Function at 0x18004ecb0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
cmp dword [rcx + 0x128], 0
jne 0x18004f0e4
mov dword [rcx + 0x128], 1
mov eax, dword [0x180132740]
test al, 1
jne 0x18004ed17
or eax, 1
mov dword [0x180132740], eax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AddDllDirectory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
setne al
mov byte [0x180132744], al
jmp 0x18004ed1e
movzx eax, byte [0x180132744]
neg al
sbb r8d, r8d
and r8d, 0x800
xor edx, edx
lea rcx, str.WINTRUST.DLL
call qword [0x1800d4958]
mov qword [rbx + 0x130], rax
test rax, rax
je 0x18004f10f
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x138], rax
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x150], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x140], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x148], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x158], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x160], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x168], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1d0], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1d8], rax
lea rdx, str.WTHelperGetProvCertFromChain
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1e0], rax
cmp qword [rbx + 0x138], 0
je 0x18004f10f
cmp qword [rbx + 0x150], 0
je 0x18004f10f
mov rax, qword [rbx + 0x140]
test rax, rax
je 0x18004f10f
cmp qword [rbx + 0x148], 0
je 0x18004f10f
cmp qword [rbx + 0x158], 0
je 0x18004f10f
cmp qword [rbx + 0x160], 0
je 0x18004f10f
cmp qword [rbx + 0x168], 0
je 0x18004f10f
cmp qword [rbx + 0x1d0], 0
je 0x18004f10f
cmp qword [rbx + 0x1d8], 0
je 0x18004f10f
lea rcx, [rbx + 0xf8]
xor r8d, r8d
xor edx, edx
call rax
mov dword [rbx + 0xf0], eax
lea rcx, str.Crypt32.dll
call fcn.180024f90
mov qword [rbx + 0x170], rax
test rax, rax
je 0x18004f10f
lea rdx, [0x1800fd860]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x178], rax
lea rdx, [0x1800fd878]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x180], rax
lea rdx, [0x1800fd888]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x188], rax
lea rdx, [0x1800fd898]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x190], rax
lea rdx, [0x1800fd8b0]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x198], rax
lea rdx, [0x1800fd8c8]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1a0], rax
lea rdx, [0x1800fd8e8]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1a8], rax
lea rdx, [0x1800fd908]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1b0], rax
lea rdx, [0x1800fd920]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1b8], rax
lea rdx, [0x1800fd930]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1c0], rax
lea rdx, [0x1800fd948]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1c8], rax
lea rdx, [0x1800fd958]
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1f0], rax
lea rdx, str.CertDuplicateCertificateContext
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1e8], rax
cmp qword [rbx + 0x178], 0
je 0x18004f10f
cmp qword [rbx + 0x180], 0
je 0x18004f10f
cmp qword [rbx + 0x188], 0
je 0x18004f10f
cmp qword [rbx + 0x190], 0
je 0x18004f10f
cmp qword [rbx + 0x198], 0
je 0x18004f10f
cmp qword [rbx + 0x1a0], 0
je 0x18004f10f
cmp qword [rbx + 0x1a8], 0
je 0x18004f10f
cmp qword [rbx + 0x1b0], 0
je 0x18004f10f
cmp qword [rbx + 0x1b8], 0
je 0x18004f10f
cmp qword [rbx + 0x1c0], 0
je 0x18004f10f
cmp qword [rbx + 0x1c8], 0
je 0x18004f10f
cmp qword [rbx + 0x1f0], 0
jne 0x18004f0f8
jmp 0x18004f10f
cmp qword [rcx + 0x130], 0
je 0x18004f103
cmp qword [rcx + 0x170], 0
je 0x18004f103
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov ecx, dword [rcx + 0x12c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r9, [0x1800f7d08]
lea r8, [0x1800f7d08]
xor edx, edx
xor ecx, ecx
call fcn.1800689dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x12c], eax
mov rcx, rbx
call fcn.18004f150
xor eax, eax
add rsp, 0x30
pop rbx
ret