Function at 0x140009f0c
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rcx, str.WinTrust
mov r13, r9
mov rbp, r8
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov rbx, rax
mov qword [rsp + 0x40], rsi
mov edi, esi
mov dword [rsp + 0x30], esi
mov r12d, esi
mov qword [rsp + 0x48], rsi
mov r14d, esi
mov qword [rsp + 0x50], rsi
test rax, rax
jne 0x140009f8c
lea rcx, str.WinTrust
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x140009f8c
lea rcx, str.WinTrust
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CryptCATOpen
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x140009fd4
lea r9, str.CryptCATOpen
lea rax, str.WinTrust
mov ecx, 3
lea r8, str.Unable_to_locate__s___in__s_n
mov qword [rsp + 0x20], rax
lea rdx, str.CreateCat
call fcn.1400082ac
jmp 0x14000a3d2
test rbx, rbx
jne 0x140009ffd
lea rdi, str.WinTrust
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x140009ffd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CryptCATClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov rdi, rax
test rax, rax
jne 0x14000a023
lea r9, str.CryptCATClose
jmp 0x140009fab
test rbx, rbx
jne 0x14000a04c
lea r14, str.WinTrust
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14000a04c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CryptCATPersistStore
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
mov r14, rax
test rax, rax
jne 0x14000a09c
lea r9, str.CryptCATPersistStore
lea rax, str.WinTrust
mov ecx, 3
lea r8, str.Unable_to_locate__s___in__s_n
mov qword [rsp + 0x20], rax
lea rdx, str.CreateCat
call fcn.1400082ac
mov r14d, r12d
jmp 0x14000a3d2
test rbx, rbx
jne 0x14000a0c6
lea rcx, str.WinTrust
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14000a0c6
lea rcx, str.WinTrust
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CryptCATStoreFromHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000a0e4
lea r9, str.CryptCATStoreFromHandle
jmp 0x14000a070
test rbx, rbx
jne 0x14000a10d
lea rdi, str.WinTrust
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14000a10d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CryptCATPutCatAttrInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14000a156
lea rax, str.WinTrust
lea r9, str.CryptCATPutCatAttrInfo
mov qword [rsp + 0x20], rax
lea r8, str.Unable_to_locate__s___in__s_n
lea rdx, str.CreateCat
lea ecx, [rdi + 3]
call fcn.1400082ac
mov r14d, r12d
jmp 0x14000a3cd
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14000a190
lea r8, str.Unable_to_acquire_crypt_context_for_cat_creation
lea rdx, str.CreateCat
lea ecx, [rax + 2]
call fcn.1400082ac
jmp 0x14000a14e
mov rcx, qword [rsp + 0x90]
call fcn.14000be90
mov rcx, r15
mov qword [rsp + 0x48], rax
mov r12, rax
call fcn.14000be90
mov rcx, rax
mov qword [rsp + 0x50], rax
mov r15, rax
call fcn.1400230e8
mov r8, qword [rsp + 0x40]
xor r9d, r9d
and dword [rsp + 0x20], 0
mov rcx, r12
lea edx, [r9 + 1]
call rsi
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a212
xor ecx, ecx
call fcn.14000bf20
mov r9, qword [rsp + 0x90]
lea r8, str.Unable_to_create_file__s:__s
lea rdx, str.CreateCat
mov qword [rsp + 0x20], rax
lea ecx, [r12 + 3]
call fcn.1400082ac
mov r14d, dword [rsp + 0x30]
jmp 0x14000a3cd
mov rcx, r15
call fcn.14001a758
mov qword [rsp + 0x20], r15
lea rdx, str.HWID1
mov r15d, 0x10010001
mov rcx, r12
mov r8d, r15d
lea r9d, [rax*2 + 2]
call rdi
test rax, rax
jne 0x14000a265
xor ecx, ecx
call fcn.14000bf20
lea r8, str.Failed_to_set_HWID1_cat_attribute:__s
mov r9, rax
lea rdx, str.CreateCat
mov ecx, 2
call fcn.1400082ac
jmp 0x14000a208
lea rsi, str.7_X86_7_X64_8_X86_8_X64_8_ARM_10_X86_10_X64_10_ARM
mov rcx, rsi
call fcn.14001a758
mov r8d, r15d
mov qword [rsp + 0x20], rsi
lea rdx, [0x14039cfe0]
mov rcx, r12
lea r9d, [rax*2 + 2]
call rdi
test rax, rax
jne 0x14000a2a5
xor ecx, ecx
call fcn.14000bf20
lea r8, str.Failed_to_set_OS_cat_attribute:__s
jmp 0x14000a24f
mov r8d, 0x104
lea rdx, [0x1403bcd40]
mov rcx, rbp
call fcn.14000b0a0
test eax, eax
jne 0x14000a2ca
mov r9, rbp
lea r8, str.Unable_to_get_full_path_for__s._n
jmp 0x14000a252
mov edi, dword [rsp + 0xb0]
mov edx, 8
mov ecx, edi
mov ebp, edi
call fcn.14001b030
mov rsi, rax
test rax, rax
jne 0x14000a302
lea r8, str.Unable_allocate_local_file_list
lea rdx, str.CreateCat
lea ecx, [rax + 2]
call fcn.1400082ac
jmp 0x14000a208
test edi, edi
je 0x14000a354
mov r14, rsi
mov r15, rdi
sub r14, r13
mov rcx, qword [r13]
call fcn.14001aad8
mov qword [r14 + r13], rax
test rax, rax
jne 0x14000a33d
mov r9, qword [r13]
lea r8, str._s_could_not_be_duplicated_and_will_be_ignored
lea rdx, str.CreateCat
lea ecx, [rax + 2]
call fcn.1400082ac
jmp 0x14000a345
mov rcx, rax
call fcn.14002352c
add r13, 8
sub r15, 1
jne 0x14000a30f
mov r14, qword [rsp + 0x58]
mov r9d, edi
lea rdx, [0x1403a5e40]
mov r8, rsi
mov rcx, r12
call fcn.14000b6bc
test edi, edi
je 0x14000a382
mov rdi, rsi
mov rcx, qword [rdi]
call fcn.14001b038
lea rdi, [rdi + 8]
sub rbp, 1
jne 0x14000a370
mov rcx, rsi
call fcn.14001b038
mov rcx, r12
call r14
test eax, eax
jne 0x14000a3a7
xor ecx, ecx
call fcn.14000bf20
lea r8, str.Unable_to_sort_file:__s
jmp 0x14000a24f
mov r9, qword [rsp + 0x90]
lea r8, str.Successfully_created_file__s
lea rdx, str.CreateCat
mov ecx, 1
call fcn.1400082ac
mov r14d, 1
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call fcn.14001b038
mov rcx, qword [rsp + 0x50]
call fcn.14001b038
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a3f8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test r12, r12
je 0x14000a402
mov rcx, r12
call rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x60]
mov eax, r14d
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret