Function at 0x140167680
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edx, edx
lea rcx, str.wintrust.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401676c9
xor edx, edx
lea rcx, str.wintrust.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401676fe
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
xor ebx, ebx
mov ebp, 0x5a4d
test rdi, rdi
je 0x140167b34
movzx ecx, word [rdi]
cmp cx, bp
jne 0x140167773
mov edx, dword ds:[rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167773
cmp dword [rdx + rdi], 0x4550
jne 0x140167773
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x14016776a
cmp dword [rdx + 4], ebx
je 0x14016776a
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x140167776
mov qword [0x140245800], rbx
jmp 0x140167785
mov rax, rbx
mov qword [0x140245800], rax
nop dword [rax]
cmp cx, bp
jne 0x1401677cd
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401677cd
cmp dword [rdx + rdi], 0x4550
jne 0x1401677cd
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x1401677cd
cmp dword [rdx + 4], ebx
je 0x1401677cd
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle2
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x1401677d0
mov rax, rbx
mov qword [0x1402457b0], rax
cmp cx, bp
jne 0x140167833
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167833
cmp dword [rdx + rdi], 0x4550
jne 0x140167833
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x14016782a
cmp dword [rdx + 4], ebx
je 0x14016782a
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x140167836
mov qword [0x1402457c8], rbx
jmp 0x140167845
mov rax, rbx
mov qword [0x1402457c8], rax
nop dword [rax]
cmp cx, bp
jne 0x140167896
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167896
cmp dword [rdx + rdi], 0x4550
jne 0x140167896
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x14016788d
cmp dword [rdx + 4], ebx
je 0x14016788d
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext2
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x140167899
mov qword [0x1402457f0], rbx
jmp 0x1401678a5
mov rax, rbx
mov qword [0x1402457f0], rax
cmp cx, bp
jne 0x1401678f6
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401678f6
cmp dword [rdx + rdi], 0x4550
jne 0x1401678f6
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x1401678ed
cmp dword [rdx + 4], ebx
je 0x1401678ed
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x1401678f9
mov qword [0x1402457d8], rbx
jmp 0x140167905
mov rax, rbx
mov qword [0x1402457d8], rax
cmp cx, bp
jne 0x140167956
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167956
cmp dword [rdx + rdi], 0x4550
jne 0x140167956
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x14016794d
cmp dword [rdx + 4], ebx
je 0x14016794d
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATCatalogInfoFromContext
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x140167959
mov qword [0x1402457b8], rbx
jmp 0x140167965
mov rax, rbx
mov qword [0x1402457b8], rax
cmp cx, bp
jne 0x1401679b6
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401679b6
cmp dword [rdx + rdi], 0x4550
jne 0x1401679b6
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x1401679ad
cmp dword [rdx + 4], ebx
je 0x1401679ad
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseCatalogContext
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x1401679b9
mov qword [0x1402457a0], rbx
jmp 0x1401679c5
mov rax, rbx
mov qword [0x1402457a0], rax
cmp cx, bp
jne 0x140167a16
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167a16
cmp dword [rdx + rdi], 0x4550
jne 0x140167a16
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x140167a0d
cmp dword [rdx + 4], ebx
je 0x140167a0d
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseContext
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x140167a19
mov qword [0x1402457a8], rbx
jmp 0x140167a25
mov rax, rbx
mov qword [0x1402457a8], rax
cmp cx, bp
jne 0x140167a76
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167a76
cmp dword [rdx + rdi], 0x4550
jne 0x140167a76
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x140167a6d
cmp dword [rdx + 4], ebx
je 0x140167a6d
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.WTHelperProvDataFromStateData
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x140167a79
mov qword [0x140245808], rbx
jmp 0x140167a85
mov rax, rbx
mov qword [0x140245808], rax
cmp cx, bp
jne 0x140167ad6
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167ad6
cmp dword [rdx + rdi], 0x4550
jne 0x140167ad6
add rdx, 0x88
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x140167acd
cmp dword [rdx + 4], ebx
je 0x140167acd
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.WTHelperGetProvSignerFromChain
mov rcx, rdi
call fcn.1400fa1a0
movzx ecx, word [rdi]
jmp 0x140167ad9
mov qword [0x1402457c0], rbx
jmp 0x140167ae5
mov rax, rbx
mov qword [0x1402457c0], rax
cmp cx, bp
jne 0x140167b2a
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140167b2a
cmp dword [rcx + rdi], 0x4550
jne 0x140167b2a
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140167b2a
cmp dword [rdx + 4], ebx
je 0x140167b2a
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.WinVerifyTrust
mov rcx, rdi
call fcn.1400fa1a0
jmp 0x140167b2d
mov rax, rbx
mov qword [0x1402457f8], rax
test rsi, rsi
je 0x140167c4f
movzx ecx, word [rsi]
cmp cx, bp
jne 0x140167b96
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167b96
cmp dword [rdx + rsi], 0x4550
jne 0x140167b96
add rdx, 0x88
add rdx, rsi
mov eax, dword [rdx]
test eax, eax
je 0x140167b8d
cmp dword [rdx + 4], ebx
je 0x140167b8d
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertNameToStrW
mov rcx, rsi
call fcn.1400fa1a0
movzx ecx, word [rsi]
jmp 0x140167b99
mov qword [0x1402457d0], rbx
jmp 0x140167ba5
mov rax, rbx
mov qword [0x1402457d0], rax
cmp cx, bp
jne 0x140167bed
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167bed
cmp dword [rdx + rsi], 0x4550
jne 0x140167bed
add rdx, 0x88
add rdx, rsi
mov eax, dword [rdx]
test eax, eax
je 0x140167bed
cmp dword [rdx + 4], ebx
je 0x140167bed
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertDuplicateCertificateContext
mov rcx, rsi
call fcn.1400fa1a0
movzx ecx, word [rsi]
jmp 0x140167bf0
mov rax, rbx
mov qword [0x1402457e0], rax
cmp cx, bp
jne 0x140167c48
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140167c48
cmp dword [rcx + rsi], 0x4550
jne 0x140167c48
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140167c48
cmp dword [rdx + 4], ebx
je 0x140167c48
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertFreeCertificateContext
mov rcx, rsi
call fcn.1400fa1a0
mov rbx, rax
mov qword [0x1402457e8], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret