Function at 0x4049e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
push 0x10000
call fcn.00404710
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404a18
xor eax, eax
jmp 0x404ba9
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
push str.MIIDYzCCAk2gAwIBAgIBVDALBgkqhkiG9w0BAQUwbDELMAkGA1UEBhMCQ04xDjAMBgNVBAgMBUpJTElOMRIwEAYDVQQHDAlDSEFOR0NIVU4xCzAJBgNVBAoMAkNVMQ0wCwYDVQQLDARDVUNBMR0wGwYDVQQDDBRDSElOQSBVTklDT00gUk9PVCBDQTAeFw0xMzA2MDEwNDAwMDBaFw0zMzA1MzEwNDAwMDBaMHAxCzAJBgNVBAYTAkNOMQ4wDAYDVQQIDAVqaWxpbjESMBAGA1UEBwwJY2hhbmdjaHVuMQwwCgYDVQQKDANDTkMxDjAMBgNVBAsMBUNOQ0NBMR8wHQYDVQQDDBZDSElOQSBORVRDT00gQ0xBU1MxIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvF36YR_ua7kROyekJyxZXh4dQdU1fZkEiizXhl5j3z2sa376L1WZTxTBB5TBeWqWmxR0UzdBzzIOpBnHXkvGaHPB3kGE4Uv4XP54WcNjtWNK2wnrIw22Lspt5J8PJuCCd3Or54uU8mTLp0QuiklGQM28sf8RaktZ_dq8FGuD6wIDAQABo4GTMIGQMB8GA1UdIwQYMBaAFKoiquFjAFSVzpcQhGaV1Ej2sISSMB0GA1UdDgQWBBTBg7OChxo7bBkNU4j2Jt1RGeW5DAMBgNVHRMEBTADAQH_MDMGA1UdIAQsMCowDAYKKoEchvF2AQEBATAMBgoqgRyG8XYBAQECMAwGCiqBHIbxdgEBAQMwCwYDVR0PBAQDAgGGMAsGCSqGSIb3DQEBBQOCAQEAlb_55133TFvmomCdei6HFMl2MAssE3GdPwLQ2FDZupDNBeSK2CXbZypV2afl6HakbnVyrsicJ0PU8IQ8O2T2SqQPhdggvIwQ6amWPceQGztstWyA_7P8zDCzKIPmOLhAS1J8j0FZIpjucwTdEufS_KWwMpIjd4NLMqeuFeM5CgyXKQdn2itb587rUgINN13JzJnOfZQQesSfNx1sACnz8kJju7f2MRJWW06maD2YOW_LWV0nomKrdtOuPZXvuBD0wTd7vllfsXn0SYsSbQjdEG0Gkc8hFFtFlzUdrX1XBEmwBz4crahB1fZBlmv75mC7fV63gTWDtNl75JLQ
call fcn.004047a0
add esp, 4
mov dword [ebp - 0x14], eax
push str.MIIDYzCCAk2gAwIBAgIBUzALBgkqhkiG9w0BAQUwbDELMAkGA1UEBhMCQ04xDjAMBgNVBAgMBUpJTElOMRIwEAYDVQQHDAlDSEFOR0NIVU4xCzAJBgNVBAoMAkNVMQ0wCwYDVQQLDARDVUNBMR0wGwYDVQQDDBRDSElOQSBVTklDT00gUk9PVCBDQTAeFw0xMzA2MDEwNDAwMDBaFw0zMzA1MzEwNDAwMDBaMHAxCzAJBgNVBAYTAkNOMQ4wDAYDVQQIDAVqaWxpbjESMBAGA1UEBwwJY2hhbmdjaHVuMQwwCgYDVQQKDANDTkMxDjAMBgNVBAsMBUNOQ0NBMR8wHQYDVQQDDBZDSElOQSBORVRDT00gQ0xBU1MyIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjghbNJ9ULuY45lrKf46h1OF5vp23cuc8vxoeIjD977TeGlym7M8xBJuvuXIAcuMqpehLi_drYtlxBFNzMPPrK1OFtkpk5puvnc2xt4A7HAKh7BgMod59cDDSOQZCGM1akU0uEaUyNhcCvcHYNeYpRjxDoNKZ2pgQJOXVB__VwwIDAQABo4GTMIGQMB8GA1UdIwQYMBaAFKoiquFjAFSVzpcQhGaV1Ej2sISSMB0GA1UdDgQWBBRXguoUS9zNSEN0YGa0GBI1uKSHXzAMBgNVHRMEBTADAQH_MDMGA1UdIAQsMCowDAYKKoEchvF2AQEBATAMBgoqgRyG8XYBAQECMAwGCiqBHIbxdgEBAQMwCwYDVR0PBAQDAgGGMAsGCSqGSIb3DQEBBQOCAQEAvTbOqQZ5VGfyb2pKSSlapk60GiNKiVvjbsKWeXC3Rm3MMawZ3DVk56dW2HZSqVknEHDymYCQIA5b6mfvJie49Wl_eNrbcDhPcgR7Kb63fUU4Pza0wa9zbzyvCLUp9lEgxYLWuwfmgiIUTIbzzFnnWAIL46oJbqov2kOviJUkgbmc8EBC8ZQpk4jty1Jq3Ar7oL58UbLTz0hNgkQi1ghBKsoKrN_ut5NQcsDBarjdB9WCUBogk1fNty0YjFjptlqHrOF1ReBjg92PwG3KG2wbCqAtSvhfqJTHM57GyIB92EEWygx_PQetVTS53v7woXYQ0G0SWNgOb2NbmKYcvw
call fcn.004047a0
add esp, 4
mov dword [ebp - 0x10], eax
push str.MIIDYzCCAk2gAwIBAgIBUjALBgkqhkiG9w0BAQUwbDELMAkGA1UEBhMCQ04xDjAMBgNVBAgMBUpJTElOMRIwEAYDVQQHDAlDSEFOR0NIVU4xCzAJBgNVBAoMAkNVMQ0wCwYDVQQLDARDVUNBMR0wGwYDVQQDDBRDSElOQSBVTklDT00gUk9PVCBDQTAeFw0xMzA2MDEwNDAwMDBaFw0zMzA1MzEwNDAwMDBaMHAxCzAJBgNVBAYTAkNOMQ4wDAYDVQQIDAVqaWxpbjESMBAGA1UEBwwJY2hhbmdjaHVuMQwwCgYDVQQKDANDTkMxDjAMBgNVBAsMBUNOQ0NBMR8wHQYDVQQDDBZDSElOQSBORVRDT00gQ0xBU1MzIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpr4ayEHMgf3JiPw6IzclePc7F_FBly7Rh_7PDpS1bOrY0Lqhdyt4eASDCUQ98u4LK5RmAp3GOm4ejjHW0AmJSdR9ZWFvcdM7lQFxVbxTNluLtZaQgRaLL3R7TsnCXbDWzJMfsum5XibDjGcCVevBTJx8hWxB8hDXkSHU1HkwIDAQABo4GTMIGQMB8GA1UdIwQYMBaAFKoiquFjAFSVzpcQhGaV1Ej2sISSMB0GA1UdDgQWBBS6ucBcnlFwQpvfNVvavXgAS8rRBTAMBgNVHRMEBTADAQH_MDMGA1UdIAQsMCowDAYKKoEchvF2AQEBATAMBgoqgRyG8XYBAQECMAwGCiqBHIbxdgEBAQMwCwYDVR0PBAQDAgGGMAsGCSqGSIb3DQEBBQOCAQEAhcJ02b5Uqs_JQTrlU5Wf31GGWqqF9wWb7ldAQeg9TgIfZZyHLKtk3F4EsqqqhQATx9CdfGskreFrBagtJUaBxyJY5GwSnpMTyKiAwI2yYgGnIttzJraIIpnC8nQVArBdBhtXjxK3difU4v0d6RUU6J88Zi1_lzCJy1MCzKTqCq0Bnx6xvCTMCwQ_JeJL9Zy5NbL1aIZqyiJ18nNPbpCjHFdG7W5Eq7JAS_HZFpHurZXiWTOrcil0U8DWle0jkykELCpZrK4PSlZQ4ImDMJN88c8QF2GmRhTn_BajNHRIc7tUJIJPEPGPIhGj2QtKyhYV5Gg0PvbSWDF8fiYsA
call fcn.004047a0
add esp, 4
mov dword [ebp - 0xc], eax
push str.MIID4zCCAs2gAwIBAgIBQDALBgkqhkiG9w0BAQUwbDELMAkGA1UEBhMCQ04xDjAMBgNVBAgMBUpJTElOMRIwEAYDVQQHDAlDSEFOR0NIVU4xCzAJBgNVBAoMAkNVMQ0wCwYDVQQLDARDVUNBMR0wGwYDVQQDDBRDSElOQSBVTklDT00gUk9PVCBDQTAeFw0xMzA2MDEwNDAwMDBaFw00MzA1MzEwNDAwMDBaMGwxCzAJBgNVBAYTAkNOMQ4wDAYDVQQIDAVKSUxJTjESMBAGA1UEBwwJQ0hBTkdDSFVOMQswCQYDVQQKDAJDVTENMAsGA1UECwwEQ1VDQTEdMBsGA1UEAwwUQ0hJTkEgVU5JQ09NIFJPT1QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCZCzUEj3cEjyevwkwZMeS3F0Kjm64xrIyGzxs0UUD2TSExFRGn9ZSA64I7A64KunYWqdtA3TdfBvEfDIp4qMtar0d04omInVV5QpeChJJWQrbbshVwfusfq0RkhRnunqG7OVN_iBj02NcGCqql2CNtIWFT01zWp4jvZ5qrKMRRyq7j4rYRxvSyX733VwirhWQSapxOGVl53mMC6nBvDVBee2kL_DLTOG62Zrt7QEBFmYUvkO7rQ2Mups2usPHlvQBAQwurIdmyvEupRNl3pp0sT8Pytt_T0NiRiP2UmrYBNj2afuG8vcxhgU6euYKZoAbl7qwSwM1mQms2AdAgMBAAGjgZMwgZAwHwYDVR0jBBgwFoAUqiKq4WMAVJXOlxCEZpXUSPawhJIwHQYDVR0OBBYEFKoiquFjAFSVzpcQhGaV1Ej2sISSMAwGA1UdEwQFMAMBAf8wMwYDVR0gBCwwKjAMBgoqgRyG8XYBAQEBMAwGCiqBHIbxdgEBAQIwDAYKKoEchvF2AQEBAzALBgNVHQ8EBAMCAQYwCwYJKoZIhvcNAQEFA4IBAQAsdjG0PtqURRgtrudldtID8fji1MvkU6ZOcOGtDfvCToWeUn63ybwZZpoZSgad9puI6jtzEJOOkDz6fQg4U3t3TZOkSHEbB_gGs8Ss0rUKBzyuJZfic4DevfxQwOFWu_ID3yOmldQd2Mpho2EsQIuePyyAd0yFCDF9rdkjaCQjjoyxms6MAw7jqferAUg5qDyCFtSfK7LjowSXGoursHmCJsD2qf9DrX5J2oxulV5JVf3DGV13XDE94FeFsDjro0XYu_ulgEImKJBmTDw_MPTDJvgc6IOt2lR_8wb6TR7tJvQdniOsxtCRHf4dEGJ95vW0AhgwO67p3xvc8FlbH
call fcn.004047a0
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push str.ROOT
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x404ad7
mov eax, dword [ebp + 8]
and eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
je 0x404ad2
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x404bb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [ebp - 0x1c]
push edx
push 3
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x404ad2
xor eax, eax
jmp 0x404ba9
jmp 0x404b5b
mov edx, dword [ebp + 8]
and edx, 2
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 2
je 0x404b05
lea eax, [ebp - 0x1c]
push eax
push 3
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x404b05
xor eax, eax
jmp 0x404ba9
mov eax, dword [ebp + 8]
and eax, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
je 0x404b30
lea ecx, [ebp - 0x1c]
push ecx
push 3
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x404b30
xor eax, eax
jmp 0x404ba9
mov ecx, dword [ebp + 8]
and ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 8
je 0x404b5b
lea edx, [ebp - 0x1c]
push edx
push 3
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x404b5b
xor eax, eax
jmp 0x404ba9
mov dword [ebp - 0x24], 0
jmp 0x404b6d
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 4
jge 0x404b8e
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x18]
push ecx
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov edx, dword [ebp - 0x24]
mov dword [ebp + edx*4 - 0x18], 0
jmp 0x404b64
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov ecx, dword [ebp - 8]
push ecx
call fcn.00404760
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret