Function at 0x566cc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0x800
push 0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x566d19
push 0x200
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x566d19
cmp dword [0x62dbb0], 0x3e
jae 0x566d17
push eax
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x566d19
xor esi, esi
push 0x800
push 0
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x566d6e
push 0x200
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x566d6e
cmp dword [0x62dbb0], 0x3e
jae 0x566d6c
push eax
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x566d6e
xor edi, edi
mov ebx, 0x5a4d
test esi, esi
je 0x567049
cmp word [esi], bx
lea ebx, [esi + 0x3c]
jne 0x566dbe
mov eax, dword [ebx]
test eax, eax
je 0x566dbe
cmp eax, 0x7fffffff
jae 0x566dbe
cmp dword [eax + esi], 0x4550
jne 0x566dbe
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566dbe
cmp dword [edx + 4], 0
je 0x566dbe
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call fcn.00525800
jmp 0x566dc0
xor eax, eax
mov dword [0x635bb8], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566e0a
mov eax, dword [ebx]
test eax, eax
je 0x566e0a
cmp eax, 0x7fffffff
jae 0x566e0a
cmp dword [eax + esi], 0x4550
jne 0x566e0a
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566e0a
cmp dword [edx + 4], 0
je 0x566e0a
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle2
push eax
call fcn.00525800
jmp 0x566e0c
xor eax, eax
mov dword [0x635b98], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566e5d
mov eax, dword ds:[ebx]
test eax, eax
je 0x566e5d
cmp eax, 0x7fffffff
jae 0x566e5d
cmp dword [eax + esi], 0x4550
jne 0x566e5d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566e5d
cmp dword [edx + 4], 0
je 0x566e5d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext
push eax
call fcn.00525800
jmp 0x566e5f
xor eax, eax
mov dword [0x635b9c], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566ea9
mov eax, dword [ebx]
test eax, eax
je 0x566ea9
cmp eax, 0x7fffffff
jae 0x566ea9
cmp dword [eax + esi], 0x4550
jne 0x566ea9
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566ea9
cmp dword [edx + 4], 0
je 0x566ea9
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext2
push eax
call fcn.00525800
jmp 0x566eab
xor eax, eax
mov dword [0x635bb0], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566efd
mov eax, dword ds:[ebx]
test eax, eax
je 0x566efd
cmp eax, 0x7fffffff
jae 0x566efd
cmp dword [eax + esi], 0x4550
jne 0x566efd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566efd
cmp dword [edx + 4], 0
je 0x566efd
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminEnumCatalogFromHash
push eax
call fcn.00525800
jmp 0x566eff
xor eax, eax
mov dword [0x635ba0], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566f49
mov eax, dword [ebx]
test eax, eax
je 0x566f49
cmp eax, 0x7fffffff
jae 0x566f49
cmp dword [eax + esi], 0x4550
jne 0x566f49
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566f49
cmp dword [edx + 4], 0
je 0x566f49
push 0
add eax, esi
mov ecx, esi
push str.CryptCATCatalogInfoFromContext
push eax
call fcn.00525800
jmp 0x566f4b
xor eax, eax
mov dword [0x635b94], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566f9d
mov eax, dword ds:[ebx]
test eax, eax
je 0x566f9d
cmp eax, 0x7fffffff
jae 0x566f9d
cmp dword [eax + esi], 0x4550
jne 0x566f9d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566f9d
cmp dword [edx + 4], 0
je 0x566f9d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseCatalogContext
push eax
call fcn.00525800
jmp 0x566f9f
xor eax, eax
mov dword [0x635b8c], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566fe9
mov eax, dword [ebx]
test eax, eax
je 0x566fe9
cmp eax, 0x7fffffff
jae 0x566fe9
cmp dword [eax + esi], 0x4550
jne 0x566fe9
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566fe9
cmp dword [edx + 4], 0
je 0x566fe9
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseContext
push eax
call fcn.00525800
jmp 0x566feb
xor eax, eax
mov dword [0x635b90], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x56703d
mov eax, dword ds:[ebx]
test eax, eax
je 0x56703d
cmp eax, 0x7fffffff
jae 0x56703d
cmp dword [eax + esi], 0x4550
jne 0x56703d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x56703d
cmp dword [edx + 4], 0
je 0x56703d
push 0
add eax, esi
mov ecx, esi
push str.WinVerifyTrust
push eax
call fcn.00525800
jmp 0x56703f
xor eax, eax
mov dword [0x635bb4], eax
mov ebx, 0x5a4d
test edi, edi
je 0x567178
lea esi, [edi + 0x3c]
cmp word [edi], bx
jne 0x567095
mov eax, dword [esi]
test eax, eax
je 0x567095
nop
cmp eax, 0x7fffffff
jae 0x567095
cmp dword [eax + edi], 0x4550
jne 0x567095
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x567095
cmp dword [edx + 4], 0
je 0x567095
push 0
add eax, edi
mov ecx, edi
push str.CertNameToStrW
push eax
call fcn.00525800
jmp 0x567097
xor eax, eax
mov dword [0x635ba4], eax
lea esp, [esp]
cmp word [edi], bx
jne 0x567122
mov eax, dword [esi]
test eax, eax
je 0x5670de
cmp eax, 0x7fffffff
jae 0x5670de
cmp dword [eax + edi], 0x4550
jne 0x5670de
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5670de
cmp dword [edx + 4], 0
je 0x5670de
push 0
add eax, edi
mov ecx, edi
push str.CertGetEnhancedKeyUsage
push eax
call fcn.00525800
mov edi, edi
cmp word [edi], bx
jne 0x567122
mov eax, dword [esi]
test eax, eax
je 0x567122
cmp eax, 0x7fffffff
jae 0x567122
cmp dword [eax + edi], 0x4550
jne 0x567122
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x567122
cmp dword [edx + 4], 0
je 0x567122
push 0
add eax, edi
mov ecx, edi
push str.CertDuplicateCertificateContext
push eax
call fcn.00525800
mov edi, edi
jmp 0x567124
xor eax, eax
mov dword [0x635ba8], eax
cmp word [edi], bx
jne 0x56716f
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x56716f
cmp eax, 0x7fffffff
jae 0x56716f
cmp dword [eax + edi], 0x4550
jne 0x56716f
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x56716f
cmp dword [edx + 4], 0
je 0x56716f
push 0
add eax, edi
mov ecx, edi
push str.CertFreeCertificateContext
push eax
call fcn.00525800
mov dword [0x635bac], eax
jmp 0x56717d
xor eax, eax
mov dword [0x635bac], eax
jmp 0x56717d
mov eax, dword [0x635bac]
cmp dword [0x635bb8], 0
je 0x5671eb
cmp dword [0x635b9c], 0
je 0x5671eb
cmp dword [0x635ba0], 0
je 0x5671eb
cmp dword [0x635b94], 0
nop
je 0x5671eb
cmp dword [0x635b8c], 0
je 0x5671eb
cmp dword [0x635b90], 0
je 0x5671eb
cmp dword [0x635bb4], 0
je 0x5671eb
cmp dword [0x635ba4], 0
je 0x5671eb
cmp dword [0x635ba8], 0
je 0x5671eb
test eax, eax
je 0x5671eb
push 0x64
push 0x568320
push 0x5682e0
push 0x18
call sym.SystemInformer.exe_PhCreateHashtable
mov dword [0x635b38], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret