Function at 0x1005f50
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4c
mov eax, dword [0x1009088]
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x1009d1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x68]
push edi
mov dword [ebp - 0x280], 0xf750e6c3
mov word [ebp - 0x27c], 0x38ee
mov word [ebp - 0x27a], 0x11d1
mov byte [ebp - 0x278], 0x85
mov byte [ebp - 0x277], 0xe5
mov byte [ebp - 0x276], 0
mov byte [ebp - 0x275], 0xc0
mov byte [ebp - 0x274], 0x4f
mov byte [ebp - 0x273], 0xc2
mov byte [ebp - 0x272], 0x95
mov byte [ebp - 0x271], 0xee
mov dword [ebp - 0x9e8], 0x64
mov dword [ebp - 0x9f0], eax
mov ebx, 0x10090c0
jne 0x1005fe8
mov ecx, 0x82
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1006011
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x10061aa
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x9e4], eax
jne 0x1006044
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x28], eax
jmp 0x10061aa
push 0x19
pop ecx
xor eax, eax
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x9e8]
push eax
push dword [ebp - 0x9e4]
call sub.WINTRUST.dll_CryptCATAdminCalcHashFromFileHandle
test eax, eax
jne 0x1006089
push ebx
push dword [ebp - 0x9e4]
call sub.WINTRUST.dll_IsCatalogFile
test eax, eax
je 0x100619e
mov dword [ebp - 0x9f0], ebx
mov dword [ebp - 0x9e8], ebx
push dword [ebp - 0x9e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
xor eax, eax
pop ecx
lea edi, [ebp - 0xa4c]
rep stosd dword es:[edi], eax
push 2
pop eax
mov dword [ebp - 0xa40], eax
mov dword [ebp - 0xa38], eax
lea eax, [ebp - 0x7d4]
mov dword [ebp - 0xa48], eax
xor eax, eax
cmp dword [esi + 0x24], ebx
mov ecx, 0x110
lea edi, [ebp - 0x7d4]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xa4c], 0x30
mov dword [ebp - 0xa3c], ebx
mov dword [ebp - 0xa30], 3
mov dword [ebp - 0x7d4], 0x440
jne 0x1006134
lea eax, [ebp - 0x394]
push eax
mov dword [ebp - 0x394], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1006134
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp - 0x38c]
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a8], ecx
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], ecx
mov edx, dword [ebp - 0x9f0]
lea eax, [ebp - 0xa1c]
mov dword [ebp - 0xa34], eax
xor eax, eax
push 9
pop ecx
lea edi, [ebp - 0xa1c]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0x9e8]
mov dword [ebp - 0xa10], eax
mov eax, dword [0x1009d24]
cmp eax, ebx
mov dword [ebp - 0xa1c], 0x24
mov dword [ebp - 0xa04], edx
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0x9ec], ebx
je 0x10061b1
lea edi, [ebp - 0x9ec]
push edi
push ebx
push ecx
push edx
push eax
call sub.WINTRUST.dll_CryptCATAdminEnumCatalogFromHash
mov dword [ebp - 0x9e4], eax
jmp 0x10061b7
push dword [ebp - 0x9e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10063a1
mov dword [ebp - 0x9e4], ebx
cmp dword [ebp - 0x9e4], ebx
mov dword [ebp - 0x9f4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
je 0x10062f2
cmp dword [ebp - 0x9f4], 0
jne 0x10062f2
xor eax, eax
push eax
mov ecx, 0x83
lea edi, [ebp - 0x9e0]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x9e4]
lea eax, [ebp - 0x9e0]
push eax
push edi
mov dword [ebp - 0x9e0], 0x20c
call sub.WINTRUST.dll_CryptCATCatalogInfoFromContext
test eax, eax
je 0x10062b9
lea eax, [ebp - 0x9dc]
mov dword [ebp - 0xa14], eax
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x280]
push eax
push dword [0x10092e0]
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
jne 0x1006294
lea eax, [ebp - 0x9f8]
push eax
lea eax, [ebp - 0x270]
push eax
push 0x104
lea eax, [ebp - 0x9dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [ebp - 0x9f8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
test eax, eax
mov dword [esi + 0xc], eax
je 0x100628a
push dword [ebp - 0x9f8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x9f4], 1
cmp dword [ebp - 0x3b0], 0
je 0x10062b0
push dword [ebp - 0x3b0]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x9f4], 0
jne 0x10062e5
lea eax, [ebp - 0x9ec]
push eax
push 0
push dword [ebp - 0x9e8]
mov dword [ebp - 0x9ec], edi
push dword [ebp - 0x9f0]
push dword [0x1009d24]
call sub.WINTRUST.dll_CryptCATAdminEnumCatalogFromHash
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 0x9e4], 0
jne 0x10061cf
xor edi, edi
inc edi
cmp dword [ebp - 0x9e4], 0
mov dword [esi + 0x20], edi
jne 0x1006318
lea eax, [ebp - 0x7d4]
push eax
push dword [esi]
call fcn.01005e20
test eax, eax
je 0x100632e
mov dword [esi + 0x1c], edi
jmp 0x100632e
push 0
push dword [ebp - 0x9e4]
mov dword [esi + 0x1c], edi
push dword [0x1009d24]
call sub.WINTRUST.dll_CryptCATAdminReleaseCatalogContext
cmp dword [esi + 0x1c], 0
je 0x1006398
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x7c0]
push eax
call edi
lea eax, [eax + eax + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
test eax, eax
mov dword [esi + 8], eax
je 0x1006368
lea ecx, [ebp - 0x7c0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x5b8]
push eax
call edi
lea eax, [eax + eax + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
test eax, eax
mov dword [esi + 0x10], eax
je 0x100639e
lea ecx, [ebp - 0x5b8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x100639e
push esi
call fcn.01005c03
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret 4