Function at 0x180022070
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r13, rcx
xor r12d, r12d
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
lea rcx, str.wintrust.dll
call fcn.1800429cc
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [r12 - 1]
mov r14, qword [rbp - 0x30]
cmp rax, r14
ja 0x180022118
lea rdi, [rbp - 0x48]
cmp r14, 8
cmovae rdi, qword [rbp - 0x48]
mov qword [rbp - 0x38], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.wintrust.dll
mov rcx, rdi
call fcn.180039130
mov word [rbx + rdi], r12w
jmp 0x18002220d
cmp r15, rsi
ja 0x18002253b
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x180022132
mov rbx, rsi
jmp 0x180022153
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180022148
mov rbx, rsi
jmp 0x180022153
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x180022165
mov rdx, r8
jmp 0x18002216e
cmp rdx, 0x1000
jb 0x180022195
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.18003762c
test rax, rax
je 0x180022541
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800221aa
test rdx, rdx
je 0x1800221a7
mov rcx, rdx
call fcn.18003762c
mov rdi, rax
jmp 0x1800221aa
mov rdi, r12
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.wintrust.dll
mov rcx, rdi
call fcn.180039130
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x180022209
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022204
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022547
call fcn.180037624
mov qword [rbp - 0x48], rdi
call fcn.18001b4d0
mov rcx, rax
lea rdx, [rbp - 0x48]
call fcn.18001b570
mov r15, rax
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x180022261
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002225c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002254d
call fcn.180037624
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
lea rcx, str.crypt32.dll
call fcn.1800429cc
mov rbx, rax
mov r14, qword [rbp - 0x10]
cmp rax, r14
ja 0x1800222d3
lea rdi, [rbp - 0x28]
cmp r14, 8
cmovae rdi, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
add rbx, rbx
mov r8, rbx
lea rdx, str.crypt32.dll
mov rcx, rdi
call fcn.180039130
mov word [rbx + rdi], r12w
jmp 0x1800223d8
cmp rbx, rsi
ja 0x180022553
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x180022307
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x180022307
lea rax, [rdx + r14]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x18002232a
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x18002233a
cmp rdx, 0x1000
jb 0x180022361
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003762c
test rax, rax
je 0x180022559
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180022376
test rdx, rdx
je 0x180022373
mov rcx, rdx
call fcn.18003762c
mov rdi, rax
jmp 0x180022376
mov rdi, r12
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
add rbx, rbx
mov r8, rbx
lea rdx, str.crypt32.dll
mov rcx, rdi
call fcn.180039130
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x1800223d4
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800223cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002255f
call fcn.180037624
mov qword [rbp - 0x28], rdi
call fcn.18001b4d0
mov rcx, rax
lea rdx, [rbp - 0x28]
call fcn.18001b570
mov rbx, rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x18002242c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022427
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022535
call fcn.180037624
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
test r15, r15
je 0x180022517
test rbx, rbx
je 0x180022517
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180042954
int3
call fcn.180001eb0
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180001eb0
int3
call fcn.180042954
int3
call fcn.180042954
int3