Function at 0x1401bf9c0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x40], rbp
lea rcx, str.wintrust.dll
mov qword [rsp + 0x48], rsi
xor edx, edx
mov r8d, 0x800
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x1401bfa37
xor edx, edx
lea rcx, str.wintrust.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401bfa37
cmp dword [0x1402b5e88], 0x3e
jae 0x1401bfa34
xor r8d, r8d
lea rcx, str.wintrust.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401bfa37
mov rdi, rbx
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401bfa97
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401bfa97
cmp dword [0x1402b5e88], 0x3e
jae 0x1401bfa94
xor r8d, r8d
lea rcx, str.crypt32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401bfa97
mov rsi, rbx
mov ebp, 0x5a4d
test rdi, rdi
je 0x1401bfe16
mov qword [rsp + 0x58], r14
lea r14, [rdi + 0x3c]
cmp word [rdi], bp
jne 0x1401bfb07
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfb07
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfb07
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfb07
cmp dword [rdx + 4], ebx
je 0x1401bfb07
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfb0a
mov rax, rbx
mov qword [0x1402c3f40], rax
cmp word [rdi], bp
jne 0x1401bfb67
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfb67
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfb67
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfb67
cmp dword [rdx + 4], ebx
je 0x1401bfb67
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle2
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfb6a
mov rax, rbx
mov qword [0x1402c3ef8], rax
cmp word [rdi], bp
jne 0x1401bfbc7
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfbc7
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfbc7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfbc7
cmp dword [rdx + 4], ebx
je 0x1401bfbc7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfbca
mov rax, rbx
mov qword [0x1402c3f08], rax
cmp word [rdi], bp
jne 0x1401bfc27
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfc27
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfc27
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfc27
cmp dword [rdx + 4], ebx
je 0x1401bfc27
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext2
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfc2a
mov rax, rbx
mov qword [0x1402c3f30], rax
cmp word [rdi], bp
jne 0x1401bfc87
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfc87
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfc87
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfc87
cmp dword [rdx + 4], ebx
je 0x1401bfc87
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfc8a
mov rax, rbx
mov qword [0x1402c3f18], rax
cmp word [rdi], bp
jne 0x1401bfce7
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfce7
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfce7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfce7
cmp dword [rdx + 4], ebx
je 0x1401bfce7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATCatalogInfoFromContext
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfcea
mov rax, rbx
mov qword [0x1402c3f00], rax
cmp word [rdi], bp
jne 0x1401bfd47
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfd47
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfd47
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfd47
cmp dword [rdx + 4], ebx
je 0x1401bfd47
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseCatalogContext
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfd4a
mov rax, rbx
mov qword [0x1402c3ef0], rax
cmp word [rdi], bp
jne 0x1401bfda7
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfda7
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfda7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfda7
cmp dword [rdx + 4], ebx
je 0x1401bfda7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseContext
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfdaa
mov rax, rbx
mov qword [0x1402c3ee8], rax
cmp word [rdi], bp
jne 0x1401bfe07
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfe07
cmp dword [rcx + rdi], 0x4550
jne 0x1401bfe07
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfe07
cmp dword [rdx + 4], ebx
je 0x1401bfe07
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.WinVerifyTrust
mov rcx, rdi
call fcn.140174840
jmp 0x1401bfe0a
mov rax, rbx
mov r14, qword [rsp + 0x58]
mov qword [0x1402c3f38], rax
test rsi, rsi
je 0x1401bff71
lea rdi, [rsi + 0x3c]
cmp word [rsi], bp
jne 0x1401bfe6c
mov ecx, dword [rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfe6c
cmp dword [rcx + rsi], 0x4550
jne 0x1401bfe6c
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfe6c
cmp dword [rdx + 4], ebx
je 0x1401bfe6c
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertNameToStrW
mov rcx, rsi
call fcn.140174840
jmp 0x1401bfe6f
mov rax, rbx
mov qword [0x1402c3f10], rax
cmp word [rsi], bp
jne 0x1401bff0e
mov ecx, dword [rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bfec5
cmp dword [rcx + rsi], 0x4550
jne 0x1401bfec5
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bfec5
cmp dword [rdx + 4], ebx
je 0x1401bfec5
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertGetEnhancedKeyUsage
mov rcx, rsi
call fcn.140174840
cmp word [rsi], bp
jne 0x1401bff0e
mov ecx, dword [rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bff0e
cmp dword [rcx + rsi], 0x4550
jne 0x1401bff0e
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bff0e
cmp dword [rdx + 4], ebx
je 0x1401bff0e
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertDuplicateCertificateContext
mov rcx, rsi
call fcn.140174840
jmp 0x1401bff11
mov rax, rbx
mov qword [0x1402c3f20], rax
cmp word [rsi], bp
jne 0x1401bff68
mov ecx, dword [rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401bff68
cmp dword [rcx + rsi], 0x4550
jne 0x1401bff68
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401bff68
cmp dword [rdx + 4], ebx
je 0x1401bff68
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertFreeCertificateContext
mov rcx, rsi
call fcn.140174840
mov rbx, rax
mov qword [0x1402c3f28], rbx
jmp 0x1401bff78
mov rbx, qword [0x1402c3f28]
cmp qword [0x1402c3f40], 0
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
je 0x1401c000c
cmp qword [0x1402c3f08], 0
je 0x1401c000c
cmp qword [0x1402c3f18], 0
je 0x1401c000c
cmp qword [0x1402c3f00], 0
je 0x1401c000c
cmp qword [0x1402c3ef0], 0
je 0x1401c000c
cmp qword [0x1402c3ee8], 0
je 0x1401c000c
cmp qword [0x1402c3f38], 0
je 0x1401c000c
cmp qword [0x1402c3f10], 0
je 0x1401c000c
cmp qword [0x1402c3f20], 0
nop
je 0x1401c000c
test rbx, rbx
je 0x1401c000c
mov r9d, 0x64
lea r8, [0x1401c1720]
lea rdx, [0x1401c16a0]
lea ecx, [r9 - 0x44]
call sym.SystemInformer.exe_PhCreateHashtable
mov qword [0x1402c3e60], rax
add rsp, 0x30
pop rbx
ret