Function at 0x14004b850
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.wintrust.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [0x14008d518], rax
jne 0x14004b8a7
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004b8a0
test byte [rcx + 0x3c], 1
je 0x14004b8a0
cmp byte [rcx + 0x39], 5
jb 0x14004b8a0
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0xa
call fcn.1400249f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 0xd0
mov qword [rsp + 0x30], rbx
call fcn.14004c8b0
test rax, rax
mov rbx, rax
je 0x14004c45d
xor edx, edx
mov r8d, 0xd0
mov rcx, rax
mov qword [rsp + 0x20], rdi
call fcn.14004c980
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATAdminAcquireContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx], rax
jne 0x14004b94b
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0xb
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATAdminReleaseContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 8], rax
jne 0x14004b9c0
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0xc
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATAdminReleaseCatalogContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10], rax
jne 0x14004ba35
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0xd
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATCatalogInfoFromContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x18], rax
jne 0x14004baaa
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0xe
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATAdminEnumCatalogFromHash
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x20], rax
jne 0x14004bb1f
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0xf
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x28], rax
jne 0x14004bb94
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x10
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.WinVerifyTrust
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x14004bc09
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, FDICreate
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.WTHelperGetProvCertFromChain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008d518]
lea rdx, str.WTHelperGetProvSignerFromChain
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008d518]
lea rdx, str.WTHelperProvDataFromStateData
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x48], rax
jne 0x14004bcae
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, reloc.Cabinet.dll_FDICreate
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATAdminAddCatalog
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x50], rax
jne 0x14004bd23
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, FDIDestroy
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATOpen
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x58], rax
jne 0x14004bd98
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, reloc.Cabinet.dll_FDICopy
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATEnumerateMember
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x68], rax
jne 0x14004be0d
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, reloc.Cabinet.dll_FDIDestroy
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x60], rax
jne 0x14004be82
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x18
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATGetMemberInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x70], rax
jne 0x14004bef7
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x19
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATEnumerateCatAttr
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x78], rax
jne 0x14004bf6c
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x1a
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14008d518]
lea rdx, str.CryptCATEnumerateAttr
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x80], rax
jne 0x14004bfe4
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x1b
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rcx, str.crypt32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
jne 0x14004c051
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x1c
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, [0x1400715e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x88], rax
jne 0x14004c0c5
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x1d
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, [0x1400715d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x90], rax
jne 0x14004c139
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x1e
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, str.CertDeleteCertificateFromStore
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x98], rax
jne 0x14004c1ad
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x1f
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, str.CertCompareCertificate
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0xa0], rax
jne 0x14004c221
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x20
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, str.CertEnumCertificatesInStore
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0xa8], rax
jne 0x14004c295
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x21
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, str.CertAddSerializedElementToStore
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0xb0], rax
jne 0x14004c309
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x22
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0xb8], rax
jne 0x14004c37d
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x23
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, str.CertGetNameStringW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0xc8], rax
jne 0x14004c3ed
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x24
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
lea rdx, [0x140071510]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0xc0], rax
jne 0x14004c455
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x14004c43c
test byte [rcx + 0x3c], 1
je 0x14004c43c
cmp byte [rcx + 0x39], 5
jb 0x14004c43c
mov rcx, qword [rcx + 0x30]
lea r8, [0x140071500]
mov dx, 0x25
call fcn.1400249f0
mov rcx, rbx
call fcn.14004ca6c
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x20]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret