Function at 0x4a6ec1
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x32c], eax
xor edx, edx
mov dword [ebp - 0x400], edi
mov esi, ecx
mov dword [ebp - 0x3e8], edx
mov ecx, edx
mov dword [ebp - 0x37c], edx
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x38c], ecx
cmp dword [0x51996c], ecx
jne 0x4a6f18
test eax, eax
je 0x4a6f18
mov ebx, edx
jmp 0x4a6f1b
xor ebx, ebx
inc ebx
mov eax, edx
mov dword [ebp - 0x380], edx
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3c4], eax
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3f0], eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3e0], eax
mov eax, dword [0x5199d8]
push 0x88
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x314]
push edx
push eax
call sub.msvcrt.dll_memset
or dword [ebp - 0x358], 0xffffffff
lea edx, [ebp - 0x3e8]
xor eax, eax
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x340], eax
call fcn.004a4541
mov esi, eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x3f8], eax
test esi, esi
je 0x4a7074
push 1
push esi
push 0xde1013e
call dword [sym.imp.certcli.dll_Ordinal_358]
jmp 0x4a8264
lea eax, [ebp - 0x400]
xor edx, edx
push eax
push ecx
lea eax, [ebp - 0x28c]
xor ecx, ecx
push eax
push 0
push edi
call fcn.0043f6ce
mov esi, eax
test esi, esi
je 0x4a70a0
push esi
push 0xdeb013e
jmp 0x4a825e
mov ecx, dword [ebp - 0x3f8]
lea eax, [ebp - 0x428]
push eax
lea edx, [ebp - 0x358]
call fcn.004dee7c
mov esi, eax
test esi, esi
je 0x4a70c9
push esi
push 0xdee013e
jmp 0x4a825e
push 0xf0000000
push 1
push 0x41d838
push 0
lea eax, [ebp - 0x380]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4a70fa
call fcn.004c73cc
mov esi, eax
push esi
push 0xdf8013e
jmp 0x4a825e
push ebx
push ecx
lea ecx, [ebp - 0x358]
call fcn.004a5103
mov esi, eax
test esi, esi
je 0x4a7118
push esi
push 0xe03013e
jmp 0x4a825e
lea eax, [ebp - 0x388]
mov edi, 0x420640
push eax
push 0
push ebx
push ecx
push 1
push edi
mov edx, 0x420658
lea ecx, [ebp - 0x358]
call fcn.004a4fe5
mov esi, eax
test esi, esi
je 0x4a714c
push esi
push 0xe11013e
jmp 0x4a825e
lea eax, [ebp - 0x394]
mov edx, 0x420658
push eax
push 0
push ebx
push ecx
push 1
push 0x420678
lea ecx, [ebp - 0x358]
call fcn.004a4fe5
mov esi, eax
test esi, esi
je 0x4a717f
push esi
push 0xe1c013e
jmp 0x4a825e
mov eax, dword [ebp - 0x394]
dec eax
push 0x40
pop esi
sub eax, 1
je 0x4a727b
sub eax, 1
je 0x4a71c6
mov eax, 0x420678
mov ecx, 0x98b
push eax
push eax
call fcn.004cf8b9
push eax
push 0x4206f4
call fcn.004c5942
add esp, 0x10
mov eax, 0x8007000d
push eax
push 0xe58013e
jmp 0x4a825c
cmp dword [ebp - 0x388], 0x80
mov dword [ebp - 0x324], 0x20
je 0x4a7205
push edi
mov ecx, 0x98b
call fcn.004cf8b9
push eax
push 0x4206c4
call fcn.004c5942
add esp, 0xc
mov eax, 0x8007000d
push eax
push 0xe3f013e
jmp 0x4a825c
lea eax, [ebp - 0x420]
mov edx, 0x420658
push eax
push 0xe0000102
push ebx
push ecx
push 1
push 0x4206e0
lea ecx, [ebp - 0x358]
call fcn.004a4fe5
test eax, eax
je 0x4a7273
push eax
push eax
push 0xe4a013e
call dword [sym.imp.certcli.dll_Ordinal_358]
xor edi, edi
mov dword [ebp - 0x328], edi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x37c]
push eax
push ebx
push ecx
lea ecx, [ebp - 0x358]
call fcn.004a53b1
mov esi, eax
test esi, esi
je 0x4a730e
push esi
push 0xe79013e
jmp 0x4a825e
mov dword [ebp - 0x324], esi
jmp 0x4a723b
cmp dword [ebp - 0x388], 0x28
mov dword [ebp - 0x324], 0x10
jne 0x4a7293
xor edi, edi
inc edi
jmp 0x4a72a1
cmp dword [ebp - 0x388], esi
jne 0x4a8237
xor edi, edi
lea eax, [ebp - 0x3fc]
mov dword [ebp - 0x328], edi
push eax
push 0
push ebx
push ecx
push 1
push 0x42071c
mov edx, 0x420658
lea ecx, [ebp - 0x358]
call fcn.004a4fe5
mov esi, eax
test esi, esi
je 0x4a72da
push esi
