Function at 0x140002e20
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14001d038]
xor ebx, ebx
test rax, rax
jne 0x140002e50
lea rcx, str.crypt32.dll
call fcn.140001550
mov qword [0x14001d038], rax
test rax, rax
je 0x1400030c9
cmp qword [0x14001d068], rbx
jne 0x140002e7c
lea rcx, str.wintrust.dll
call fcn.140001550
mov qword [0x14001d068], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d0f8], rbx
jne 0x140002eac
lea rdx, str.CertGetNameStringA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d0f8], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d140], rbx
jne 0x140002edc
lea rdx, str.CryptDecodeObjectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d140], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d0b8], rbx
jne 0x140002f0c
lea rdx, str.CertFreeCertificateContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d0b8], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d030], rbx
jne 0x140002f3c
lea rdx, str.CertFindCertificateInStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d030], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d0f0], rbx
jne 0x140002f6c
lea rdx, str.CertGetIssuerCertificateFromStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d0f0], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d120], rbx
jne 0x140002f9c
lea rdx, str.CryptMsgGetParam
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d120], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d150], rbx
jne 0x140002fcc
lea rdx, str.CryptQueryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d150], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d290], rbx
jne 0x140002ffc
lea rdx, str.CryptMsgClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d290], rax
test rax, rax
je 0x1400030c9
mov rax, qword [0x14001d038]
cmp qword [0x14001d168], rbx
jne 0x140003025
lea rdx, str.CertCloseStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d168], rax
test rax, rax
je 0x1400030c9
cmp qword [0x14001d040], rbx
jne 0x14000304e
mov rcx, qword [0x14001d068]
lea rdx, str.WinVerifyTrust
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d040], rax
test rax, rax
je 0x1400030c9
cmp qword [0x14001d058], rbx
jne 0x140003077
mov rcx, qword [0x14001d068]
lea rdx, str.WTHelperProvDataFromStateData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d058], rax
test rax, rax
je 0x1400030c9
cmp qword [0x14001d118], rbx
jne 0x1400030a0
mov rcx, qword [0x14001d068]
lea rdx, str.WTHelperGetProvCertFromChain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d118], rax
test rax, rax
je 0x1400030c9
cmp qword [0x14001d0d8], rbx
jne 0x1400030cd
mov rcx, qword [0x14001d068]
lea rdx, str.WTHelperGetProvSignerFromChain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001d0d8], rax
test rax, rax
jne 0x1400030cd
xor eax, eax
jmp 0x1400030d2
mov eax, 1
add rsp, 0x20
pop rbx
ret