qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rsi
call fcn.100033778
mov ebx, eax
test eax, eax
je 0x100033fcc
mov edx, 0x9a9012e
jmp 0x100033fba
mov rdx, qword [rsp + 0x118]
test rdx, rdx
je 0x100033e92
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov cl, 1
call fcn.100033b9c
mov ebx, eax
test eax, eax
je 0x100033e89
xor r9d, r9d
mov r8d, eax
mov edx, 0x9b1012e
xor ecx, ecx
call fcn.1000b51b8
mov rsi, qword [rsp + 0x70]
mov ebp, dword [rsp + 0x60]
jmp 0x100034070
mov rsi, qword [rsp + 0x70]
mov ebp, dword [rsp + 0x60]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.10003ccb8
test eax, eax
jne 0x100033f1b
mov r9b, byte [rsp + 0x108]
mov r8, qword [rsp + reloc.certcli.dll_Ordinal_256]
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0xe8]
mov rdx, r13
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.100033234
mov ebx, eax
test eax, eax
je 0x100033fcc
mov edx, 0x9c5012e
jmp 0x100033fba
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.10003cba8
mov ebx, eax
test eax, eax
jne 0x10003405e
cmp byte [rsp + 0x108], r12b
je 0x100033f4e
mov ebx, 0x80070057
mov edx, 0x9cf012e
mov r8d, ebx
jmp 0x100033fbd
mov r9, qword [rsp + reloc.certcli.dll_Ordinal_256]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov r8, r13
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x128]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.100033778
mov ebx, eax
test eax, eax
je 0x100033fcc
mov edx, 0x9dd012e
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100034070
mov r9d, dword [0x10011ac04]
mov rdi, qword [rsp + 0x130]
mov r8d, dword [rsp + 0xe8]
mov rdx, qword [rsp + 0x68]
or r9d, 2
mov rcx, rdi
call sub.certcli.dll_Ordinal_225
mov ebx, eax
test eax, eax
je 0x100034001
mov edx, 0x16b
jmp 0x100034063
lea rcx, [0x100004a38]
mov rdx, rdi
call fcn.1000b99b0
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0xb0]
mov dword [rsp + 0xb0], ecx
mov ecx, 0x169
call fcn.1000ba420
mov edx, dword [rsp + 0xb0]
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
xor ebx, ebx
jmp 0x100034070
mov edx, 0x2e5
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000ba5ac
mov rdx, rsi
mov ecx, ebp
call fcn.1000cb418
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x100034093
call qword [sym.imp.CRYPT32.dll_CertFreeCRLContext]
lea rcx, [rsp + 0x80]
call fcn.10003cb80
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1000340b0
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret