Function at 0x563240
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0x800
push 0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x563299
push 0x200
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x563299
cmp dword [0x62abb0], 0x3e
jae 0x563297
push eax
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x563299
xor esi, esi
push 0x800
push 0
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5632ee
push 0x200
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5632ee
cmp dword [0x62abb0], 0x3e
jae 0x5632ec
push eax
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5632ee
xor edi, edi
mov ebx, 0x5a4d
test esi, esi
je 0x563601
jmp 0x563300
cmp word [esi], bx
jne 0x563342
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x563342
cmp eax, 0x7fffffff
jae 0x563342
cmp dword [eax + esi], 0x4550
jne 0x563342
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x563342
cmp dword [edx + 4], 0
je 0x563342
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call fcn.00522ae0
nop
jmp 0x563344
xor eax, eax
mov dword [0x63341c], eax
mov ebx, esi
mov eax, 0x5a4d
mov ecx, 0x3c
cmp word [esi], ax
jne 0x56339d
mov eax, dword ds:[ebx + ecx]
test eax, eax
je 0x56339d
cmp eax, 0x7fffffff
jae 0x56339d
cmp dword [eax + esi], 0x4550
jne 0x56339d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x56339d
cmp dword [edx + 4], 0
je 0x56339d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle2
push eax
call fcn.00522ae0
jmp 0x56339f
xor eax, eax
mov dword [0x6333fc], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x5633f5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x5633f5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x5633f5
cmp dword [eax + esi], 0x4550
jne 0x5633f5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x5633f5
cmp dword [edx + 4], 0
je 0x5633f5
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext
push eax
call fcn.00522ae0
jmp 0x5633f7
xor eax, eax
mov dword [0x633400], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x563447
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x563447
cmp eax, 0x7fffffff
jae 0x563447
cmp dword [eax + esi], 0x4550
jne 0x563447
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x563447
cmp dword [edx + 4], 0
je 0x563447
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext2
push eax
call fcn.00522ae0
jmp 0x563449
xor eax, eax
mov dword [0x633414], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x56349d
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x56349d
cmp eax, 0x7fffffff
jae 0x56349d
cmp dword [eax + esi], 0x4550
jne 0x56349d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x56349d
cmp dword [edx + 4], 0
je 0x56349d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminEnumCatalogFromHash
push eax
call fcn.00522ae0
jmp 0x56349f
xor eax, eax
mov dword [0x633404], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x5634f5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x5634f5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x5634f5
cmp dword [eax + esi], 0x4550
jne 0x5634f5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x5634f5
cmp dword [edx + 4], 0
je 0x5634f5
push 0
add eax, esi
mov ecx, esi
push str.CryptCATCatalogInfoFromContext
push eax
call fcn.00522ae0
jmp 0x5634f7
xor eax, eax
mov dword [0x6333f8], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x563547
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x563547
cmp eax, 0x7fffffff
jae 0x563547
cmp dword [eax + esi], 0x4550
jne 0x563547
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x563547
cmp dword [edx + 4], 0
je 0x563547
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseCatalogContext
push eax
call fcn.00522ae0
jmp 0x563549
xor eax, eax
mov dword [0x6333f0], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x56359d
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x56359d
cmp eax, 0x7fffffff
jae 0x56359d
cmp dword [eax + esi], 0x4550
jne 0x56359d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x56359d
cmp dword [edx + 4], 0
je 0x56359d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseContext
push eax
call fcn.00522ae0
jmp 0x56359f
xor eax, eax
mov dword [0x6333f4], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x5635f5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x5635f5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x5635f5
cmp dword [eax + esi], 0x4550
jne 0x5635f5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x5635f5
cmp dword [edx + 4], 0
je 0x5635f5
push 0
add eax, esi
mov ecx, esi
push str.WinVerifyTrust
push eax
call fcn.00522ae0
jmp 0x5635f7
xor eax, eax
mov dword [0x633418], eax
mov ebx, 0x5a4d
test edi, edi
je 0x563743
cmp word [edi], bx
jne 0x56364a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x56364a
cmp eax, 0x7fffffff
jae 0x56364a
cmp dword [eax + edi], 0x4550
jne 0x56364a
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x56364a
cmp dword [edx + 4], 0
je 0x56364a
push 0
add eax, edi
mov ecx, edi
push str.CertNameToStrW
push eax
call fcn.00522ae0
jmp 0x56364c
xor eax, eax
mov ecx, edi
mov edx, 0x3c
mov dword [0x633408], eax
cmp word [edi], bx
jne 0x5636e7
mov eax, dword [ecx + edx]
test eax, eax
je 0x5636a5
cmp eax, 0x7fffffff
jae 0x5636a5
cmp dword ds:[eax + edi], 0x4550
jne 0x5636a5
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5636a5
cmp dword [edx + 4], 0
je 0x5636a5
push 0
add eax, edi
push str.CertGetEnhancedKeyUsage
push eax
call fcn.00522ae0
cmp word [edi], bx
jne 0x5636e7
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x5636e7
cmp eax, 0x7fffffff
jae 0x5636e7
cmp dword ds:[eax + edi], 0x4550
jne 0x5636e7
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5636e7
cmp dword [edx + 4], 0
je 0x5636e7
push 0
add eax, edi
mov ecx, edi
push str.CertDuplicateCertificateContext
push eax
call fcn.00522ae0
jmp 0x5636e9
xor eax, eax
mov dword [0x63340c], eax
cmp word [edi], bx
jne 0x56373a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x56373a
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x56373a
cmp dword [eax + edi], 0x4550
jne 0x56373a
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x56373a
cmp dword [edx + 4], 0
je 0x56373a
push 0
add eax, edi
mov ecx, edi
push str.CertFreeCertificateContext
push eax
call fcn.00522ae0
mov dword [0x633410], eax
jmp 0x563748
xor eax, eax
mov dword [0x633410], eax
jmp 0x563748
mov eax, dword [0x633410]
cmp dword [0x63341c], 0
je 0x5637b5
cmp dword [0x633400], 0
je 0x5637b5
cmp dword [0x633404], 0
je 0x5637b5
cmp dword [0x6333f8], 0
je 0x5637b5
cmp dword [0x6333f0], 0
je 0x5637b5
cmp dword [0x6333f4], 0
je 0x5637b5
cmp dword [0x633418], 0
je 0x5637b5
cmp dword [0x633408], 0
je 0x5637b5
cmp dword [0x63340c], 0
je 0x5637b5
test eax, eax
je 0x5637b5
push 0x64
push 0x564860
push 0x564820
push 0x18
call sym.SystemInformer.exe_PhCreateHashtable
mov dword [0x633398], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret