Function at 0x14002583f
Capabilities:
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
xor edi, edi
xor ebp, ebp
mov qword [rsp + 0x98], rdi
mov rsi, rcx
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0x90], ebp
test rcx, rcx
jne 0x140025906
mov edx, 2
mov ecx, 0x104
call sub.msvcrt.dll_vfprintf
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140025d0c
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov rcx, rax
test rax, rax
jne 0x1400258b7
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_get_current_executable_handle:__s
mov rdx, rax
jmp 0x1400258db
mov rdx, qword [rsp + 0x68]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.DLL_SetDefaultDllDirectoriSetEvent]
test eax, eax
jne 0x1400258e5
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_get_module_filename:__s
mov rdx, rax
call fcn.140038472
jmp 0x140025d0c
cmp eax, 0x104
jne 0x1400258f7
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp eax, 0x7a
je 0x1400258cc
mov rcx, qword [rsp + 0x68]
call fcn.140024e10
mov r13, rax
jmp 0x140025913
call fcn.140024ece
xor r13d, r13d
mov qword [rsp + 0x68], rax
xor r11d, r11d
xor ebx, ebx
mov rdx, qword [rsp + 0x68]
mov r9d, 2
mov qword [rsp + 0x50], r11
lea rax, [rsp + 0xa0]
mov ecx, 1
mov r8d, 0x400
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [0x14011c290]
test eax, eax
jne 0x1400259a2
call fcn.140024ffd
test rsi, rsi
lea rcx, str.PKI:_Failed_to_get_signature_for__s:__s
cmove rsi, r13
mov r8, rax
mov rdx, rsi
call fcn.140038472
jmp 0x1400259e4
lea rbx, [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rbx
mov r15, qword [0x14011c278]
mov edx, 6
call r15
test eax, eax
jne 0x1400259ed
call fcn.140024ffd
lea rcx, str.PKI:_Failed_to_get_signer_size:__s
mov rdx, rax
call fcn.140038472
xor ebx, ebx
xor edi, edi
jmp 0x140025d13
mov ecx, dword [rsp + 0x90]
mov edx, 1
call sub.msvcrt.dll_vfprintf
mov rdi, rax
test rax, rax
jne 0x140025a14
lea rcx, str.PKI:_Could_not_allocate_memory_for_signer_information
call fcn.140038472
jmp 0x1400259e4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r9, rax
mov edx, 6
mov rcx, qword [rsp + 0xa0]
call r15
test eax, eax
jne 0x140025a4c
call fcn.140024ffd
lea rcx, str.PKI:_Failed_to_get_signer_information:__s
mov rdx, rax
call fcn.140038472
jmp 0x140025d11
mov rcx, rdi
call fcn.1400252cb
mov rbx, rax
test rax, rax
je 0x140025a7d
mov rcx, rax
call fcn.1400390b5
test rsi, rsi
mov rdx, r13
lea rcx, str.Note:__s_has_timestamp__s
cmovne rdx, rsi
mov r8, rax
call fcn.140038472
xor r9d, r9d
xor r8d, r8d
xor r10d, r10d
xor r12d, r12d
mov dword [rsp + 0x94], r8d
xor ebp, ebp
xor r14d, r14d
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x7c], r10d
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140025ac5
call qword [0x14011c668]
xor ecx, ecx
mov qword [rsp + 0xa8], rcx
test r12, r12
je 0x140025ad3
mov rcx, r12
call qword [0x14011c270]
mov rcx, rbp
call fcn.1400796c8
mov eax, dword [rsp + 0x7c]
cmp eax, dword [rdi + 0x78]
jae 0x140025cae
mov ebp, eax
mov rax, qword [rdi + 0x80]
lea rdx, str.1.3.6.1.4.1.311.2.4.1
imul rbp, rbp, 0x18
mov rcx, qword [rax + rbp]
call qword [0x14011c7e0]
test eax, eax
jne 0x140025ca0
test r14d, r14d
je 0x140025b24
lea rcx, str.PKI:_Multiple_nested_signatures_found._This_could_indicate_something_very_nasty...
call fcn.140038472
jmp 0x140025d13
mov rax, qword [rdi + 0x80]
lea rdx, [rsp + 0xa8]
mov ecx, 0x10000
lea r14, [rsp + 0x94]
mov rax, qword [rax + rbp + 0x10]
mov r8, qword [rax + 8]
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x28], rdx
mov edx, 0x21
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x20], 0x8000
mov r9d, dword [rax]
call qword [sym.imp.CRYPT32.dll_CryptMsgUpdate]
test eax, eax
jne 0x140025b8d
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_retrieve_nested_signature_data:__s
xor r12d, r12d
mov rdx, rax
call fcn.140038472
jmp 0x140025c02
xor eax, eax
xor r9d, r9d
mov r8d, 2
mov edx, 4
mov qword [rsp + 0x28], rax
mov ecx, 0x10001
mov qword [rsp + 0x20], rax
call qword [0x14011c280]
mov r12, rax
test rax, rax
jne 0x140025bcb
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_create_nested_signature_message:__s
mov rdx, rax
jmp 0x140025bfd
mov rax, qword [rsp + 0xa8]
mov r9d, 1
mov rcx, r12
mov rdx, qword [rax + 0x10]
mov r8d, dword [rax + 8]
call qword [0x14011c288]
test eax, eax
jne 0x140025c09
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_update_message:__s
mov rdx, rax
call fcn.140038472
xor ebp, ebp
jmp 0x140025c98
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov edx, 6
mov rcx, r12
call r15
test eax, eax
jne 0x140025c34
call fcn.140024ffd
lea rcx, str.PKI:_Failed_to_get_nested_signer_size:__s
mov rdx, rax
jmp 0x140025bfd
mov ecx, dword [rsp + 0x94]
mov edx, 1
call sub.msvcrt.dll_vfprintf
mov rbp, rax
test rax, rax
jne 0x140025c5b
lea rcx, str.PKI:_Could_not_allocate_memory_for_nested_signer
call fcn.140038472
jmp 0x140025c02
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov r9, rax
mov edx, 6
mov rcx, r12
call r15
test eax, eax
jne 0x140025c8b
call fcn.140024ffd
lea rcx, str.PKI:_Failed_to_get_nested_signer_information:__s
mov rdx, rax
call fcn.140038472
jmp 0x140025c98
mov rcx, rbp
call fcn.1400252cb
mov qword [rsp + 0x70], rax
mov r14d, 1
jmp 0x140025ca5
xor r12d, r12d
xor ebp, ebp
inc dword [rsp + 0x7c]
jmp 0x140025aa8
cmp qword [rsp + 0x70], 0
je 0x140025d13
mov rcx, qword [rsp + 0x70]
call fcn.1400390b5
test rsi, rsi
lea rcx, str.Note:__s_has_nested_timestamp__s
cmove rsi, r13
mov r8, rax
mov rdx, rsi
call fcn.140038472
test rbx, rbx
je 0x140025d13
mov rdx, qword [rsp + 0x70]
sub rdx, rbx
mov rax, rdx
neg rax
cmovs rax, rdx
cmp rax, 0x64
jle 0x140025d13
mov r8, qword [rsp + 0x70]
mov rdx, rbx
lea rcx, str.PKI:_Signature_timestamp_and_nested_timestamp_differ_by_more_than_a_minute._This_could_indicate_something_very_nasty...
call fcn.140038472
jmp 0x140025d11
xor edi, edi
xor r13d, r13d
xor ebx, ebx
mov rcx, r13
call fcn.1400796c8
mov rcx, qword [rsp + 0x68]
call fcn.1400796c8
mov rcx, rdi
call fcn.1400796c8
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140025d42
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140025d55
call qword [0x14011c270]
mov rax, rbx
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret