Function at 0x54e060
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0x800
push 0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x54e0b9
push 0x200
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x54e0b9
cmp dword [0x62ebb0], 0x3e
jae 0x54e0b7
push eax
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x54e0b9
xor esi, esi
push 0x800
push 0
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x54e10e
push 0x200
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x54e10e
cmp dword [0x62ebb0], 0x3e
jae 0x54e10c
push eax
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x54e10e
xor edi, edi
mov ebx, 0x5a4d
test esi, esi
je 0x54e421
jmp 0x54e120
cmp word [esi], bx
jne 0x54e162
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x54e162
cmp eax, 0x7fffffff
jae 0x54e162
cmp dword [eax + esi], 0x4550
jne 0x54e162
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e162
cmp dword [edx + 4], 0
je 0x54e162
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call fcn.00528e20
nop
jmp 0x54e164
xor eax, eax
mov dword [0x637450], eax
mov ebx, esi
mov eax, 0x5a4d
mov ecx, 0x3c
cmp word [esi], ax
jne 0x54e1bd
mov eax, dword ds:[ebx + ecx]
test eax, eax
je 0x54e1bd
cmp eax, 0x7fffffff
jae 0x54e1bd
cmp dword [eax + esi], 0x4550
jne 0x54e1bd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e1bd
cmp dword [edx + 4], 0
je 0x54e1bd
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle2
push eax
call fcn.00528e20
jmp 0x54e1bf
xor eax, eax
mov dword [0x637430], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e215
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e215
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x54e215
cmp dword [eax + esi], 0x4550
jne 0x54e215
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e215
cmp dword [edx + 4], 0
je 0x54e215
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext
push eax
call fcn.00528e20
jmp 0x54e217
xor eax, eax
mov dword [0x637434], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e267
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e267
cmp eax, 0x7fffffff
jae 0x54e267
cmp dword [eax + esi], 0x4550
jne 0x54e267
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e267
cmp dword [edx + 4], 0
je 0x54e267
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext2
push eax
call fcn.00528e20
jmp 0x54e269
xor eax, eax
mov dword [0x637448], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e2bd
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e2bd
cmp eax, 0x7fffffff
jae 0x54e2bd
cmp dword [eax + esi], 0x4550
jne 0x54e2bd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e2bd
cmp dword [edx + 4], 0
je 0x54e2bd
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminEnumCatalogFromHash
push eax
call fcn.00528e20
jmp 0x54e2bf
xor eax, eax
mov dword [0x637438], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e315
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e315
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x54e315
cmp dword [eax + esi], 0x4550
jne 0x54e315
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e315
cmp dword [edx + 4], 0
je 0x54e315
push 0
add eax, esi
mov ecx, esi
push str.CryptCATCatalogInfoFromContext
push eax
call fcn.00528e20
jmp 0x54e317
xor eax, eax
mov dword [0x63742c], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e367
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e367
cmp eax, 0x7fffffff
jae 0x54e367
cmp dword [eax + esi], 0x4550
jne 0x54e367
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e367
cmp dword [edx + 4], 0
je 0x54e367
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseCatalogContext
push eax
call fcn.00528e20
jmp 0x54e369
xor eax, eax
mov dword [0x637424], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e3bd
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e3bd
cmp eax, 0x7fffffff
jae 0x54e3bd
cmp dword [eax + esi], 0x4550
jne 0x54e3bd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e3bd
cmp dword [edx + 4], 0
je 0x54e3bd
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseContext
push eax
call fcn.00528e20
jmp 0x54e3bf
xor eax, eax
mov dword [0x637428], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e415
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e415
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x54e415
cmp dword [eax + esi], 0x4550
jne 0x54e415
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e415
cmp dword [edx + 4], 0
je 0x54e415
push 0
add eax, esi
mov ecx, esi
push str.WinVerifyTrust
push eax
call fcn.00528e20
jmp 0x54e417
xor eax, eax
mov dword [0x63744c], eax
mov ebx, 0x5a4d
test edi, edi
je 0x54e563
cmp word [edi], bx
jne 0x54e46a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x54e46a
cmp eax, 0x7fffffff
jae 0x54e46a
cmp dword [eax + edi], 0x4550
jne 0x54e46a
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x54e46a
cmp dword [edx + 4], 0
je 0x54e46a
push 0
add eax, edi
mov ecx, edi
push str.CertNameToStrW
push eax
call fcn.00528e20
jmp 0x54e46c
xor eax, eax
mov ecx, edi
mov edx, 0x3c
mov dword [0x63743c], eax
cmp word [edi], bx
jne 0x54e507
mov eax, dword [ecx + edx]
test eax, eax
je 0x54e4c5
cmp eax, 0x7fffffff
jae 0x54e4c5
cmp dword ds:[eax + edi], 0x4550
jne 0x54e4c5
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x54e4c5
cmp dword [edx + 4], 0
je 0x54e4c5
push 0
add eax, edi
push str.CertGetEnhancedKeyUsage
push eax
call fcn.00528e20
cmp word [edi], bx
jne 0x54e507
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x54e507
cmp eax, 0x7fffffff
jae 0x54e507
cmp dword ds:[eax + edi], 0x4550
jne 0x54e507
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x54e507
cmp dword [edx + 4], 0
je 0x54e507
push 0
add eax, edi
mov ecx, edi
push str.CertDuplicateCertificateContext
push eax
call fcn.00528e20
jmp 0x54e509
xor eax, eax
mov dword [0x637440], eax
cmp word [edi], bx
jne 0x54e55a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x54e55a
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x54e55a
cmp dword [eax + edi], 0x4550
jne 0x54e55a
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x54e55a
cmp dword [edx + 4], 0
je 0x54e55a
push 0
add eax, edi
mov ecx, edi
push str.CertFreeCertificateContext
push eax
call fcn.00528e20
mov dword [0x637444], eax
jmp 0x54e568
xor eax, eax
mov dword [0x637444], eax
jmp 0x54e568
mov eax, dword [0x637444]
cmp dword [0x637450], 0
je 0x54e5d5
cmp dword [0x637434], 0
je 0x54e5d5
cmp dword [0x637438], 0
je 0x54e5d5
cmp dword [0x63742c], 0
je 0x54e5d5
cmp dword [0x637424], 0
je 0x54e5d5
cmp dword [0x637428], 0
je 0x54e5d5
cmp dword [0x63744c], 0
je 0x54e5d5
cmp dword [0x63743c], 0
je 0x54e5d5
cmp dword [0x637440], 0
je 0x54e5d5
test eax, eax
je 0x54e5d5
push 0x64
push 0x54f680
push 0x54f640
push 0x18
call sym.SystemInformer.exe_PhCreateHashtable
mov dword [0x6373cc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret