Function at 0x180022080
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r13, rcx
xor r12d, r12d
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
lea rcx, str.wintrust.dll
call fcn.1800429ec
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [r12 - 1]
mov r14, qword [rbp - 0x30]
cmp rax, r14
ja 0x180022128
lea rdi, [rbp - 0x48]
cmp r14, 8
cmovae rdi, qword [rbp - 0x48]
mov qword [rbp - 0x38], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.wintrust.dll
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r12w
jmp 0x18002221d
cmp r15, rsi
ja 0x18002254b
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x180022142
mov rbx, rsi
jmp 0x180022163
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180022158
mov rbx, rsi
jmp 0x180022163
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x180022175
mov rdx, r8
jmp 0x18002217e
cmp rdx, 0x1000
jb 0x1800221a5
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.18003764c
test rax, rax
je 0x180022551
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800221ba
test rdx, rdx
je 0x1800221b7
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
jmp 0x1800221ba
mov rdi, r12
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.wintrust.dll
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x180022219
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022214
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022557
call fcn.180037644
mov qword [rbp - 0x48], rdi
call fcn.18001b4e0
mov rcx, rax
lea rdx, [rbp - 0x48]
call fcn.18001b580
mov r15, rax
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x180022271
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002226c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002255d
call fcn.180037644
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
lea rcx, str.crypt32.dll
call fcn.1800429ec
mov rbx, rax
mov r14, qword [rbp - 0x10]
cmp rax, r14
ja 0x1800222e3
lea rdi, [rbp - 0x28]
cmp r14, 8
cmovae rdi, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
add rbx, rbx
mov r8, rbx
lea rdx, str.crypt32.dll
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r12w
jmp 0x1800223e8
cmp rbx, rsi
ja 0x180022563
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x180022317
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x180022317
lea rax, [rdx + r14]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x18002233a
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x18002234a
cmp rdx, 0x1000
jb 0x180022371
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x180022569
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180022386
test rdx, rdx
je 0x180022383
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
jmp 0x180022386
mov rdi, r12
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
add rbx, rbx
mov r8, rbx
lea rdx, str.crypt32.dll
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x1800223e4
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800223df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002256f
call fcn.180037644
mov qword [rbp - 0x28], rdi
call fcn.18001b4e0
mov rcx, rax
lea rdx, [rbp - 0x28]
call fcn.18001b580
mov rbx, rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x18002243c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022437
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022545
call fcn.180037644
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
test r15, r15
je 0x180022527
test rbx, rbx
je 0x180022527
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3