Function at 0x140009428
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x690
mov rax, qword [0x1403bbc88]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov qword [rsp + 0x50], rcx
lea r14, str.Crypt32
mov rcx, r14
mov qword [rsp + 0x58], r9
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x40], edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r12d, r12d
mov rbx, rax
test rax, rax
jne 0x14000949c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14000949c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CertOpenStore
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x1400094dd
lea r9, str.CertOpenStore
mov qword [rsp + 0x20], r14
lea r8, str.Unable_to_locate__s___in__s_n
mov ecx, 3
lea rdx, str.AddCertToTrustedPublisher
call fcn.1400082ac
jmp 0x1400098a0
test rbx, rbx
jne 0x1400094ff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1400094ff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CertCreateCertificateContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x140009520
lea r9, str.CertCreateCertificateContext
jmp 0x1400094bb
test rbx, rbx
jne 0x140009542
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x140009542
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CertFindCertificateInStore
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
jne 0x140009566
lea r9, str.CertFindCertificateInStore
jmp 0x1400094bb
test rbx, rbx
jne 0x140009588
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x140009588
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CertAddCertificateContextToStore
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
jne 0x1400095ac
lea r9, str.CertAddCertificateContextToStore
jmp 0x1400094bb
test rbx, rbx
jne 0x1400095ce
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1400095ce
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CertFreeCertificateContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x1400095f2
lea r9, str.CertFreeCertificateContext
jmp 0x1400094bb
test rbx, rbx
jne 0x140009614
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x140009614
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CertGetNameStringA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x14000963a
lea r9, str.CertGetNameStringA
jmp 0x1400094bb
test rbx, rbx
jne 0x14000965c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14000965c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.CertCloseStore
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x14000968c
lea rax, str.Crypt32
mov qword [rsp + 0x20], rax
lea r9, str.CertCloseStore
jmp 0x1400094c0
xor r8d, r8d
lea rax, str.TrustedPublisher
mov r9d, 0x20000
mov qword [rsp + 0x20], rax
lea edx, [r8 + 1]
lea ecx, [rdx + 8]
call rdi
mov rdi, rax
test rax, rax
jne 0x1400096d7
xor ecx, ecx
call fcn.14000bf20
mov r9, rax
lea r8, str.Unable_to_open_system_store:__s
lea rdx, str.AddCertToTrustedPublisher
lea ecx, [rdi + 2]
call fcn.1400082ac
jmp 0x1400098a0
mov r8d, dword [rsp + 0x40]
mov ecx, 1
mov rdx, qword [rsp + 0x50]
call rsi
mov rsi, rax
test rax, rax
jne 0x14000971d
xor ecx, ecx
call fcn.14000bf20
mov r9, rax
lea r8, str.Could_not_create_context_for_certificate:__s
lea rdx, str.AddCertToTrustedPublisher
lea ecx, [rsi + 2]
call fcn.1400082ac
xor edx, edx
mov rcx, rdi
call r14
jmp 0x140009898
and qword [rsp + 0x28], r12
xor r8d, r8d
mov r9d, 0xd0000
mov qword [rsp + 0x20], rsi
mov rcx, rdi
lea edx, [r8 + 1]
call rbp
mov rbp, rax
xor eax, eax
test rbp, rbp
jne 0x140009881
cmp dword [rsp + 0x44], eax
jne 0x140009849
mov byte [rsp + 0x170], al
lea r9, str.2.5.4.10
mov byte [rsp + 0x60], al
lea edx, [rbp + 3]
lea rax, [rsp + 0x170]
mov dword [rsp + 0x28], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x104
lea r9, str.2.5.4.11
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rbp + 3]
mov rcx, rsi
call qword [rsp + 0x48]
mov cl, byte [rsp + 0x60]
lea rdx, [0x1403a5e40]
test cl, cl
lea r8, [0x14039c41c]
mov rax, rdx
lea r9, [rsp + 0x170]
cmovne rax, r8
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x30], rax
lea r8, [0x14039c420]
cmovne rdx, r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r8, str.Warning:_this_software_is_about_to_install_the_following_organization_nas_a_Trusted_Publisher_on_your_system:_n_n__s_s_s_s_n_nThis_will_allow_this_Publisher_to_run_software_with_elevated_privileges__nas_well_as_install_driver_packages__without_further_security_notices._n_nIf_this_is_not_what_you_want__you_can_cancel_this_operation_now.
mov qword [rsp + 0x20], rdx
mov edx, 0x400
call fcn.1400031e0
mov rcx, qword [rsp + 0x58]
lea r9d, [rbp + 0x31]
lea r8, str.Warning:_Trusted_Certificate_installation
mov byte [rsp + 0x67f], r12b
lea rdx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
je 0x140009849
lea r8, str.Operation_cancelled_by_the_user
lea rdx, str.AddCertToTrustedPublisher
lea ecx, [rbp + 1]
call fcn.1400082ac
jmp 0x140009887
xor r9d, r9d
mov rdx, rsi
mov rcx, rdi
lea r8d, [r9 + 6]
call r13
test eax, eax
jne 0x140009881
xor ecx, ecx
call fcn.14000bf20
mov r9, rax
lea r8, str.Could_not_add_certificate:__s
lea rdx, str.AddCertToTrustedPublisher
mov ecx, 2
call fcn.1400082ac
jmp 0x140009887
mov r12d, 1
mov rcx, rsi
call r15
test rbp, rbp
je 0x140009898
mov rcx, rbp
call r15
xor edx, edx
mov rcx, rdi
call r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, r12d
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.14000c340
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x690
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret