Function at 0x1401c5f40
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rsi
lea rcx, str.wintrust.dll
mov qword [rsp + 0x60], rdi
xor edx, edx
mov qword [rsp + 0x68], r12
mov r8d, 0x800
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x1401c5fbc
xor edx, edx
lea rcx, str.wintrust.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401c5fbc
cmp dword [0x1402bff40], 0x3e
jae 0x1401c5fb9
xor r8d, r8d
lea rcx, str.wintrust.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401c5fbc
mov rdi, rbx
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c601c
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c601c
cmp dword [0x1402bff40], 0x3e
jae 0x1401c6019
xor r8d, r8d
lea rcx, str.crypt32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c601c
mov rsi, rbx
mov r12d, 0x5a4d
mov r15d, 0x3c
test rdi, rdi
je 0x1401c639b
mov qword ss:[rsp + 0x50], rbp
mov qword [rsp + 0x38], r14
cmp word [rdi], r12w
jne 0x1401c608b
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c608b
cmp dword [rcx + rdi], 0x4550
jne 0x1401c608b
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c608b
cmp dword [rdx + 4], ebx
je 0x1401c608b
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c608e
mov rax, rbx
mov rbp, rdi
mov r14, r15
mov qword [0x1402cec70], rax
cmp word [rdi], r12w
jne 0x1401c60ec
mov ecx, dword [r15 + rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c60ec
cmp dword [rcx + rdi], 0x4550
jne 0x1401c60ec
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c60ec
cmp dword [rdx + 4], ebx
je 0x1401c60ec
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle2
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c60ef
mov rax, rbx
mov qword [0x1402cec28], rax
cmp word [rdi], r12w
jne 0x1401c6147
mov ecx, dword [r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6147
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6147
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6147
cmp dword [rdx + 4], ebx
je 0x1401c6147
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c614a
mov rax, rbx
mov qword [0x1402cec38], rax
cmp word [rdi], r12w
jne 0x1401c61a7
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c61a7
cmp dword [rcx + rdi], 0x4550
jne 0x1401c61a7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c61a7
cmp dword [rdx + 4], ebx
je 0x1401c61a7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext2
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c61aa
mov rax, rbx
mov qword [0x1402cec68], rax
cmp word [rdi], r12w
jne 0x1401c6207
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6207
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6207
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6207
cmp dword [rdx + 4], ebx
je 0x1401c6207
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c620a
mov rax, rbx
mov qword [0x1402cec40], rax
cmp word [rdi], r12w
jne 0x1401c6267
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6267
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6267
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6267
cmp dword [rdx + 4], ebx
je 0x1401c6267
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATCatalogInfoFromContext
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c626a
mov rax, rbx
mov qword [0x1402cec30], rax
cmp word [rdi], r12w
jne 0x1401c62c7
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c62c7
cmp dword [rcx + rdi], 0x4550
jne 0x1401c62c7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c62c7
cmp dword [rdx + 4], ebx
je 0x1401c62c7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseCatalogContext
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c62ca
mov rax, rbx
mov qword [0x1402cec20], rax
cmp word [rdi], r12w
jne 0x1401c6327
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6327
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6327
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6327
cmp dword [rdx + 4], ebx
je 0x1401c6327
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseContext
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c632a
mov rax, rbx
mov qword [0x1402cec18], rax
cmp word [rdi], r12w
jne 0x1401c6387
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6387
cmp dword [rcx + rdi], 0x4550
jne 0x1401c6387
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6387
cmp dword [rdx + 4], ebx
je 0x1401c6387
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.WinVerifyTrust
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401c638a
mov rax, rbx
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
mov qword [0x1402cec60], rax
mov rdi, qword [rsp + 0x60]
test rsi, rsi
je 0x1401c6511
cmp word [rsi], r12w
jne 0x1401c63f4
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c63f4
cmp dword [rcx + rsi], 0x4550
jne 0x1401c63f4
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c63f4
cmp dword [rdx + 4], ebx
je 0x1401c63f4
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertNameToStrW
mov rcx, rsi
call fcn.14017dc40
jmp 0x1401c63f7
mov rax, rbx
mov rcx, rsi
mov qword [0x1402cec48], rax
cmp word [rsi], r12w
jne 0x1401c64a7
mov ecx, dword [r15 + rcx]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c644f
cmp dword [rcx + rsi], 0x4550
jne 0x1401c644f
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c644f
cmp dword [rdx + 4], ebx
je 0x1401c644f
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertGetEnhancedKeyUsage
mov rcx, rsi
call fcn.14017dc40
cmp word [rsi], r12w
jne 0x1401c64a7
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c64a7
cmp dword [rcx + rsi], 0x4550
jne 0x1401c64a7
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c64a7
cmp dword [rdx + 4], ebx
je 0x1401c64a7
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertDuplicateCertificateContext
mov rcx, rsi
call fcn.14017dc40
jmp 0x1401c64aa
mov rax, rbx
mov qword [0x1402cec50], rax
cmp word [rsi], r12w
jne 0x1401c6508
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6508
cmp dword [rcx + rsi], 0x4550
jne 0x1401c6508
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6508
cmp dword [rdx + 4], ebx
je 0x1401c6508
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertFreeCertificateContext
mov rcx, rsi
call fcn.14017dc40
mov rbx, rax
mov qword [0x1402cec58], rbx
jmp 0x1401c6518
mov rbx, qword [0x1402cec58]
cmp qword [0x1402cec70], 0
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
je 0x1401c65ac
cmp qword [0x1402cec38], 0
je 0x1401c65ac
cmp qword [0x1402cec40], 0
je 0x1401c65ac
cmp qword [0x1402cec30], 0
je 0x1401c65ac
cmp qword [0x1402cec20], 0
je 0x1401c65ac
cmp qword [0x1402cec18], 0
je 0x1401c65ac
cmp qword [0x1402cec60], 0
je 0x1401c65ac
cmp qword [0x1402cec48], 0
je 0x1401c65ac
cmp qword [0x1402cec50], 0
nop
je 0x1401c65ac
test rbx, rbx
je 0x1401c65ac
mov r9d, 0x64
lea r8, [0x1401c7ca0]
lea rdx, [0x1401c7c20]
mov ecx, 0x20
call sym.SystemInformer.exe_PhCreateHashtable
mov qword [0x1402ceb88], rax
add rsp, 0x40
pop rbx
ret