Function at 0x432230
Capabilities:
Decode data using base64 via winapi
Get session information
Get session user name
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1005c
call fcn.00584fc0
mov eax, dword [0x62c140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
push str._Inside_InstallCertificate_method___n
mov dword [ebp - 0x10044], edi
mov dword [ebp - 0x10038], eax
mov dword [ebp - 0x10054], ecx
call fcn.0043d7e0
xor esi, esi
add esp, 4
lea edx, [ebp - 0x10048]
push edx
push esi
mov dword [ebp - 0x1004c], esi
mov dword [ebp - 0x1003c], esi
mov dword [ebp - 0x10030], esi
mov dword [ebp - 0x10040], esi
mov dword [ebp - 0x10034], 1
mov dword [ebp - 0x10048], esi
call fcn.00411ff0
add esp, 8
push esi
push 0x80
push 3
push esi
push esi
push SQLAllocStmt
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x10058], ebx
cmp ebx, esi
je 0x4329b4
cmp ebx, 0xffffffff
je 0x4329b4
lea eax, [ebp - 0x1002c]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x4322fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_get_Certificate_File_Attributes.._error__ld__n
jmp 0x4329c0
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov esi, eax
push esi
push str.InstallCertificate:_Certificate_file_Extension____s__n
mov dword [ebp - 0x10050], esi
call fcn.0043d7e0
add esp, 8
mov ecx, str..cer
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x432340
test dl, dl
je 0x43233c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x432340
add eax, 2
add ecx, 2
test dl, dl
jne 0x432320
xor eax, eax
jmp 0x432345
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43262b
mov ecx, str..crt
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x432374
test dl, dl
je 0x432370
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x432374
add eax, 2
add ecx, 2
test dl, dl
jne 0x432354
xor eax, eax
jmp 0x432379
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43262b
push 0xb
push 1
call fcn.0057f01b
mov ecx, dword [ebp - 0x1000c]
add ecx, 3
push ecx
push 1
mov esi, eax
call fcn.0057f01b
add esp, 0x10
push 0
push esi
mov dword [esi + 4], eax
mov edx, dword [ebp - 0x1000c]
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4323ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_Read_Certificate_File.._error__ld__n
jmp 0x4329c0
mov eax, dword [ebp - 0x10048]
push 0
push eax
push esi
call dword [sym.imp.CRYPT32.dll_PFXVerifyPassword]
test eax, eax
jne 0x4325a4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10038], 0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432400
sub eax, edx
mov edx, eax
xor eax, eax
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432410
sub eax, esi
lea ecx, [eax + edx + 0xc8]
push ecx
push 1
call fcn.0057f01b
push 0x5ea674
push str.Trusted_Root_Certification_Authorities
mov edi, eax
call fcn.0057f695
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4329ce
mov edx, str.Active_Directory_User_Object
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x43246d
test al, al
je 0x432469
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x43246d
add ecx, 2
add edx, 2
test bl, bl
jne 0x43244d
xor eax, eax
jmp 0x432472
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4324a1
cmp dword [ebp + 0xc], eax
jne 0x4324a1
mov edx, dword [ebp - 0x10054]
push 0x5ea674
push eax
mov dword [edx], 1
call fcn.0057f695
mov dword [ebp - 0x10030], 1
jmp 0x432592
xor ebx, ebx
mov eax, esi
mov dword [ebp - 0x10050], ebx
mov dword [ebp - 0x10034], ebx
call fcn.00433670
push eax
mov eax, dword [ebp - 0x10044]
push ebx
push eax
push str.powershell.exe_Import_PfxCertificate__FilePath__s__Password__ConvertTo_SecureString__String__s__AsPlainText__Force___CertStoreLocation_Cert:LocalMachine_s
push edi
call fcn.0057f0e8
add esp, 0x14
call fcn.0042b870
mov esi, eax
call fcn.0042afb0
lea ecx, [ebp - 0x10050]
push ecx
lea edx, [ebp - 0x10034]
push edx
push 5
push esi
push 0
mov ebx, eax
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
mov eax, dword [ebp - 0x10034]
push eax
push str.ExecuteScript_:_The_active_session_User_name_is_given_by__s__n
call fcn.0043d7e0
push ebx
push esi
push str.Active_Console_Id:__d_and_Active_Session_Id_:__d_n
call fcn.0043d7e0
mov eax, dword [ebp - 0x10034]
add esp, 0x14
test eax, eax
je 0x432545
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432521
sub eax, edx
je 0x432545
lea ecx, [ebp - 0x10038]
push esi
push ecx
mov ebx, edi
call fcn.0042b3e0
mov dword [ebp - 0x10030], eax
mov esi, eax
jmp 0x43256e
call fcn.00406320
push ebx
mov ebx, edi
test eax, eax
je 0x43255a
lea edx, [ebp - 0x10038]
push edx
jmp 0x432561
lea eax, [ebp - 0x10038]
push eax
call fcn.0042b3e0
mov esi, eax
mov dword [ebp - 0x10030], esi
add esp, 8
push esi
push str.InstallCertificate:_Cannot_User_Import_PFX_Certificate_using_powershell_command_error__ld__n
call fcn.0043d500
add esp, 8
test esi, esi
jne 0x4329ce
push 0x5ea674
push esi
call fcn.0057f695
mov esi, eax
add esp, 8
test esi, esi
jne 0x432446
jmp 0x4329ce
mov ecx, dword [ebp - 0x10048]
push 0
push ecx
push esi
call dword [sym.imp.CRYPT32.dll_PFXImportCertStore]
mov dword [ebp - 0x1004c], eax
test eax, eax
jne 0x4325cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_Import_PFX_Certificate.._error__ld__n
jmp 0x4329c0
push esi
call fcn.0057f05b
add esp, 4
push 0x5ea674
push str.Trusted_Root_Certification_Authorities
call fcn.0057f695
mov edi, eax
add esp, 8
test edi, edi
je 0x4329ce
mov ecx, str.Active_Directory_User_Object
mov eax, edi
jmp 0x432600
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43270b
test dl, dl
je 0x432624
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43270b
add eax, 2
add ecx, 2
test dl, dl
jne 0x432600
xor eax, eax
jmp 0x432710
mov eax, dword [ebp - 0x1000c]
push 0
lea edx, [ebp - 0x10040]
push edx
push eax
lea ecx, [ebp - 0x10008]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43265e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_Read_Certificate_File.._error__ld__n
jmp 0x4329c0
mov edx, dword [ebp - 0x10040]
mov ebx, dword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
push edx
lea eax, [ebp - 0x10008]
push eax
push 0x10001
call ebx
mov dword [ebp - 0x1003c], eax
test eax, eax
jne 0x4325d8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, dword [ebp - 0x10040]
push 0
push 0
lea ecx, [ebp - 0x10040]
push ecx
lea esi, [ebp + esi - 0x10008]
push esi
lea eax, [ebp - 0x10008]
push 6
mov edx, esi
sub edx, eax
push edx
mov ecx, eax
push ecx
mov dword [ebp - 0x10030], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
mov eax, dword [ebp - 0x10040]
jne 0x4326e3
test eax, eax
je 0x4326e3
call edi
push eax
push str.InstallCertificate:_CryptStringToBinary_failed_with_error__ld__n
jmp 0x4329c0
push eax
push esi
push 0x10001
call ebx
mov dword [ebp - 0x1003c], eax
test eax, eax
jne 0x4325d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_create_Certificate_context.._error__ld__n
jmp 0x4329c0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x432744
cmp dword [ebp + 0xc], eax
jne 0x432744
mov edx, dword [ebp - 0x10054]
push 0x5ea674
push eax
mov dword [edx], 1
call fcn.0057f695
add esp, 8
mov edi, eax
mov dword [ebp - 0x10030], 1
jmp 0x4329aa
mov esi, edi
call fcn.00433190
push edi
push str.InstallCertificate:_Store_Name___s___n
mov esi, eax
call fcn.0043d390
add esp, 8
push esi
push 0x21000
push 0
push 0x10001
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov ebx, eax
mov dword [ebp - 0x10044], ebx
test ebx, ebx
jne 0x43279c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.InstallCertificate:_Error_in_opening_certificate_store___s_.._error__ld__n
mov dword [ebp - 0x10030], eax
call fcn.0043d500
add esp, 0xc
jmp 0x432921
mov esi, dword [ebp - 0x10050]
mov ecx, str..cer
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4327d0
test dl, dl
je 0x4327cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4327d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4327b0
xor eax, eax
jmp 0x4327d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4328b6
mov ecx, str..crt
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x432804
test dl, dl
je 0x432800
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x432804
add eax, 2
add ecx, 2
test dl, dl
jne 0x4327e4
xor eax, eax
jmp 0x432809
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4328b6
mov eax, dword [ebp - 0x1003c]
mov ecx, dword [ebp - 0x1004c]
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov esi, eax
test esi, esi
je 0x4328aa
push 0
push 4
push esi
push ebx
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x432896
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x10030], ebx
cmp ebx, 0x80092005
je 0x43286c
push ebx
push edi
push str.InstallCertificate:_Certificate_cannot_be_added_to_the_store___s_.._error__ld__n
mov dword [ebp - 0x10034], 0
call fcn.0043d500
add esp, 0xc
jmp 0x432879
push str.InstallCertificate:_Certificate_already_exist_in_this_store__n
call fcn.0043d7e0
add esp, 4
push ebx
call fcn.0043f8a0
add esp, 4
push eax
push str.Error_Message:__s__n
call fcn.0043d500
mov ebx, dword [ebp - 0x10044]
add esp, 8
mov edx, dword [ebp - 0x1004c]
push esi
push edx
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov esi, eax
test esi, esi
jne 0x43282b
mov dword [ebp - 0x1003c], 0
jmp 0x432921
mov eax, dword [ebp - 0x1003c]
push 0
push 4
push eax
push ebx
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x432921
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x10030], esi
cmp esi, 0x80092005
je 0x4328fd
push esi
push edi
push str.InstallCertificate:_Certificate_cannot_be_added_to_the_store___s_.._error__ld__n
mov dword [ebp - 0x10034], 0
call fcn.0043d500
add esp, 0xc
jmp 0x43290a
push str.InstallCertificate:_Certificate_already_exist_in_this_store__n
call fcn.0043d7e0
add esp, 4
push esi
call fcn.0043f8a0
add esp, 4
push eax
push str.Error_Message:__s
call fcn.0043d500
add esp, 8
cmp dword [ebp - 0x10034], 0
jne 0x432986
mov edx, dword [ebp - 0x10038]
mov eax, dword [edx]
mov dword [ebp - 0x10034], 1
mov ecx, 0x5e72f8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x432961
test dl, dl
je 0x43295d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x432961
add eax, 2
add ecx, 2
test dl, dl
jne 0x432941
xor eax, eax
jmp 0x432966
sbb eax, eax
sbb eax, 0xffffffff
mov ebx, dword [ebp - 0x10038]
test eax, eax
je 0x43297d
push 0x5f9254
call fcn.00431ed0
add esp, 4
push edi
call fcn.00431ed0
add esp, 4
push 0x5ea674
push 0
call fcn.0057f695
mov edi, eax
mov eax, dword [ebp - 0x10044]
add esp, 8
test eax, eax
je 0x4329aa
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
test edi, edi
jne 0x4325f4
jmp 0x4329ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_get_certificate_file_handle.._error__ld__n
mov dword [ebp - 0x10030], eax
call fcn.0043d500
add esp, 8
mov eax, dword [ebp - 0x10058]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1003c]
test eax, eax
je 0x4329ec
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [ebp - 0x1004c]
test eax, eax
je 0x4329ff
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov eax, dword [ebp - 0x10048]
test eax, eax
je 0x432a12
push eax
call fcn.0057f05b
add esp, 4
push str._End_of_InstallCertificate_method___n
call fcn.0043d7e0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10030]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057ee81
mov esp, ebp
pop ebp
ret