Function at 0x7ff72e2ee450
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rax, qword [0x7ff72e3c6490]
test rax, rax
jne 0x7ff72e2ee47e
xor edx, edx
lea rcx, str.crypt32.dll
call fcn.7ff72e2eab30
mov qword [0x7ff72e3c6490], rax
test rax, rax
je 0x7ff72e2ee707
cmp qword [0x7ff72e3c6570], 0
jne 0x7ff72e2ee4ad
xor edx, edx
lea rcx, str.wintrust.dll
call fcn.7ff72e2eab30
mov qword [0x7ff72e3c6570], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c64c8], 0
jne 0x7ff72e2ee4de
lea rdx, str.CertGetNameStringA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c64c8], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c64d0], 0
jne 0x7ff72e2ee50f
lea rdx, str.CryptDecodeObjectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c64d0], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c64a8], 0
jne 0x7ff72e2ee540
lea rdx, str.CertFreeCertificateContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c64a8], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c64b0], 0
jne 0x7ff72e2ee571
lea rdx, str.CertFindCertificateInStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c64b0], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c64d8], 0
jne 0x7ff72e2ee5a2
lea rdx, str.CertGetIssuerCertificateFromStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c64d8], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c64b8], 0
jne 0x7ff72e2ee5d3
lea rdx, str.CryptMsgGetParam
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c64b8], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c64c0], 0
jne 0x7ff72e2ee604
lea rdx, str.CryptQueryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c64c0], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c6498], 0
jne 0x7ff72e2ee635
lea rdx, str.CryptMsgClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c6498], rax
test rax, rax
je 0x7ff72e2ee707
mov rax, qword [0x7ff72e3c6490]
cmp qword [0x7ff72e3c64a0], 0
jne 0x7ff72e2ee65f
lea rdx, str.CertCloseStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c64a0], rax
test rax, rax
je 0x7ff72e2ee707
cmp qword [0x7ff72e3c6578], 0
jne 0x7ff72e2ee689
mov rcx, qword [0x7ff72e3c6570]
lea rdx, str.WinVerifyTrust
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c6578], rax
test rax, rax
je 0x7ff72e2ee707
cmp qword [0x7ff72e3c6580], 0
jne 0x7ff72e2ee6b3
mov rcx, qword [0x7ff72e3c6570]
lea rdx, str.WTHelperProvDataFromStateData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c6580], rax
test rax, rax
je 0x7ff72e2ee707
cmp qword [0x7ff72e3c6590], 0
jne 0x7ff72e2ee6dd
mov rcx, qword [0x7ff72e3c6570]
lea rdx, str.WTHelperGetProvCertFromChain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c6590], rax
test rax, rax
je 0x7ff72e2ee707
cmp qword [0x7ff72e3c6588], 0
jne 0x7ff72e2ee70e
mov rcx, qword [0x7ff72e3c6570]
lea rdx, str.WTHelperGetProvSignerFromChain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff72e3c6588], rax
test rax, rax
jne 0x7ff72e2ee70e
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret