Function at 0x14014ac20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rcx, str.wintrust.dll
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.crypt32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
mov ebp, 0x5a4d
mov rsi, rax
test rdi, rdi
je 0x14014b0e2
movzx ecx, word [rdi]
cmp cx, bp
jne 0x14014accb
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014accb
cmp dword [rdx + rdi], 0x4550
jne 0x14014accb
lea r8, [rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014acc2
cmp dword [r8 + 4], ebx
je 0x14014acc2
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word ds:[rdi]
jmp 0x14014acce
mov qword [0x1402178a0], rbx
jmp 0x14014acda
mov rax, rbx
mov qword [0x1402178a0], rax
cmp cx, bp
jne 0x14014ad2c
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014ad2c
cmp dword [rdx + rdi], 0x4550
jne 0x14014ad2c
lea r8, ds:[rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014ad2c
cmp dword [r8 + 4], ebx
je 0x14014ad2c
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CryptCATAdminCalcHashFromFileHandle2
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014ad2f
mov rax, rbx
mov qword [0x140217848], rax
cmp cx, bp
jne 0x14014ad95
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014ad95
cmp dword [rdx + rdi], 0x4550
jne 0x14014ad95
lea r8, ds:[rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014ad8c
cmp dword [r8 + 4], ebx
je 0x14014ad8c
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CryptCATAdminAcquireContext
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014ad98
mov qword [0x140217860], rbx
jmp 0x14014ada5
mov rax, rbx
mov qword [0x140217860], rax
nop
cmp cx, bp
jne 0x14014adfd
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014adfd
cmp dword [rdx + rdi], 0x4550
jne 0x14014adfd
lea r8, [rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014adf4
cmp dword [r8 + 4], ebx
je 0x14014adf4
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CryptCATAdminAcquireContext2
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014ae00
mov qword [0x140217890], rbx
jmp 0x14014ae0c
mov rax, rbx
mov qword [0x140217890], rax
cmp cx, bp
jne 0x14014ae64
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014ae64
cmp dword [rdx + rdi], 0x4550
jne 0x14014ae64
lea r8, [rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014ae5b
cmp dword [r8 + 4], ebx
je 0x14014ae5b
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014ae67
mov qword [0x140217870], rbx
jmp 0x14014ae73
mov rax, rbx
mov qword [0x140217870], rax
cmp cx, bp
jne 0x14014aed5
mov edx, dword ds:[rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014aed5
cmp dword [rdx + rdi], 0x4550
jne 0x14014aed5
lea r8, ds:[rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014aecc
cmp dword [r8 + 4], ebx
je 0x14014aecc
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CryptCATCatalogInfoFromContext
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014aed8
mov qword [0x140217850], rbx
jmp 0x14014aee5
mov rax, rbx
mov qword [0x140217850], rax
nop
cmp cx, bp
jne 0x14014af3d
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014af3d
cmp dword [rdx + rdi], 0x4550
jne 0x14014af3d
lea r8, [rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014af34
cmp dword [r8 + 4], ebx
je 0x14014af34
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CryptCATAdminReleaseCatalogContext
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014af40
mov qword [0x140217838], rbx
jmp 0x14014af4c
mov rax, rbx
mov qword [0x140217838], rax
cmp cx, bp
jne 0x14014afa4
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014afa4
cmp dword [rdx + rdi], 0x4550
jne 0x14014afa4
lea r8, [rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014af9b
cmp dword [r8 + 4], ebx
je 0x14014af9b
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CryptCATAdminReleaseContext
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014afa7
mov qword [0x140217840], rbx
jmp 0x14014afb3
mov rax, rbx
mov qword [0x140217840], rax
cmp cx, bp
jne 0x14014b015
mov edx, dword ds:[rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014b015
cmp dword [rdx + rdi], 0x4550
jne 0x14014b015
lea r8, ds:[rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014b00c
cmp dword [r8 + 4], ebx
je 0x14014b00c
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.WTHelperProvDataFromStateData
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014b018
mov qword [0x140217898], rbx
jmp 0x14014b025
mov rax, rbx
mov qword [0x140217898], rax
nop
cmp cx, bp
jne 0x14014b07d
mov edx, dword [rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014b07d
cmp dword [rdx + rdi], 0x4550
jne 0x14014b07d
lea r8, [rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014b074
cmp dword [r8 + 4], ebx
je 0x14014b074
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.WTHelperGetProvSignerFromChain
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rdi]
jmp 0x14014b080
mov qword [0x140217858], rbx
jmp 0x14014b08c
mov rax, rbx
mov qword [0x140217858], rax
cmp cx, bp
jne 0x14014b0d8
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x14014b0d8
cmp dword [rcx + rdi], 0x4550
jne 0x14014b0d8
lea r8, [rdi + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x14014b0d8
cmp dword [r8 + 4], ebx
je 0x14014b0d8
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, str.WinVerifyTrust
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
jmp 0x14014b0db
mov rax, rbx
mov qword [0x140217888], rax
test rsi, rsi
je 0x14014b219
movzx ecx, word [rsi]
cmp cx, bp
jne 0x14014b155
mov edx, dword ds:[rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014b155
cmp dword [rdx + rsi], 0x4550
jne 0x14014b155
lea r8, ds:[rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014b14c
cmp dword [r8 + 4], ebx
je 0x14014b14c
lea r9, [rsi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CertNameToStrW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x14014b158
mov qword [0x140217868], rbx
jmp 0x14014b165
mov rax, rbx
mov qword [0x140217868], rax
nop
cmp cx, bp
jne 0x14014b1b4
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14014b1b4
cmp dword [rdx + rsi], 0x4550
jne 0x14014b1b4
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14014b1b4
cmp dword [r8 + 4], ebx
je 0x14014b1b4
lea r9, [rsi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CertDuplicateCertificateContext
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x14014b1b7
mov rax, rbx
mov qword [0x140217878], rax
nop
cmp cx, bp
jne 0x14014b212
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x14014b212
cmp dword [rcx + rsi], 0x4550
jne 0x14014b212
lea r8, [rsi + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x14014b212
cmp dword [r8 + 4], ebx
je 0x14014b212
lea r9, [rsi + rax]
mov word [rsp + 0x28], bx
lea rax, str.CertFreeCertificateContext
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rbx, rax
mov qword [0x140217880], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret