Function at 0x1401ad9e0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rsi
lea rcx, str.wintrust.dll
mov qword [rsp + 0x60], rdi
xor edx, edx
mov qword [rsp + 0x68], r12
mov r8d, 0x800
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x1401ada5c
xor edx, edx
lea rcx, str.wintrust.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401ada5c
cmp dword [0x1402c0f40], 0x3e
jae 0x1401ada59
xor r8d, r8d
lea rcx, str.wintrust.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401ada5c
mov rdi, rbx
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401adabc
xor edx, edx
lea rcx, str.crypt32.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401adabc
cmp dword [0x1402c0f40], 0x3e
jae 0x1401adab9
xor r8d, r8d
lea rcx, str.crypt32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1401adabc
mov rsi, rbx
mov r12d, 0x5a4d
mov r15d, 0x3c
test rdi, rdi
je 0x1401ade3b
mov qword ss:[rsp + 0x50], rbp
mov qword [rsp + 0x38], r14
cmp word [rdi], r12w
jne 0x1401adb2b
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401adb2b
cmp dword [rcx + rdi], 0x4550
jne 0x1401adb2b
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401adb2b
cmp dword [rdx + 4], ebx
je 0x1401adb2b
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rdi
call fcn.14017f180
jmp 0x1401adb2e
mov rax, rbx
mov rbp, rdi
mov r14, r15
mov qword [0x1402cfbc0], rax
cmp word [rdi], r12w
jne 0x1401adb8c
mov ecx, dword [r15 + rdi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401adb8c
cmp dword [rcx + rdi], 0x4550
jne 0x1401adb8c
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401adb8c
cmp dword [rdx + 4], ebx
je 0x1401adb8c
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminCalcHashFromFileHandle2
mov rcx, rdi
call fcn.14017f180
jmp 0x1401adb8f
mov rax, rbx
mov qword [0x1402cfb78], rax
cmp word [rdi], r12w
jne 0x1401adbe7
mov ecx, dword [r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401adbe7
cmp dword [rcx + rdi], 0x4550
jne 0x1401adbe7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401adbe7
cmp dword [rdx + 4], ebx
je 0x1401adbe7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext
mov rcx, rdi
call fcn.14017f180
jmp 0x1401adbea
mov rax, rbx
mov qword [0x1402cfb88], rax
cmp word [rdi], r12w
jne 0x1401adc47
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401adc47
cmp dword [rcx + rdi], 0x4550
jne 0x1401adc47
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401adc47
cmp dword [rdx + 4], ebx
je 0x1401adc47
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminAcquireContext2
mov rcx, rdi
call fcn.14017f180
jmp 0x1401adc4a
mov rax, rbx
mov qword [0x1402cfbb8], rax
cmp word [rdi], r12w
jne 0x1401adca7
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401adca7
cmp dword [rcx + rdi], 0x4550
jne 0x1401adca7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401adca7
cmp dword [rdx + 4], ebx
je 0x1401adca7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rdi
call fcn.14017f180
jmp 0x1401adcaa
mov rax, rbx
mov qword [0x1402cfb98], rax
cmp word [rdi], r12w
jne 0x1401add07
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401add07
cmp dword [rcx + rdi], 0x4550
jne 0x1401add07
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401add07
cmp dword [rdx + 4], ebx
je 0x1401add07
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATCatalogInfoFromContext
mov rcx, rdi
call fcn.14017f180
jmp 0x1401add0a
mov rax, rbx
mov qword [0x1402cfb80], rax
cmp word [rdi], r12w
jne 0x1401add67
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401add67
cmp dword [rcx + rdi], 0x4550
jne 0x1401add67
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401add67
cmp dword [rdx + 4], ebx
je 0x1401add67
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseCatalogContext
mov rcx, rdi
call fcn.14017f180
jmp 0x1401add6a
mov rax, rbx
mov qword [0x1402cfb70], rax
cmp word [rdi], r12w
jne 0x1401addc7
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401addc7
cmp dword [rcx + rdi], 0x4550
jne 0x1401addc7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401addc7
cmp dword [rdx + 4], ebx
je 0x1401addc7
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CryptCATAdminReleaseContext
mov rcx, rdi
call fcn.14017f180
jmp 0x1401addca
mov rax, rbx
mov qword [0x1402cfb68], rax
cmp word [rdi], r12w
jne 0x1401ade27
mov ecx, dword ds:[r14 + rbp]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ade27
cmp dword [rcx + rdi], 0x4550
jne 0x1401ade27
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ade27
cmp dword [rdx + 4], ebx
je 0x1401ade27
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.WinVerifyTrust
mov rcx, rdi
call fcn.14017f180
jmp 0x1401ade2a
mov rax, rbx
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
mov qword [0x1402cfbb0], rax
mov rdi, qword [rsp + 0x60]
test rsi, rsi
je 0x1401adfb1
cmp word [rsi], r12w
jne 0x1401ade94
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ade94
cmp dword [rcx + rsi], 0x4550
jne 0x1401ade94
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ade94
cmp dword [rdx + 4], ebx
je 0x1401ade94
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertNameToStrW
mov rcx, rsi
call fcn.14017f180
jmp 0x1401ade97
mov rax, rbx
mov rcx, rsi
mov qword [0x1402cfb90], rax
cmp word [rsi], r12w
jne 0x1401adf47
mov ecx, dword [r15 + rcx]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401adeef
cmp dword [rcx + rsi], 0x4550
jne 0x1401adeef
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401adeef
cmp dword [rdx + 4], ebx
je 0x1401adeef
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertGetEnhancedKeyUsage
mov rcx, rsi
call fcn.14017f180
cmp word [rsi], r12w
jne 0x1401adf47
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401adf47
cmp dword [rcx + rsi], 0x4550
jne 0x1401adf47
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401adf47
cmp dword [rdx + 4], ebx
je 0x1401adf47
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertDuplicateCertificateContext
mov rcx, rsi
call fcn.14017f180
jmp 0x1401adf4a
mov rax, rbx
mov qword [0x1402cfba0], rax
cmp word [rsi], r12w
jne 0x1401adfa8
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401adfa8
cmp dword [rcx + rsi], 0x4550
jne 0x1401adfa8
lea rdx, ds:[rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401adfa8
cmp dword [rdx + 4], ebx
je 0x1401adfa8
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.CertFreeCertificateContext
mov rcx, rsi
call fcn.14017f180
mov rbx, rax
mov qword [0x1402cfba8], rbx
jmp 0x1401adfb8
mov rbx, qword [0x1402cfba8]
cmp qword [0x1402cfbc0], 0
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
je 0x1401ae04c
cmp qword [0x1402cfb88], 0
je 0x1401ae04c
cmp qword [0x1402cfb98], 0
je 0x1401ae04c
cmp qword [0x1402cfb80], 0
je 0x1401ae04c
cmp qword [0x1402cfb70], 0
je 0x1401ae04c
cmp qword [0x1402cfb68], 0
je 0x1401ae04c
cmp qword [0x1402cfbb0], 0
je 0x1401ae04c
cmp qword [0x1402cfb90], 0
je 0x1401ae04c
cmp qword [0x1402cfba0], 0
nop
je 0x1401ae04c
test rbx, rbx
je 0x1401ae04c
mov r9d, 0x64
lea r8, [0x1401af740]
lea rdx, [0x1401af6c0]
mov ecx, 0x20
call sym.SystemInformer.exe_PhCreateHashtable
mov qword [0x1402cfad8], rax
add rsp, 0x40
pop rbx
ret