Function at 0x4cde80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.crypt32.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
movzx ecx, word [esi]
mov ebx, eax
mov eax, 0x5a4d
mov edx, ecx
cmp cx, ax
jne 0x4cdef5
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x4cdef5
cmp ecx, 0x10000000
jae 0x4cdef5
cmp dword [ecx + esi], 0x4550
jne 0x4cdef5
add ecx, 0x78
add ecx, esi
mov eax, dword [ecx]
test eax, eax
je 0x4cdef5
cmp dword [ecx + 4], 0
je 0x4cdef5
push 0
push str.CryptCATAdminCalcHashFromFileHandle
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov ecx, eax
movzx eax, word [esi]
jmp 0x4cdef9
mov eax, edx
xor ecx, ecx
mov dword [0x54b5e0], ecx
mov ecx, 0x5a4d
movzx eax, ax
cmp ax, cx
mov ecx, eax
jne 0x4cdf2a
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4cdf2a
cmp edx, 0x10000000
jae 0x4cdf2a
cmp dword [edx + esi], 0x4550
je 0x4ce146
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5b4], edx
mov ecx, eax
jne 0x4cdf60
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4cdf60
cmp edx, 0x10000000
jae 0x4cdf60
cmp dword [edx + esi], 0x4550
je 0x4ce17f
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5c0], edx
mov ecx, eax
jne 0x4cdf96
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4cdf96
cmp edx, 0x10000000
jae 0x4cdf96
cmp dword [edx + esi], 0x4550
je 0x4ce1b8
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5d8], edx
mov ecx, eax
jne 0x4cdfcc
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4cdfcc
cmp edx, 0x10000000
jae 0x4cdfcc
cmp dword [edx + esi], 0x4550
je 0x4ce1f1
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5c8], edx
mov ecx, eax
jne 0x4ce002
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4ce002
cmp edx, 0x10000000
jae 0x4ce002
cmp dword [edx + esi], 0x4550
je 0x4ce22a
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5b8], edx
mov ecx, eax
jne 0x4ce038
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4ce038
cmp edx, 0x10000000
jae 0x4ce038
cmp dword [edx + esi], 0x4550
je 0x4ce263
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5ac], edx
mov ecx, eax
jne 0x4ce06e
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4ce06e
cmp edx, 0x10000000
jae 0x4ce06e
cmp dword [edx + esi], 0x4550
je 0x4ce29c
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5b0], edx
mov ecx, eax
jne 0x4ce0a4
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4ce0a4
cmp edx, 0x10000000
jae 0x4ce0a4
cmp dword [edx + esi], 0x4550
je 0x4ce2d5
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5dc], edx
mov ecx, eax
jne 0x4ce0da
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4ce0da
cmp edx, 0x10000000
jae 0x4ce0da
cmp dword [edx + esi], 0x4550
je 0x4ce30e
movzx ecx, cx
xor eax, eax
mov dword [0x54b5bc], eax
mov eax, 0x5a4d
cmp cx, ax
jne 0x4ce344
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4ce344
cmp eax, 0x10000000
jae 0x4ce344
cmp dword [eax + esi], 0x4550
jne 0x4ce344
lea ecx, [eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x4ce344
cmp dword [ecx + 4], 0
je 0x4ce344
push 0
push str.WinVerifyTrust
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004a2140
jmp 0x4ce346
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4ce177
cmp dword [ecx + 4], 0
je 0x4ce177
push 0
push str.CryptCATAdminCalcHashFromFileHandle2
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov edx, eax
movzx eax, word [esi]
jmp 0x4cdf2f
movzx eax, di
jmp 0x4cdf2d
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4ce1b0
cmp dword [ecx + 4], 0
je 0x4ce1b0
push 0
push str.CryptCATAdminAcquireContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov edx, eax
movzx eax, word [esi]
jmp 0x4cdf65
movzx eax, di
jmp 0x4cdf63
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4ce1e9
cmp dword [ecx + 4], 0
je 0x4ce1e9
push 0
push str.CryptCATAdminAcquireContext2
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov edx, eax
movzx eax, word [esi]
jmp 0x4cdf9b
movzx eax, di
jmp 0x4cdf99
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4ce222
cmp dword [ecx + 4], 0
je 0x4ce222
push 0
push str.CryptCATAdminEnumCatalogFromHash
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov edx, eax
movzx eax, word [esi]
jmp 0x4cdfd1
movzx eax, di
jmp 0x4cdfcf
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4ce25b
cmp dword [ecx + 4], 0
je 0x4ce25b
push 0
push str.CryptCATCatalogInfoFromContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov edx, eax
movzx eax, word [esi]
jmp 0x4ce007
movzx eax, di
jmp 0x4ce005
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4ce294
cmp dword [ecx + 4], 0
je 0x4ce294
push 0
push str.CryptCATAdminReleaseCatalogContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov edx, eax
movzx eax, word [esi]
jmp 0x4ce03d
movzx eax, di
jmp 0x4ce03b
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4ce2cd
cmp dword [ecx + 4], 0
je 0x4ce2cd
push 0
push str.CryptCATAdminReleaseContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov edx, eax
movzx eax, word [esi]
jmp 0x4ce073
movzx eax, di
jmp 0x4ce071
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4ce306
cmp dword [ecx + 4], 0
je 0x4ce306
push 0
push str.WTHelperProvDataFromStateData
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
mov edx, eax
movzx eax, word [esi]
jmp 0x4ce0a9
movzx eax, di
jmp 0x4ce0a7
lea ecx, [edx + 0x78]
mov edx, eax
add ecx, esi
mov edi, dword [ecx]
test edi, edi
je 0x4ce33c
cmp dword [ecx + 4], 0
je 0x4ce33c
push 0
push str.WTHelperGetProvSignerFromChain
lea eax, [edi + esi]
push eax
push ecx
mov ecx, esi
call fcn.004a2140
movzx ecx, word [esi]
jmp 0x4ce0df
movzx ecx, dx
jmp 0x4ce0dd
xor eax, eax
mov dword [0x54b5d4], eax
mov esi, 0x5a4d
movzx eax, word [ebx]
mov edx, eax
cmp ax, si
jne 0x4ce39c
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4ce39c
cmp eax, 0x10000000
jae 0x4ce39c
cmp dword [eax + ebx], 0x4550
jne 0x4ce39c
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x4ce39c
cmp dword [ecx + 4], 0
je 0x4ce39c
push 0
push str.CertNameToStrW
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.004a2140
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4ce3a0
mov eax, edx
xor ecx, ecx
movzx eax, ax
mov dword [0x54b5c4], ecx
mov ecx, eax
cmp ax, si
jne 0x4ce3c8
mov edx, dword [ebx + 0x3c]
test edx, edx
je 0x4ce3c8
cmp edx, 0x10000000
jae 0x4ce3c8
cmp dword [edx + ebx], 0x4550
je 0x4ce423
movzx ecx, cx
xor eax, eax
mov dword [0x54b5cc], eax
mov eax, 0x5a4d
cmp cx, ax
jne 0x4ce459
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4ce459
cmp eax, 0x10000000
jae 0x4ce459
cmp dword [eax + ebx], 0x4550
jne 0x4ce459
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x4ce459
cmp dword [ecx + 4], 0
je 0x4ce459
push 0
push str.CertFreeCertificateContext
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.004a2140
mov dword [0x54b5d0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edx + 0x78]
mov edx, eax
add ecx, ebx
mov esi, dword [ecx]
test esi, esi
je 0x4ce451
cmp dword [ecx + 4], 0
je 0x4ce451
push 0
push str.CertDuplicateCertificateContext
lea eax, [esi + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004a2140
movzx ecx, word [ebx]
jmp 0x4ce3cd
movzx ecx, dx
jmp 0x4ce3cb
pop edi
pop esi
mov dword [0x54b5d0], 0
pop ebx
mov esp, ebp
pop ebp
ret