Function at 0x164c948d0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov byte [rsp + 8], cl
push rdi
sub rsp, 0x20
xor esi, esi
mov ebx, 0x32
mov edi, ebx
cmp byte [rsp + 0x30], sil
je 0x164c94a69
mov eax, dword [0x164cf5824]
test eax, eax
jne 0x164c94a50
mov rax, qword [0x164cf5830]
mov dword [0x164cf5824], 0xffffffff
test rax, rax
jne 0x164c94938
lea rcx, str.WinTrust.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x164cf5830], rax
test rax, rax
je 0x164c94a53
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5830]
lea rdx, str.CryptCATAdminAcquireContext
mov qword [0x164cf58a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5830]
lea rdx, str.CryptCATAdminReleaseContext
mov qword [0x164cf58a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5830]
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov qword [0x164cf5898], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5830]
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov qword [0x164cf5890], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5830]
lea rdx, str.CryptCATCatalogInfoFromContext
mov qword [0x164cf5888], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5830]
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov qword [0x164cf5880], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x164cf58a8], rsi
mov qword [0x164cf5878], rax
je 0x164c94a3a
cmp qword [0x164cf58a0], rsi
je 0x164c94a3a
cmp qword [0x164cf5898], rsi
je 0x164c94a3a
cmp qword [0x164cf5890], rsi
je 0x164c94a3a
cmp qword [0x164cf5888], rsi
je 0x164c94a3a
cmp qword [0x164cf5880], rsi
je 0x164c94a3a
test rax, rax
je 0x164c94a3a
mov edi, esi
mov dword [0x164cf5824], 1
jmp 0x164c94a53
mov rcx, qword [0x164cf5830]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x164cf5830], rsi
jmp 0x164c94a53
cmovg edi, esi
test edi, edi
je 0x164c94a69
mov eax, edi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [0x164cf5820]
test eax, eax
jne 0x164c94c04
mov rax, qword [0x164cf5828]
mov dword [0x164cf5820], 0xffffffff
test rax, rax
jne 0x164c94aaa
lea rcx, str.CRYPT32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x164cf5828], rax
test rax, rax
je 0x164c94c07
lea rdx, str.CertFindCertificateInStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5828]
lea rdx, str.CertGetNameStringW
mov qword [0x164cf5870], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5828]
lea rdx, str.CertCloseStore
mov qword [0x164cf5868], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5828]
lea rdx, str.CertFreeCertificateContext
mov qword [0x164cf5860], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5828]
lea rdx, str.CryptQueryObject
mov qword [0x164cf5858], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5828]
lea rdx, str.CryptDecodeObject
mov qword [0x164cf5850], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5828]
lea rdx, str.CryptMsgGetParam
mov qword [0x164cf5848], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5828]
lea rdx, str.CryptMsgClose
mov qword [0x164cf5840], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x164cf5870], rsi
mov qword [0x164cf5838], rax
je 0x164c94bde
cmp qword [0x164cf5868], rsi
je 0x164c94bde
cmp qword [0x164cf5860], rsi
je 0x164c94bde
cmp qword [0x164cf5858], rsi
je 0x164c94bde
cmp qword [0x164cf5850], rsi
je 0x164c94bde
cmp qword [0x164cf5848], rsi
je 0x164c94bde
cmp qword [0x164cf5840], rsi
je 0x164c94bde
test rax, rax
je 0x164c94bde
mov dword [0x164cf5820], 1
mov eax, esi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [0x164cf5828]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov qword [0x164cf5828], rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmovg ebx, esi
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret