Function at 0x18004d778
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x270], rax
or rsi, 0xffffffffffffffff
mov byte [rsp + 0x40], r9b
xor edi, edi
mov dword [rbp + 0x50], 0xf750e6c3
mov dword [rbp + 0x54], 0x11d138ee
mov r13, r8
mov dword [rbp + 0x58], 0xc000e585
mov r12, rdx
mov dword [rbp + 0x5c], 0xee95c24f
mov r14, rcx
test rcx, rcx
je 0x18004db05
test rdx, rdx
je 0x18004db05
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, r14
mov rdi, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, r14
mov r15, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, str.WinVerifyTrust
mov rcx, r14
mov rsi, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, r14
mov rbx, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [rsp + 0x70], rax
test rdi, rdi
je 0x18004d8ce
xor edi, edi
test r15, r15
je 0x18004d8ce
test rsi, rsi
je 0x18004d8ce
test rbx, rbx
je 0x18004d8ce
test rax, rax
je 0x18004d8ce
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18004d8e1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18004db33
mov ebx, 0x58
lea rcx, [rbp - 0x60]
mov r8d, ebx
xor edx, edx
call sub.ntdll.dll_memset
lea rax, [rbp]
mov dword [rbp - 0x60], ebx
lea edx, [rbx + 0xc]
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x44], edx
mov qword [rbp - 0x48], 2
mov dword [rbp - 0x30], 3
mov dword [rbp - 0x18], 0x10
mov qword [rbp - 0x58], rdi
jmp 0x18004d96d
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x44]
xor r9d, r9d
mov r8, rdi
mov rcx, rsi
call qword [case.0x1800532bc.0]
test eax, eax
jne 0x18004d9f0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
cmp ebx, 0x7a
jne 0x18004d9ec
mov edx, dword [rsp + 0x44]
xor ecx, ecx
call qword [sym.imp.KERNELBASE.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x18004d922
and dword [rsp + 0x7c], 0
lea rax, [rsp + 0x78]
and qword [rbp - 0x70], 0
lea r8, [rbp - 0x60]
mov qword [rbp - 0x38], rax
lea rdx, [rbp + 0x50]
mov rax, qword [rsp + 0x50]
xor ecx, ecx
mov dword [rbp - 0x40], 1
mov dword [rsp + 0x78], 0x20
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], rsi
call qword [case.0x1800532bc.0]
mov ebx, eax
test eax, eax
jne 0x18004db0a
mov r8b, byte [rsp + 0x40]
mov rdx, r13
mov rcx, r14
call fcn.18004d0e0
test eax, eax
jne 0x18004db0a
lea ebx, [rax + 0x1f]
jmp 0x18004db0a
xor edi, edi
jmp 0x18004d983
mov ebx, 0x48
mov dword [rbp - 0x40], 2
mov r8d, ebx
lea rcx, [rbp]
xor edx, edx
call sub.ntdll.dll_memset
mov r8d, dword [rsp + 0x44]
lea rax, [rsp + 0x48]
and qword [rsp + 0x48], 0
mov qword [rsp + 0x20], rax
mov rax, r15
mov dword [rbp], ebx
mov qword [rbp + 0x28], rdi
mov dword [rbp + 0x30], r8d
mov qword [rbp + 0x10], r13
jmp 0x18004dacf
mov rax, qword [rsp + 0x60]
lea rdx, [rbp + 0x60]
xor r8d, r8d
mov dword [rbp + 0x60], 0x20c
mov rcx, r15
call qword [case.0x1800532bc.0]
test eax, eax
je 0x18004dab6
lea rax, [rbp + 0x64]
mov dword [rbp - 0x30], 4
mov qword [rbp + 8], rax
lea r8, [rbp - 0x60]
mov rax, qword [rsp + 0x50]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [case.0x1800532bc.0]
and dword [rbp - 0x30], 0
lea rax, [rbp + 0x64]
mov qword [rbp + 8], rax
lea r8, [rbp - 0x60]
mov rax, qword [rsp + 0x50]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [case.0x1800532bc.0]
mov ebx, eax
test eax, eax
jne 0x18004dab6
mov r8b, byte [rsp + 0x40]
lea rdx, [rbp + 0x64]
mov rcx, r14
call fcn.18004d0e0
test eax, eax
jne 0x18004daef
mov r8d, dword [rsp + 0x44]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], r15
xor r9d, r9d
mov rdx, rdi
mov rcx, r12
call qword [case.0x1800532bc.0]
mov r15, rax
test rax, rax
jne 0x18004da36
jmp 0x18004d983
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [case.0x1800532bc.0]
jmp 0x18004db0a
mov ebx, 0x57
test rdi, rdi
je 0x18004db1e
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
cmp rsi, 0xffffffffffffffff
je 0x18004db33
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
sete al
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret