Function at 0x14000ca4c
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2380]
mov eax, 0x2480
call fcn.1400160e0
sub rsp, rax
mov rax, qword [0x14001f078]
xor rax, rsp
mov qword [rbp + 0x2370], rax
mov r15, rdx
mov r14, rcx
mov r13d, 0x400
lea rcx, [rbp + 0xf70]
mov r8d, r13d
xor edx, edx
call sub.msvcrt.dll_memset
or rbx, 0xffffffffffffffff
lea rcx, [rbp + 0x1f70]
mov r8d, r13d
xor edx, edx
mov rsi, rbx
call sub.msvcrt.dll_memset
mov rcx, qword [r14 + 0x40038]
xor r12d, r12d
mov dword [rbp + 0xb64], r12d
mov edi, r12d
mov byte [rsp + 0x60], r12b
mov byte [rbp + 0xb63], r12b
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x50], r12
test rcx, rcx
je 0x14000d0f2
mov rax, rbx
inc rax
cmp byte [rcx + rax], r12b
jne 0x14000caf2
cmp rax, r13
jae 0x14000d0f2
mov rax, qword [r14 + 0x40030]
test rax, rax
je 0x14000d0eb
cmp qword [rax + 0x2d30], r12
je 0x14000d0eb
lea rdx, [rbp + 0x1f70]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
nop dword [rax + rax]
test eax, eax
jne 0x14000cb64
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x14000d112
lea r9, [rbp + 0xf70]
xor r8d, r8d
lea rdx, [0x14001b30c]
lea rcx, [rbp + 0x1f70]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop dword [rax + rax]
test eax, eax
je 0x14000cb3b
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0xf70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rsi, rax
cmp rax, rbx
je 0x14000cb3b
lea rdx, str._CatalogHeader__r_n
lea rcx, [rsp + 0x60]
call fcn.14000eef8
mov ebx, eax
test eax, eax
js 0x14000d112
mov r8, qword [r14 + 0x40038]
lea rdx, str.Name_s_r_n
lea rcx, [rsp + 0x60]
call fcn.14000eef8
mov ebx, eax
test eax, eax
js 0x14000d112
lea rdx, str.PublicVersion0x0000001_r_n
lea rcx, [rsp + 0x60]
call fcn.14000eef8
mov ebx, eax
test eax, eax
js 0x14000d112
lea rdx, str.EncodingType0x00010001_r_n
lea rcx, [rsp + 0x60]
call fcn.14000eef8
mov ebx, eax
test eax, eax
js 0x14000d112
lea rdx, str.CATATTR10x10010001:OSAttr:2:5.1_r_n
lea rcx, [rsp + 0x60]
call fcn.14000eef8
mov ebx, eax
test eax, eax
js 0x14000d112
lea rdx, str._CatalogFiles__r_n
lea rcx, [rsp + 0x60]
call fcn.14000eef8
mov ebx, eax
test eax, eax
js 0x14000d112
mov rdx, qword [r14 + 0x40030]
mov rax, qword [rdx + 0x2d30]
cmp dword [rax + 0x1008], r12d
jbe 0x14000cce7
mov rax, qword [rdx + 0x2d30]
mov ecx, edi
add rcx, rcx
mov r8, qword [rax + rcx*8 + 0x808]
test r8, r8
je 0x14000cec4
cmp byte [r8], r12b
je 0x14000cec4
mov r9, r8
lea rdx, str._hash__s_s_r_n
lea rcx, [rsp + 0x60]
call fcn.14000eef8
mov ebx, eax
test eax, eax
js 0x14000d112
mov rdx, qword [r14 + 0x40030]
inc edi
mov rax, qword [rdx + 0x2d30]
cmp edi, dword [rax + 0x1008]
jb 0x14000cc8b
mov ebx, dword [rbp + 0xb64]
lea r9, [rsp + 0x40]
mov r8d, ebx
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x14000cb3b
cmp dword [rsp + 0x40], ebx
jne 0x14000cb3b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edi, 0xc00
lea r8, str.makecat__n__v
mov edx, edi
lea rcx, [rbp + 0x1370]
or rsi, 0xffffffffffffffff
call fcn.140001c90
mov ebx, eax
test eax, eax
js 0x14000d112
lea r8, [rbp + 0xf70]
mov edx, edi
lea rcx, [rbp + 0x1370]
call fcn.140007b6c
mov ebx, eax
test eax, eax
js 0x14000d112
lea r8, [rbp + 0x1370]
mov rdx, r15
call fcn.14000c8cc
mov ebx, eax
test eax, eax
js 0x14000d112
lea r8, str.setreg__q_1_TRUE
mov edx, edi
lea rcx, [rbp + 0x1370]
call fcn.140001c90
mov ebx, eax
test eax, eax
js 0x14000d112
lea r8, [rbp + 0x1370]
mov rdx, r15
call fcn.14000c8cc
mov ebx, eax
test eax, eax
js 0x14000d112
mov r8d, r13d
lea rdx, [rbp + 0xb70]
lea rcx, str.NT_CERTHASH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax + rax]
mov dword [rsp + 0x40], eax
dec eax
cmp eax, 0x3ff
ja 0x14000d0e4
lea r8, str.signcode__sha1
mov edx, edi
lea rcx, [rbp + 0x1370]
call fcn.140001c90
mov ebx, eax
test eax, eax
js 0x14000d112
lea r8, [rbp + 0xb70]
mov edx, edi
lea rcx, [rbp + 0x1370]
call fcn.140007b6c
mov ebx, eax
test eax, eax
js 0x14000d112
lea r8, str.__n__Microsoft_DRM_gene_generated_Manifest_
mov edx, edi
lea rcx, [rbp + 0x1370]
call fcn.140007b6c
mov ebx, eax
test eax, eax
js 0x14000d112
mov r8, qword [r14 + 0x40038]
lea rcx, [rbp + 0x1370]
mov edx, edi
call fcn.140007b6c
mov ebx, eax
test eax, eax
js 0x14000d112
lea r8, [rbp + 0x1370]
mov rdx, r15
call fcn.14000c8cc
mov ebx, eax
test eax, eax
js 0x14000d112
or rdi, rsi
lea rcx, [rbp + 0xb70]
mov rax, rdi
inc rax
cmp byte [rcx + rax], r12b
jne 0x14000ce97
shr rax, 1
inc eax
mov ecx, eax
mov dword [rsp + 0x48], eax
call fcn.140015308
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x14000cece
mov ebx, 0x8007000e
jmp 0x14000d112
mov ebx, 0x8007064a
jmp 0x14000d112
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_memset
mov r10d, r12d
lea rax, [rbp + 0xb70]
mov rdx, rdi
inc rdx
cmp byte [rax + rdx], r12b
jne 0x14000ceec
test rdx, rdx
je 0x14000cfb5
mov r9, r12
mov r11b, 5
movsx r8d, byte [rbp + r9 + 0xb70]
mov ecx, r12d
lea eax, [r8 - 0x61]
cmp al, r11b
ja 0x14000cf1f
lea ecx, [r8 - 0x57]
jmp 0x14000cf3a
lea eax, [r8 - 0x41]
cmp al, r11b
ja 0x14000cf2e
lea ecx, [r8 - 0x37]
jmp 0x14000cf3a
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x14000cf3a
lea ecx, [r8 - 0x30]
lea eax, [r10 + 1]
shl ecx, 4
mov r8d, eax
cmp r8, rdx
jae 0x14000cf77
movsx edx, byte [rbp + rax + 0xb70]
lea eax, [rdx - 0x61]
cmp al, r11b
ja 0x14000cf5e
add ecx, 0xffffffa9
jmp 0x14000cf75
lea eax, [rdx - 0x41]
cmp al, r11b
ja 0x14000cf6b
add ecx, 0xffffffc9
jmp 0x14000cf75
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x14000cf77
add ecx, 0xffffffd0
add ecx, edx
mov eax, r10d
shr eax, 1
cmp dword [rsp + 0x48], eax
jb 0x14000ceba
mov rax, qword [rsp + 0x50]
mov rdx, rdi
shr r9, 1
add r10d, 2
mov byte [r9 + rax], cl
lea rax, [rbp + 0xb70]
inc rdx
cmp byte [rax + rdx], r12b
jne 0x14000cfa0
mov r9d, r10d
cmp r9, rdx
jb 0x14000cf04
lea rdx, [0x14001b440]
xor ecx, ecx
call qword [sym.imp.CRYPT32.dll_CertOpenSystemStoreA]
nop dword [rax + rax]
test rax, rax
je 0x14000cb3b
mov r9d, 0x10000
mov qword [rsp + 0x28], r12
lea rcx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rax
lea r13d, [r9 + 1]
mov edx, r13d
call qword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14000d0dd
mov r8, qword [rax + 0x18]
test r8, r8
je 0x14000d0dd
mov r9d, dword [r8 + 0x78]
lea rsi, [r14 + 0x40048]
mov r8, qword [r8 + 0x80]
mov edx, 0x13
mov qword [rsp + 0x38], rsi
mov ecx, r13d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
nop dword [rax + rax]
test eax, eax
jne 0x14000d07e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x14000d0f7
cmp dword [rsi], r12d
je 0x14000d0f7
mov ecx, dword [rsi]
call fcn.140015308
mov qword [r14 + 0x40040], rax
test rax, rax
jne 0x14000d09d
mov ebx, 0x8007000e
jmp 0x14000d0f7
mov r8, qword [rdi + 0x18]
mov edx, 0x13
mov qword [rsp + 0x38], rsi
mov ecx, r13d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov r9d, dword [r8 + 0x78]
mov r8, qword [r8 + 0x80]
mov dword [rsp + 0x20], r12d
call qword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
nop dword [rax + rax]
test eax, eax
jne 0x14000d0f7
jmp 0x14000d058
mov ebx, 0x80004005
jmp 0x14000d0f7
mov ebx, 0x80004005
jmp 0x14000d112
mov ebx, 0x80004003
jmp 0x14000d112
mov ebx, 0x80070057
or r14, 0xffffffffffffffff
mov rsi, r14
test rdi, rdi
je 0x14000d112
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
cmp rsi, 0xffffffffffffffff
je 0x14000d138
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
jns 0x14000d14e
mov r8d, ebx
lea rdx, str.XML__WriteCatFile_failed:__hr_r_n
mov rcx, r15
call fcn.14000eef8
mov eax, ebx
mov rcx, qword [rbp + 0x2370]
xor rcx, rsp
call fcn.1400156d0
mov rbx, qword [rsp + 0x24d0]
add rsp, 0x2480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret