Function at 0x427e80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.crypt32.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
movzx ecx, word [esi]
mov ebx, eax
mov eax, 0x5a4d
mov edx, ecx
cmp cx, ax
jne 0x427ef5
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x427ef5
cmp ecx, 0x10000000
jae 0x427ef5
cmp dword [ecx + esi], 0x4550
jne 0x427ef5
add ecx, 0x78
add ecx, esi
mov eax, dword [ecx]
test eax, eax
je 0x427ef5
cmp dword [ecx + 4], 0
je 0x427ef5
push 0
push str.CryptCATAdminCalcHashFromFileHandle
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov ecx, eax
movzx eax, word [esi]
jmp 0x427ef9
mov eax, edx
xor ecx, ecx
mov dword [0x458ba0], ecx
mov ecx, 0x5a4d
movzx eax, ax
cmp ax, cx
mov ecx, eax
jne 0x427f2a
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x427f2a
cmp edx, 0x10000000
jae 0x427f2a
cmp dword [edx + esi], 0x4550
je 0x428146
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x458b74], edx
mov ecx, eax
jne 0x427f60
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x427f60
cmp edx, 0x10000000
jae 0x427f60
cmp dword [edx + esi], 0x4550
je 0x42817f
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x458b80], edx
mov ecx, eax
jne 0x427f96
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x427f96
cmp edx, 0x10000000
jae 0x427f96
cmp dword [edx + esi], 0x4550
je 0x4281b8
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x458b98], edx
mov ecx, eax
jne 0x427fcc
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x427fcc
cmp edx, 0x10000000
jae 0x427fcc
cmp dword [edx + esi], 0x4550
je 0x4281f1
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x458b88], edx
mov ecx, eax
jne 0x428002
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x428002
cmp edx, 0x10000000
jae 0x428002
cmp dword [edx + esi], 0x4550
je 0x42822a
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x458b78], edx
mov ecx, eax
jne 0x428038
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x428038
cmp edx, 0x10000000
jae 0x428038
cmp dword [edx + esi], 0x4550
je 0x428263
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x458b6c], edx
mov ecx, eax
jne 0x42806e
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x42806e
cmp edx, 0x10000000
jae 0x42806e
cmp dword [edx + esi], 0x4550
je 0x42829c
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x458b70], edx
mov ecx, eax
jne 0x4280a4
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4280a4
cmp edx, 0x10000000
jae 0x4280a4
cmp dword [edx + esi], 0x4550
je 0x4282d5
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x458b9c], edx
mov ecx, eax
jne 0x4280da
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4280da
cmp edx, 0x10000000
jae 0x4280da
cmp dword [edx + esi], 0x4550
je 0x42830e
movzx ecx, cx
xor eax, eax
mov dword [0x458b7c], eax
mov eax, 0x5a4d
cmp cx, ax
jne 0x428344
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x428344
cmp eax, 0x10000000
jae 0x428344
cmp dword [eax + esi], 0x4550
jne 0x428344
lea ecx, [eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x428344
cmp dword [ecx + 4], 0
je 0x428344
push 0
push str.WinVerifyTrust
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
jmp 0x428346
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x428177
cmp dword [ecx + 4], 0
je 0x428177
push 0
push str.CryptCATAdminCalcHashFromFileHandle2
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov edx, eax
movzx eax, word [esi]
jmp 0x427f2f
movzx eax, di
jmp 0x427f2d
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4281b0
cmp dword [ecx + 4], 0
je 0x4281b0
push 0
push str.CryptCATAdminAcquireContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov edx, eax
movzx eax, word [esi]
jmp 0x427f65
movzx eax, di
jmp 0x427f63
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4281e9
cmp dword [ecx + 4], 0
je 0x4281e9
push 0
push str.CryptCATAdminAcquireContext2
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov edx, eax
movzx eax, word [esi]
jmp 0x427f9b
movzx eax, di
jmp 0x427f99
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x428222
cmp dword [ecx + 4], 0
je 0x428222
push 0
push str.CryptCATAdminEnumCatalogFromHash
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov edx, eax
movzx eax, word [esi]
jmp 0x427fd1
movzx eax, di
jmp 0x427fcf
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x42825b
cmp dword [ecx + 4], 0
je 0x42825b
push 0
push str.CryptCATCatalogInfoFromContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov edx, eax
movzx eax, word [esi]
jmp 0x428007
movzx eax, di
jmp 0x428005
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x428294
cmp dword [ecx + 4], 0
je 0x428294
push 0
push str.CryptCATAdminReleaseCatalogContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov edx, eax
movzx eax, word [esi]
jmp 0x42803d
movzx eax, di
jmp 0x42803b
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x4282cd
cmp dword [ecx + 4], 0
je 0x4282cd
push 0
push str.CryptCATAdminReleaseContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov edx, eax
movzx eax, word [esi]
jmp 0x428073
movzx eax, di
jmp 0x428071
lea ecx, [edx + 0x78]
mov edi, eax
mov edx, dword [ecx + esi]
add ecx, esi
test edx, edx
je 0x428306
cmp dword [ecx + 4], 0
je 0x428306
push 0
push str.WTHelperProvDataFromStateData
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
mov edx, eax
movzx eax, word [esi]
jmp 0x4280a9
movzx eax, di
jmp 0x4280a7
lea ecx, [edx + 0x78]
mov edx, eax
add ecx, esi
mov edi, dword [ecx]
test edi, edi
je 0x42833c
cmp dword [ecx + 4], 0
je 0x42833c
push 0
push str.WTHelperGetProvSignerFromChain
lea eax, [edi + esi]
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
movzx ecx, word [esi]
jmp 0x4280df
movzx ecx, dx
jmp 0x4280dd
xor eax, eax
mov dword [0x458b94], eax
mov esi, 0x5a4d
movzx eax, word [ebx]
mov edx, eax
cmp ax, si
jne 0x42839c
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x42839c
cmp eax, 0x10000000
jae 0x42839c
cmp dword [eax + ebx], 0x4550
jne 0x42839c
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x42839c
cmp dword [ecx + 4], 0
je 0x42839c
push 0
push str.CertNameToStrW
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.0041a7d0
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4283a0
mov eax, edx
xor ecx, ecx
movzx eax, ax
mov dword [0x458b84], ecx
mov ecx, eax
cmp ax, si
jne 0x4283c8
mov edx, dword [ebx + 0x3c]
test edx, edx
je 0x4283c8
cmp edx, 0x10000000
jae 0x4283c8
cmp dword [edx + ebx], 0x4550
je 0x428423
movzx ecx, cx
xor eax, eax
mov dword [0x458b8c], eax
mov eax, 0x5a4d
cmp cx, ax
jne 0x428459
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x428459
cmp eax, 0x10000000
jae 0x428459
cmp dword [eax + ebx], 0x4550
jne 0x428459
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x428459
cmp dword [ecx + 4], 0
je 0x428459
push 0
push str.CertFreeCertificateContext
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.0041a7d0
mov dword [0x458b90], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edx + 0x78]
mov edx, eax
add ecx, ebx
mov esi, dword [ecx]
test esi, esi
je 0x428451
cmp dword [ecx + 4], 0
je 0x428451
push 0
push str.CertDuplicateCertificateContext
lea eax, [esi + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.0041a7d0
movzx ecx, word [ebx]
jmp 0x4283cd
movzx ecx, dx
jmp 0x4283cb
pop edi
pop esi
mov dword [0x458b90], 0
pop ebx
mov esp, ebp
pop ebp
ret