Function at 0x1400be640
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rax, vtable.Hmpa::WinVerifyFileClassifier.0
mov qword [rcx], rax
mov byte [rcx + 8], 1
xor edi, edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rdi
mov qword [rcx + 0x50], rdi
mov qword [rcx + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x28]
lea edx, [rdi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400be6d0
lea rdx, str.SeBackupPrivilege
mov rcx, qword [rsp + 0x28]
call fcn.1401d65c0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x28]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400be709
lea rdx, str.SeRestorePrivilege
mov rcx, qword [rsp + 0x28]
call fcn.1401d65c0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.wintrust.dll
call fcn.1400ca810
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400be747
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], rdi
jmp 0x1400be817
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
lea rdx, str.CryptCATAdminAcquireContext2
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
lea rdx, str.CryptCATAdminCalcHashFromFileHandle2
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x50], rdi
je 0x1400be812
test rax, rax
je 0x1400be812
mov al, 1
jmp 0x1400be814
xor al, al
mov byte [rbx + 8], al
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret