Function at 0x1401c6800
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rsi
lea rcx, str.wintrust.dll
mov qword [rsp + 0x60], rdi
xor edx, edx
mov qword [rsp + 0x68], r12
mov r8d, 0x800
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x1401c687c
xor edx, edx
lea rcx, str.wintrust.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401c687c
cmp dword [0x1402bff40], 0x3e
jae 0x1401c6879
xor r8d, r8d
lea rcx, str.wintrust.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401c687c
mov rdi, rbx
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c68dc
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c68dc
cmp dword [0x1402bff40], 0x3e
jae 0x1401c68d9
xor r8d, r8d
lea rcx, str.crypt32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c68dc
mov rsi, rbx
mov r12d, 0x5a4d
mov r15d, 0x3c
test rdi, rdi
je 0x1401c6c5b
mov qword ss:[rsp + 0x50], rbp
mov qword [rsp + 0x38], r14
cmp word [rdi], r12w
jne 0x1401c694b
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c694b
cmp dword [rcx + rdi], 0x4550
jne 0x1401c694b
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c694b
cmp dword [rdx + 4], ebx
je 0x1401c694b
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c694e
mov rax, rbx
mov rbp, rdi
mov r14, r15
mov qword [0x1402cec90], rax
cmp word [rdi], r12w
jne 0x1401c69ac
mov ecx, dword [r15 + rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c69ac
cmp dword [rcx + rdi], 0x4550
jne 0x1401c69ac
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c69ac
cmp dword [rdx + 4], ebx
je 0x1401c69ac
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle2
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c69af
mov rax, rbx
mov qword [0x1402cec48], rax
cmp word [rdi], r12w
jne 0x1401c6a07
mov ecx, dword [r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6a07
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6a07
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6a07
cmp dword [rdx + 4], ebx
je 0x1401c6a07
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c6a0a
mov rax, rbx
mov qword [0x1402cec58], rax
cmp word [rdi], r12w
jne 0x1401c6a67
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6a67
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6a67
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6a67
cmp dword [rdx + 4], ebx
je 0x1401c6a67
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext2
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c6a6a
mov rax, rbx
mov qword [0x1402cec88], rax
cmp word [rdi], r12w
jne 0x1401c6ac7
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6ac7
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6ac7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6ac7
cmp dword [rdx + 4], ebx
je 0x1401c6ac7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c6aca
mov rax, rbx
mov qword [0x1402cec68], rax
cmp word [rdi], r12w
jne 0x1401c6b27
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6b27
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6b27
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6b27
cmp dword [rdx + 4], ebx
je 0x1401c6b27
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATCatalogInfoFromContext
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c6b2a
mov rax, rbx
mov qword [0x1402cec50], rax
cmp word [rdi], r12w
jne 0x1401c6b87
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6b87
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6b87
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6b87
cmp dword [rdx + 4], ebx
je 0x1401c6b87
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseCatalogContext
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c6b8a
mov rax, rbx
mov qword [0x1402cec40], rax
cmp word [rdi], r12w
jne 0x1401c6be7
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6be7
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6be7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6be7
cmp dword [rdx + 4], ebx
je 0x1401c6be7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseContext
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c6bea
mov rax, rbx
mov qword [0x1402cec38], rax
cmp word [rdi], r12w
jne 0x1401c6c47
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6c47
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6c47
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6c47
cmp dword [rdx + 4], ebx
je 0x1401c6c47
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.WinVerifyTrust
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401c6c4a
mov rax, rbx
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
mov qword [0x1402cec80], rax
mov rdi, qword [rsp + 0x60]
test rsi, rsi
je 0x1401c6dd1
cmp word [rsi], r12w
jne 0x1401c6cb4
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6cb4
cmp dword [rcx + rsi], 0x4550
jne 0x1401c6cb4
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6cb4
cmp dword [rdx + 4], ebx
je 0x1401c6cb4
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertNameToStrW
mov rcx, rsi
call fcn.14017e4c0
jmp 0x1401c6cb7
mov rax, rbx
mov rcx, rsi
mov qword [0x1402cec60], rax
cmp word [rsi], r12w
jne 0x1401c6d67
mov ecx, dword [r15 + rcx]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6d0f
cmp dword [rcx + rsi], 0x4550
jne 0x1401c6d0f
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6d0f
cmp dword [rdx + 4], ebx
je 0x1401c6d0f
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertGetEnhancedKeyUsage
mov rcx, rsi
call fcn.14017e4c0
cmp word [rsi], r12w
jne 0x1401c6d67
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6d67
cmp dword [rcx + rsi], 0x4550
jne 0x1401c6d67
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6d67
cmp dword [rdx + 4], ebx
je 0x1401c6d67
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertDuplicateCertificateContext
mov rcx, rsi
call fcn.14017e4c0
jmp 0x1401c6d6a
mov rax, rbx
mov qword [0x1402cec70], rax
cmp word [rsi], r12w
jne 0x1401c6dc8
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6dc8
cmp dword [rcx + rsi], 0x4550
jne 0x1401c6dc8
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6dc8
cmp dword [rdx + 4], ebx
je 0x1401c6dc8
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertFreeCertificateContext
mov rcx, rsi
call fcn.14017e4c0
mov rbx, rax
mov qword [0x1402cec78], rbx
jmp 0x1401c6dd8
mov rbx, qword [0x1402cec78]
cmp qword [0x1402cec90], 0
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
je 0x1401c6e6c
cmp qword [0x1402cec58], 0
je 0x1401c6e6c
cmp qword [0x1402cec68], 0
je 0x1401c6e6c
cmp qword [0x1402cec50], 0
je 0x1401c6e6c
cmp qword [0x1402cec40], 0
je 0x1401c6e6c
cmp qword [0x1402cec38], 0
je 0x1401c6e6c
cmp qword [0x1402cec80], 0
je 0x1401c6e6c
cmp qword [0x1402cec60], 0
je 0x1401c6e6c
cmp qword [0x1402cec70], 0
nop
je 0x1401c6e6c
test rbx, rbx
je 0x1401c6e6c
mov r9d, 0x64
lea r8, [0x1401c8560]
lea rdx, [0x1401c84e0]
mov ecx, 0x20
call sym.SystemInformer.exe_PhCreateHashtable
mov qword [0x1402ceba8], rax
add rsp, 0x40
pop rbx
ret