Function at 0x4050a0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x58
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x4050b2
mov byte [eax], bl
mov edx, dword [esp + 0x78]
cmp edx, ebx
je 0x4050bc
mov dword [edx], ebx
mov al, 0xc2
mov byte [esp + 0x21], al
mov byte [esp + 0x25], al
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov ecx, 0xb
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x44], eax
xor eax, eax
cmp edx, ebx
setne al
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x28]
push str.wintrust.dll
mov dword [esp + 0x1c], 0xaac56b
mov word [esp + 0x20], 0xcd44
mov word [esp + 0x22], 0x11d0
mov byte [esp + 0x24], 0x8c
mov byte [esp + 0x26], 0
mov byte [esp + 0x27], 0xc0
mov byte [esp + 0x28], 0x4f
mov byte [esp + 0x2a], 0x95
mov byte [esp + 0x2b], 0xee
mov dword [esp + 0x2c], 0x10
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], 0x2c
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
jne 0x405174
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x58
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinVerifyTrust
push esi
call ebp
push str.WTHelperProvDataFromStateData
mov ebx, eax
push esi
mov dword [esp + 0x74], ebx
call ebp
push str.WTHelperGetProvSignerFromChain
mov edi, eax
push esi
mov dword [esp + 0x1c], edi
call ebp
push str.WTHelperGetProvCertFromChain
push esi
mov dword [esp + 0x18], eax
call ebp
test ebx, ebx
mov dword [esp + 0x18], eax
je 0x405221
test edi, edi
je 0x405221
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x405221
test eax, eax
je 0x405221
cmp dword [esp + 0x74], 2
jne 0x4051cf
or eax, 0xffffffff
jmp 0x4051d3
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
call ebx
mov edi, eax
push edi
push str._WVT__WVT_returned_0x_X_n
call fcn.00404d80
add esp, 8
cmp edi, 0x800b0001
je 0x405206
xor eax, eax
test edi, edi
setne al
inc eax
mov dword [esp + 0x74], eax
jne 0x405232
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x20]
mov eax, 2
push edx
push 0xffffffffffffffff
mov dword [esp + 0x54], eax
mov dword [esp + 0x64], eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x58
ret
mov eax, dword [esp + 0x78]
test eax, eax
je 0x405245
cmp edi, 0x800b0100
setne cl
mov byte [eax], cl
cmp edi, 0x800b0100
jne 0x40527b
mov eax, 2
lea edx, [esp + 0x3c]
mov dword [esp + 0x48], eax
mov dword [esp + 0x58], eax
push edx
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x74]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x58
ret
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x40530f
mov ecx, dword [esp + 0x5c]
push ecx
call dword [esp + 0x18]
test eax, eax
je 0x4052b4
push 0
push 0
push 0
push eax
call dword [esp + 0x20]
test eax, eax
je 0x4052b4
push 0
push eax
call dword [esp + 0x20]
mov ebx, eax
test ebx, ebx
jne 0x4052c0
mov ebx, dword [esp + 0x6c]
mov edx, dword [esp + 0x7c]
mov dword [edx], 0
jmp 0x4052f4
push 0x40c014
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4052f0
push str.CertDuplicateCertificateContext
push edi
call ebp
test eax, eax
je 0x4052e9
mov ecx, dword [ebx + 4]
push ecx
call eax
mov edx, dword [esp + 0x7c]
mov dword [edx], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [esp + 0x6c]
mov eax, 2
mov dword [esp + 0x48], eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0xffffffffffffffff
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x74]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x58
ret