Function at 0x565940
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0x800
push 0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x565999
push 0x200
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x565999
cmp dword [0x62dbb0], 0x3e
jae 0x565997
push eax
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x565999
xor esi, esi
push 0x800
push 0
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5659ee
push 0x200
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5659ee
cmp dword [0x62dbb0], 0x3e
jae 0x5659ec
push eax
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5659ee
xor edi, edi
mov ebx, 0x5a4d
test esi, esi
je 0x565d01
jmp 0x565a00
cmp word [esi], bx
jne 0x565a42
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x565a42
cmp eax, 0x7fffffff
jae 0x565a42
cmp dword [eax + esi], 0x4550
jne 0x565a42
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565a42
cmp dword [edx + 4], 0
je 0x565a42
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call fcn.00527c80
nop
jmp 0x565a44
xor eax, eax
mov dword [0x636520], eax
mov ebx, esi
mov eax, 0x5a4d
mov ecx, 0x3c
cmp word [esi], ax
jne 0x565a9d
mov eax, dword ds:[ebx + ecx]
test eax, eax
je 0x565a9d
cmp eax, 0x7fffffff
jae 0x565a9d
cmp dword [eax + esi], 0x4550
jne 0x565a9d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565a9d
cmp dword [edx + 4], 0
je 0x565a9d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle2
push eax
call fcn.00527c80
jmp 0x565a9f
xor eax, eax
mov dword [0x6364fc], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x565af5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x565af5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x565af5
cmp dword [eax + esi], 0x4550
jne 0x565af5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565af5
cmp dword [edx + 4], 0
je 0x565af5
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext
push eax
call fcn.00527c80
jmp 0x565af7
xor eax, eax
mov dword [0x636504], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x565b47
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x565b47
cmp eax, 0x7fffffff
jae 0x565b47
cmp dword [eax + esi], 0x4550
jne 0x565b47
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565b47
cmp dword [edx + 4], 0
je 0x565b47
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext2
push eax
call fcn.00527c80
jmp 0x565b49
xor eax, eax
mov dword [0x63651c], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x565b9d
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x565b9d
cmp eax, 0x7fffffff
jae 0x565b9d
cmp dword [eax + esi], 0x4550
jne 0x565b9d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565b9d
cmp dword [edx + 4], 0
je 0x565b9d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminEnumCatalogFromHash
push eax
call fcn.00527c80
jmp 0x565b9f
xor eax, eax
mov dword [0x63650c], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x565bf5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x565bf5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x565bf5
cmp dword [eax + esi], 0x4550
jne 0x565bf5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565bf5
cmp dword [edx + 4], 0
je 0x565bf5
push 0
add eax, esi
mov ecx, esi
push str.CryptCATCatalogInfoFromContext
push eax
call fcn.00527c80
jmp 0x565bf7
xor eax, eax
mov dword [0x636500], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x565c47
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x565c47
cmp eax, 0x7fffffff
jae 0x565c47
cmp dword [eax + esi], 0x4550
jne 0x565c47
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565c47
cmp dword [edx + 4], 0
je 0x565c47
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseCatalogContext
push eax
call fcn.00527c80
jmp 0x565c49
xor eax, eax
mov dword [0x6364f4], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x565c9d
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x565c9d
cmp eax, 0x7fffffff
jae 0x565c9d
cmp dword [eax + esi], 0x4550
jne 0x565c9d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565c9d
cmp dword [edx + 4], 0
je 0x565c9d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseContext
push eax
call fcn.00527c80
jmp 0x565c9f
xor eax, eax
mov dword [0x6364f8], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x565cf5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x565cf5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x565cf5
cmp dword [eax + esi], 0x4550
jne 0x565cf5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565cf5
cmp dword [edx + 4], 0
je 0x565cf5
push 0
add eax, esi
mov ecx, esi
push str.WinVerifyTrust
push eax
call fcn.00527c80
jmp 0x565cf7
xor eax, eax
mov dword [0x636518], eax
mov ebx, 0x5a4d
test edi, edi
je 0x565e43
cmp word [edi], bx
jne 0x565d4a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x565d4a
cmp eax, 0x7fffffff
jae 0x565d4a
cmp dword [eax + edi], 0x4550
jne 0x565d4a
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x565d4a
cmp dword [edx + 4], 0
je 0x565d4a
push 0
add eax, edi
mov ecx, edi
push str.CertNameToStrW
push eax
call fcn.00527c80
jmp 0x565d4c
xor eax, eax
mov ecx, edi
mov edx, 0x3c
mov dword [0x636508], eax
cmp word [edi], bx
jne 0x565de7
mov eax, dword [ecx + edx]
test eax, eax
je 0x565da5
cmp eax, 0x7fffffff
jae 0x565da5
cmp dword ds:[eax + edi], 0x4550
jne 0x565da5
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x565da5
cmp dword [edx + 4], 0
je 0x565da5
push 0
add eax, edi
push str.CertGetEnhancedKeyUsage
push eax
call fcn.00527c80
cmp word [edi], bx
jne 0x565de7
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x565de7
cmp eax, 0x7fffffff
jae 0x565de7
cmp dword ds:[eax + edi], 0x4550
jne 0x565de7
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x565de7
cmp dword [edx + 4], 0
je 0x565de7
push 0
add eax, edi
mov ecx, edi
push str.CertDuplicateCertificateContext
push eax
call fcn.00527c80
jmp 0x565de9
xor eax, eax
mov dword [0x636510], eax
cmp word [edi], bx
jne 0x565e3a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x565e3a
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x565e3a
cmp dword [eax + edi], 0x4550
jne 0x565e3a
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x565e3a
cmp dword [edx + 4], 0
je 0x565e3a
push 0
add eax, edi
mov ecx, edi
push str.CertFreeCertificateContext
push eax
call fcn.00527c80
mov dword [0x636514], eax
jmp 0x565e48
xor eax, eax
mov dword [0x636514], eax
jmp 0x565e48
mov eax, dword [0x636514]
cmp dword [0x636520], 0
je 0x565eb5
cmp dword [0x636504], 0
je 0x565eb5
cmp dword [0x63650c], 0
je 0x565eb5
cmp dword [0x636500], 0
je 0x565eb5
cmp dword [0x6364f4], 0
je 0x565eb5
cmp dword [0x6364f8], 0
je 0x565eb5
cmp dword [0x636518], 0
je 0x565eb5
cmp dword [0x636508], 0
je 0x565eb5
cmp dword [0x636510], 0
je 0x565eb5
test eax, eax
je 0x565eb5
push 0x64
push 0x566f60
push 0x566f20
push 0x18
call sym.SystemInformer.exe_PhCreateHashtable
mov dword [0x63649c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret