Function at 0x1400ffa10
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
lea rcx, str.wintrust.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.crypt32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea r9, [rbp + 0x30]
mov dword [rbp - 0x10], 0x240023
mov rdi, rax
lea rdx, [rbp - 0x10]
lea rax, str.CryptCATAdminCalcHashFromFileHandle
xor r8d, r8d
mov rcx, rbx
mov qword [rbp - 8], rax
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
xor r13d, r13d
mov dword [rbp - 0x10], 0x250024
test eax, eax
lea rdx, [rbp - 0x10]
lea rax, str.CryptCATAdminCalcHashFromFileHandle2
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196580], rcx
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x1c001b
lea rax, str.CryptCATAdminAcquireContext
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196528], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x1d001c
lea rax, str.CryptCATAdminAcquireContext2
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196540], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x210020
lea rax, str.CryptCATAdminEnumCatalogFromHash
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196570], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x1f001e
lea rax, str.CryptCATCatalogInfoFromContext
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196550], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x230022
lea rax, str.CryptCATAdminReleaseCatalogContext
cmovs rcx, r13
mov qword [0x140196530], rcx
lea r9, [rbp + 0x30]
mov qword [rbp - 8], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x1c001b
lea rax, str.CryptCATAdminReleaseContext
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196518], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x1e001d
lea rax, str.WTHelperProvDataFromStateData
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196520], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x1f001e
lea rax, str.WTHelperGetProvSignerFromChain
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196578], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0xf000e
lea rax, str.WinVerifyTrust
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196538], rcx
lea rdx, [rbp - 0x10]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0xf000e
lea rax, str.CertNameToStrW
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196568], rcx
lea rdx, [rbp - 0x10]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
lea r9, [rbp + 0x30]
test eax, eax
mov dword [rbp - 0x10], 0x20001f
lea rax, str.CertDuplicateCertificateContext
cmovs rcx, r13
mov qword [rbp - 8], rax
mov qword [0x140196548], rcx
lea rdx, [rbp - 0x10]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
test eax, eax
cmovs rcx, r13
mov qword [0x140196558], rcx
lea rax, str.CertFreeCertificateContext
mov rcx, rdi
mov qword [rbp - 8], rax
lea r9, [rbp + 0x30]
mov dword [rbp - 0x10], 0x1b001a
xor r8d, r8d
lea rdx, [rbp - 0x10]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0x30]
test eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
cmovs rcx, r13
mov rdi, qword [rsp + 0x78]
mov qword [0x140196560], rcx
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret