Function at 0x51b4c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0x800
push 0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x51b4f7
push 0xa00
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
push 0x800
push 0
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x51b528
push 0xa00
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov ebx, 0x5a4d
test esi, esi
je 0x51b97c
movzx eax, word [esi]
mov ecx, eax
cmp ax, bx
jne 0x51b590
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x51b590
cmp eax, 0x7fffffff
jae 0x51b590
cmp dword [eax + esi], 0x4550
jne 0x51b590
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x51b582
cmp dword [edx + 4], 0
je 0x51b582
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call fcn.004c0900
mov edx, eax
movzx eax, word [esi]
jmp 0x51b594
mov dword [0x5cf860], 0
mov eax, ecx
jmp 0x51b5a5
xor edx, edx
mov eax, ecx
movzx eax, ax
mov dword [0x5cf860], edx
cmp ax, bx
jne 0x51b5ec
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x51b5ec
cmp ecx, 0x7fffffff
jae 0x51b5ec
cmp dword [ecx + esi], 0x4550
jne 0x51b5ec
lea edx, [ecx + 0x78]
mov ecx, dword [edx + esi]
add edx, esi
test ecx, ecx
je 0x51b5ec
cmp dword [edx + 4], 0
je 0x51b5ec
push 0
lea eax, [ecx + esi]
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle2
push eax
call fcn.004c0900
mov edx, eax
movzx eax, word [esi]
jmp 0x51b5f1
movzx eax, ax
xor edx, edx
movzx ecx, ax
mov dword [0x5cf834], edx
cmp cx, bx
jne 0x51b650
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x51b650
cmp eax, 0x7fffffff
jae 0x51b650
cmp dword [eax + esi], 0x4550
jne 0x51b650
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x51b642
cmp dword [edx + 4], 0
je 0x51b642
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext
push eax
call fcn.004c0900
mov edx, eax
movzx eax, word [esi]
jmp 0x51b654
mov dword [0x5cf840], 0
mov eax, ecx
jmp 0x51b665
xor edx, edx
mov eax, ecx
movzx eax, ax
mov dword [0x5cf840], edx
cmp ax, bx
jne 0x51b6bb
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x51b6bb
cmp ecx, 0x7fffffff
jae 0x51b6bb
cmp dword [ecx + esi], 0x4550
jne 0x51b6bb
lea edx, [ecx + 0x78]
mov ecx, dword [edx + esi]
add edx, esi
test ecx, ecx
je 0x51b6ac
cmp dword [edx + 4], 0
je 0x51b6ac
push 0
lea eax, [ecx + esi]
mov ecx, esi
push str.CryptCATAdminAcquireContext2
push eax
call fcn.004c0900
mov ecx, eax
movzx eax, word [esi]
jmp 0x51b6c0
mov dword [0x5cf854], 0
movzx eax, ax
jmp 0x51b6ce
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5cf854], ecx
cmp ax, bx
jne 0x51b722
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x51b722
cmp ecx, 0x7fffffff
jae 0x51b722
cmp dword [ecx + esi], 0x4550
jne 0x51b722
lea edx, [ecx + 0x78]
mov ecx, dword [edx + esi]
add edx, esi
test ecx, ecx
je 0x51b711
cmp dword [edx + 4], 0
je 0x51b711
push 0
lea eax, [ecx + esi]
mov ecx, esi
push str.CryptCATAdminEnumCatalogFromHash
push eax
call fcn.004c0900
mov ecx, eax
movzx eax, word [esi]
jmp 0x51b727
mov dword [0x5cf848], 0
movzx eax, ax
jmp 0x51b735
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5cf848], ecx
cmp ax, bx
jne 0x51b78b
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x51b78b
lea esp, [esp]
cmp ecx, 0x7fffffff
jae 0x51b78b
cmp dword [ecx + esi], 0x4550
jne 0x51b78b
lea edx, [ecx + 0x78]
mov ecx, dword [edx + esi]
add edx, esi
test ecx, ecx
je 0x51b77c
cmp dword [edx + 4], 0
je 0x51b77c
push 0
lea eax, [ecx + esi]
mov ecx, esi
push str.CryptCATCatalogInfoFromContext
push eax
call fcn.004c0900
mov ecx, eax
movzx eax, word [esi]
jmp 0x51b790
mov dword [0x5cf838], 0
movzx eax, ax
jmp 0x51b79e
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5cf838], ecx
cmp ax, bx
jne 0x51b7f2
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x51b7f2
cmp ecx, 0x7fffffff
jae 0x51b7f2
cmp dword [ecx + esi], 0x4550
jne 0x51b7f2
lea edx, ds:[ecx + 0x78]
mov ecx, dword [edx + esi]
add edx, esi
test ecx, ecx
je 0x51b7e3
cmp dword [edx + 4], 0
je 0x51b7e3
push 0
lea eax, [ecx + esi]
mov ecx, esi
push str.CryptCATAdminReleaseCatalogContext
push eax
call fcn.004c0900
mov ecx, eax
movzx eax, word [esi]
jmp 0x51b7f7
mov dword [0x5cf82c], 0
movzx eax, ax
jmp 0x51b805
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5cf82c], ecx
cmp ax, bx
jne 0x51b85b
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x51b85b
cmp ecx, 0x7fffffff
jae 0x51b85b
cmp dword [ecx + esi], 0x4550
jne 0x51b85b
lea edx, [ecx + 0x78]
mov ecx, dword [edx + esi]
add edx, esi
test ecx, ecx
je 0x51b84c
cmp dword [edx + 4], 0
je 0x51b84c
push 0
lea eax, [ecx + esi]
mov ecx, esi
push str.CryptCATAdminReleaseContext
push eax
call fcn.004c0900
mov ecx, eax
movzx eax, word [esi]
jmp 0x51b860
mov dword [0x5cf830], 0
movzx eax, ax
jmp 0x51b86e
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5cf830], ecx
cmp ax, bx
jne 0x51b8c2
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x51b8c2
cmp ecx, 0x7fffffff
jae 0x51b8c2
cmp dword [ecx + esi], 0x4550
jne 0x51b8c2
lea edx, [ecx + 0x78]
mov ecx, dword [edx + esi]
add edx, esi
test ecx, ecx
je 0x51b8b1
cmp dword [edx + 4], 0
je 0x51b8b1
push 0
lea eax, [ecx + esi]
mov ecx, esi
push str.WTHelperProvDataFromStateData
push eax
call fcn.004c0900
mov edx, eax
movzx eax, word [esi]
jmp 0x51b8c7
mov dword [0x5cf85c], 0
movzx ecx, ax
jmp 0x51b8d5
xor edx, edx
movzx eax, ax
movzx ecx, ax
mov dword [0x5cf85c], edx
cmp cx, bx
jne 0x51b924
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x51b924
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x51b924
cmp dword [eax + esi], 0x4550
jne 0x51b924
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x51b918
cmp dword [edx + 4], 0
je 0x51b918
push 0
add eax, esi
mov ecx, esi
push str.WTHelperGetProvSignerFromChain
push eax
call fcn.004c0900
movzx ecx, word [esi]
jmp 0x51b929
mov dword [0x5cf83c], 0
jmp 0x51b933
xor eax, eax
movzx ecx, cx
mov dword [0x5cf83c], eax
cmp cx, bx
jne 0x51b975
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x51b975
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x51b975
cmp dword [eax + esi], 0x4550
jne 0x51b975
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x51b975
cmp dword [edx + 4], 0
je 0x51b975
push 0
add eax, esi
mov ecx, esi
push str.WinVerifyTrust
push eax
call fcn.004c0900
jmp 0x51b977
xor eax, eax
mov dword [0x5cf858], eax
lea esp, [esp]
test edi, edi
je 0x51baa6
movzx eax, word [edi]
mov ecx, eax
cmp ax, bx
jne 0x51b9e8
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x51b9e8
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x51b9e8
cmp dword [eax + edi], 0x4550
jne 0x51b9e8
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x51b9da
cmp dword [edx + 4], 0
je 0x51b9da
push 0
add eax, edi
mov ecx, edi
push str.CertNameToStrW
push eax
call fcn.004c0900
mov edx, eax
movzx eax, word [edi]
jmp 0x51b9ec
mov dword [0x5cf844], 0
mov eax, ecx
jmp 0x51b9fa
xor edx, edx
mov eax, ecx
movzx eax, ax
mov dword [0x5cf844], edx
cmp ax, bx
jne 0x51ba43
mov ecx, dword ds:[edi + 0x3c]
test ecx, ecx
je 0x51ba43
cmp ecx, 0x7fffffff
jae 0x51ba43
cmp dword [ecx + edi], 0x4550
jne 0x51ba43
lea edx, ds:[ecx + 0x78]
mov ecx, dword [edx + edi]
add edx, edi
test ecx, ecx
je 0x51ba43
cmp dword [edx + 4], 0
je 0x51ba43
push 0
lea eax, [ecx + edi]
mov ecx, edi
push str.CertDuplicateCertificateContext
push eax
call fcn.004c0900
mov ecx, eax
movzx eax, word [edi]
jmp 0x51ba48
movzx eax, ax
xor ecx, ecx
mov dword [0x5cf84c], ecx
cmp ax, bx
jne 0x51ba9f
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x51ba9f
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x51ba9f
cmp dword [eax + edi], 0x4550
jne 0x51ba9f
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x51ba9f
cmp dword [edx + 4], 0
je 0x51ba9f
push 0
add eax, edi
mov ecx, edi
push str.CertFreeCertificateContext
push eax
call fcn.004c0900
mov dword [0x5cf850], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [0x5cf850], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret