Function at 0x1800238f0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r13, rcx
xor r12d, r12d
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
lea rcx, str.wintrust.dll
call fcn.180042f9c
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [r12 - 1]
mov r14, qword [rbp - 0x30]
cmp rax, r14
ja 0x180023998
lea rdi, [rbp - 0x48]
cmp r14, 8
cmovae rdi, qword [rbp - 0x48]
mov qword [rbp - 0x38], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.wintrust.dll
mov rcx, rdi
call fcn.180039700
mov word [rbx + rdi], r12w
jmp 0x180023a8d
cmp r15, rsi
ja 0x180023dbb
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x1800239b2
mov rbx, rsi
jmp 0x1800239d3
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x1800239c8
mov rbx, rsi
jmp 0x1800239d3
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x1800239e5
mov rdx, r8
jmp 0x1800239ee
cmp rdx, 0x1000
jb 0x180023a15
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.180037bfc
test rax, rax
je 0x180023dc1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180023a2a
test rdx, rdx
je 0x180023a27
mov rcx, rdx
call fcn.180037bfc
mov rdi, rax
jmp 0x180023a2a
mov rdi, r12
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.wintrust.dll
mov rcx, rdi
call fcn.180039700
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x180023a89
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023a84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023dc7
call fcn.180037bf4
mov qword [rbp - 0x48], rdi
call fcn.180018aa0
mov rcx, rax
lea rdx, [rbp - 0x48]
call fcn.180018b40
mov r15, rax
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x180023ae1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023adc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023dcd
call fcn.180037bf4
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
lea rcx, str.crypt32.dll
call fcn.180042f9c
mov rbx, rax
mov r14, qword [rbp - 0x10]
cmp rax, r14
ja 0x180023b53
lea rdi, [rbp - 0x28]
cmp r14, 8
cmovae rdi, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
add rbx, rbx
mov r8, rbx
lea rdx, str.crypt32.dll
mov rcx, rdi
call fcn.180039700
mov word [rbx + rdi], r12w
jmp 0x180023c58
cmp rbx, rsi
ja 0x180023dd3
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x180023b87
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x180023b87
lea rax, [rdx + r14]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180023baa
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180023bba
cmp rdx, 0x1000
jb 0x180023be1
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.180037bfc
test rax, rax
je 0x180023dd9
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180023bf6
test rdx, rdx
je 0x180023bf3
mov rcx, rdx
call fcn.180037bfc
mov rdi, rax
jmp 0x180023bf6
mov rdi, r12
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
add rbx, rbx
mov r8, rbx
lea rdx, str.crypt32.dll
mov rcx, rdi
call fcn.180039700
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x180023c54
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023c4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023ddf
call fcn.180037bf4
mov qword [rbp - 0x28], rdi
call fcn.180018aa0
mov rcx, rax
lea rdx, [rbp - 0x28]
call fcn.180018b40
mov rbx, rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x180023cac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023ca7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023db5
call fcn.180037bf4
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
test r15, r15
je 0x180023d97
test rbx, rbx
je 0x180023d97
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13 + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180042f24
int3
call fcn.180001ee0
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180001ee0
int3
call fcn.180042f24
int3
call fcn.180042f24
int3