Function at 0x1401c2080
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x40], rbp
lea rcx, str.wintrust.dll
mov qword [rsp + 0x48], rsi
xor edx, edx
mov r8d, 0x800
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x1401c20f7
xor edx, edx
lea rcx, str.wintrust.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401c20f7
cmp dword [0x1402baf40], 0x3e
jae 0x1401c20f4
xor r8d, r8d
lea rcx, str.wintrust.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401c20f7
mov rdi, rbx
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c2157
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c2157
cmp dword [0x1402baf40], 0x3e
jae 0x1401c2154
xor r8d, r8d
lea rcx, str.crypt32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401c2157
mov rsi, rbx
mov ebp, 0x5a4d
test rdi, rdi
je 0x1401c24d6
mov qword [rsp + 0x58], r14
lea r14, [rdi + 0x3c]
cmp word [rdi], bp
jne 0x1401c21c7
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c21c7
cmp dword [rcx + rdi], 0x4550
jne 0x1401c21c7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c21c7
cmp dword [rdx + 4], ebx
je 0x1401c21c7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c21ca
mov rax, rbx
mov qword [0x1402c9208], rax
cmp word [rdi], bp
jne 0x1401c2227
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c2227
cmp dword [rcx + rdi], 0x4550
jne 0x1401c2227
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c2227
cmp dword [rdx + 4], ebx
je 0x1401c2227
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle2
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c222a
mov rax, rbx
mov qword [0x1402c91c0], rax
cmp word [rdi], bp
jne 0x1401c2287
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c2287
cmp dword [rcx + rdi], 0x4550
jne 0x1401c2287
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c2287
cmp dword [rdx + 4], ebx
je 0x1401c2287
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c228a
mov rax, rbx
mov qword [0x1402c91d0], rax
cmp word [rdi], bp
jne 0x1401c22e7
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c22e7
cmp dword [rcx + rdi], 0x4550
jne 0x1401c22e7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c22e7
cmp dword [rdx + 4], ebx
je 0x1401c22e7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext2
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c22ea
mov rax, rbx
mov qword [0x1402c9200], rax
cmp word [rdi], bp
jne 0x1401c2347
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c2347
cmp dword [rcx + rdi], 0x4550
jne 0x1401c2347
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c2347
cmp dword [rdx + 4], ebx
je 0x1401c2347
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c234a
mov rax, rbx
mov qword [0x1402c91e0], rax
cmp word [rdi], bp
jne 0x1401c23a7
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c23a7
cmp dword [rcx + rdi], 0x4550
jne 0x1401c23a7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c23a7
cmp dword [rdx + 4], ebx
je 0x1401c23a7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATCatalogInfoFromContext
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c23aa
mov rax, rbx
mov qword [0x1402c91c8], rax
cmp word [rdi], bp
jne 0x1401c2407
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c2407
cmp dword [rcx + rdi], 0x4550
jne 0x1401c2407
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c2407
cmp dword [rdx + 4], ebx
je 0x1401c2407
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseCatalogContext
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c240a
mov rax, rbx
mov qword [0x1402c91b0], rax
cmp word [rdi], bp
jne 0x1401c2467
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c2467
cmp dword [rcx + rdi], 0x4550
jne 0x1401c2467
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c2467
cmp dword [rdx + 4], ebx
je 0x1401c2467
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseContext
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c246a
mov rax, rbx
mov qword [0x1402c91b8], rax
cmp word [rdi], bp
jne 0x1401c24c7
mov ecx, dword ds:[r14]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c24c7
cmp dword [rcx + rdi], 0x4550
jne 0x1401c24c7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c24c7
cmp dword [rdx + 4], ebx
je 0x1401c24c7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.WinVerifyTrust
mov rcx, rdi
call fcn.140177a80
jmp 0x1401c24ca
mov rax, rbx
mov r14, qword [rsp + 0x58]
mov qword [0x1402c91f8], rax
test rsi, rsi
je 0x1401c2631
lea rdi, [rsi + 0x3c]
cmp word [rsi], bp
jne 0x1401c252c
mov ecx, dword [rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c252c
cmp dword [rcx + rsi], 0x4550
jne 0x1401c252c
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c252c
cmp dword [rdx + 4], ebx
je 0x1401c252c
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertNameToStrW
mov rcx, rsi
call fcn.140177a80
jmp 0x1401c252f
mov rax, rbx
mov qword [0x1402c91d8], rax
cmp word [rsi], bp
jne 0x1401c25ce
mov ecx, dword [rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c2585
cmp dword [rcx + rsi], 0x4550
jne 0x1401c2585
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c2585
cmp dword [rdx + 4], ebx
je 0x1401c2585
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertGetEnhancedKeyUsage
mov rcx, rsi
call fcn.140177a80
cmp word [rsi], bp
jne 0x1401c25ce
mov ecx, dword [rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c25ce
cmp dword [rcx + rsi], 0x4550
jne 0x1401c25ce
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c25ce
cmp dword [rdx + 4], ebx
je 0x1401c25ce
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertDuplicateCertificateContext
mov rcx, rsi
call fcn.140177a80
jmp 0x1401c25d1
mov rax, rbx
mov qword [0x1402c91e8], rax
cmp word [rsi], bp
jne 0x1401c2628
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c2628
cmp dword [rcx + rsi], 0x4550
jne 0x1401c2628
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c2628
cmp dword [rdx + 4], ebx
je 0x1401c2628
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertFreeCertificateContext
mov rcx, rsi
call fcn.140177a80
mov rbx, rax
mov qword [0x1402c91f0], rbx
jmp 0x1401c2638
mov rbx, qword [0x1402c91f0]
cmp qword [0x1402c9208], 0
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
je 0x1401c26cc
cmp qword [0x1402c91d0], 0
je 0x1401c26cc
cmp qword [0x1402c91e0], 0
je 0x1401c26cc
cmp qword [0x1402c91c8], 0
je 0x1401c26cc
cmp qword [0x1402c91b0], 0
je 0x1401c26cc
cmp qword [0x1402c91b8], 0
je 0x1401c26cc
cmp qword [0x1402c91f8], 0
je 0x1401c26cc
cmp qword [0x1402c91d8], 0
je 0x1401c26cc
cmp qword [0x1402c91e8], 0
nop
je 0x1401c26cc
test rbx, rbx
je 0x1401c26cc
mov r9d, 0x64
lea r8, [0x1401c3de0]
lea rdx, [0x1401c3d60]
lea ecx, [r9 - 0x44]
call sym.SystemInformer.exe_QiCreateHashtable
mov qword [0x1402c9128], rax
add rsp, 0x30
pop rbx
ret