push 0xe66013e
jmp 0x4a825e
cmp dword [ebp - 0x3fc], 3
je 0x4a7243
mov ecx, 0x98b
call fcn.004cf8b9
push eax
push 0x420728
call fcn.004c5942
pop ecx
pop ecx
mov eax, 0x8007000d
push eax
push 0xe6e013e
jmp 0x4a825c
lea eax, [ebp - 0x38c]
push eax
push ecx
push ebx
push ecx
lea ecx, [ebp - 0x358]
call fcn.004a5078
mov esi, eax
test esi, esi
je 0x4a7340
push esi
push 0xe82013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edx, dword [ebp - 0x38c]
jmp 0x4a826a
lea eax, [ebp - 0x3fc]
mov edx, 0x420658
push eax
push 0
push ebx
push ecx
push 1
push 0x420764
lea ecx, [ebp - 0x358]
call fcn.004a4fe5
test eax, eax
je 0x4a7372
push eax
push 0xe8d013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edx, dword [ebp - 0x380]
lea eax, [ebp - 0x314]
push eax
push ecx
mov ecx, dword [ebp - 0x38c]
push ecx
push dword [ebp - 0x400]
mov dword [ebp - 0x320], ecx
mov ecx, dword [ebp - 0x324]
call fcn.004a39c6
mov esi, eax
test esi, esi
je 0x4a73af
push esi
push 0xe9d013e
jmp 0x4a825e
push dword [ebp - 0x41c]
mov edx, dword [ebp - 0x37c]
lea ecx, [ebp - 0x314]
call fcn.004a406f
mov esi, eax
test esi, esi
je 0x4a73f2
push esi
push 0xea4013e
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp dword [0x518ddc], 2
jl 0x4a8264
cmp dword [ebp - 0x324], 0x40
jne 0x4a8264
cmp dword [0x51996c], 0
jne 0x4a7409
test ebx, ebx
jne 0x4a7409
mov dword [0x5199d8], 1
call fcn.004a38c1
cmp dword [ebp - 0x394], 2
mov esi, dword [ebp - 0x324]
je 0x4a7426
cmp esi, 0x40
jne 0x4a7c71
lea eax, [ebp - 0x390]
mov edx, 0x420778
push eax
lea eax, [ebp - 0x404]
push eax
push 0xe0000102
lea eax, [ebp - 0x314]
push eax
push 0x414974
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
test eax, eax
je 0x4a7475
mov ecx, 0x4207a0
cmp esi, 0x40
je 0x4a7468
mov ecx, 0x4207e8
push eax
push 0xeca013e
push ecx
call dword [sym.imp.certcli.dll_Ordinal_359]
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a74a1
push 0x420ff8
call fcn.004c5942
mov dword [esp], 0x420778
push 0x4205a0
call fcn.004c5942
pop ecx
pop ecx
push 0x414974
push 0x40aa64
call fcn.004c5942
mov esi, dword [ebp - 0x404]
mov dword [ebp - 0x3ac], esi
pop ecx
pop ecx
test esi, esi
je 0x4a750b
mov edx, dword [ebp - 0x390]
mov ecx, esi
call fcn.004a54a5
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0x390]
xor edx, edx
xor ecx, ecx
push esi
call fcn.0045bba5
mov esi, eax
test esi, esi
je 0x4a74f6
push esi
push 0xed8013e
jmp 0x4a825e
push 0x406520
call fcn.004c5942
mov esi, dword [ebp - 0x3ac]
xor eax, eax
pop ecx
jmp 0x4a7510
mov eax, 0xe0000102
lea ecx, [ebp - 0x40c]
mov edx, 0x420778
push ecx
lea ecx, [ebp - 0x408]
push ecx
push eax
lea eax, [ebp - 0x314]
push eax
push 0x40c12c
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
test eax, eax
je 0x4a755f
cmp dword [ebp - 0x324], 0x40
mov ecx, 0x42082c
je 0x4a7552
mov ecx, 0x420860
push eax
push 0xeeb013e
push ecx
call dword [sym.imp.certcli.dll_Ordinal_359]
test ebx, ebx
je 0x4a757a
push 0x40c12c
push 0x420778
push 0x420894
call fcn.004c5942
add esp, 0xc
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3b4], ecx
test esi, esi
je 0x4a75e6
test eax, eax
je 0x4a75e6
mov ecx, 0x98f
call fcn.004cf8b9
test eax, eax
jne 0x4a75ad
mov eax, 0x4208ac
mov ecx, dword [ebp - 0x32c]
mov edx, ebx
push 2
push 0x2400
push dword [ebp - 0x3b4]
push dword [ebp - 0x3b0]
push dword [ebp - 0x390]
push esi
push eax
call fcn.004a5a6d
mov esi, eax
test esi, esi
je 0x4a75e6
push esi
push 0xf02013e
jmp 0x4a825e
lea eax, [ebp - 0x410]
mov edx, 0x4208d0
push eax
push 0
push ebx
push ecx
push 1
push 0x4208bc
lea ecx, [ebp - 0x358]
call fcn.004a4fe5
mov esi, eax
test esi, esi
je 0x4a7619
push esi
push 0xf11013e
jmp 0x4a825e
test edi, edi
je 0x4a7624
mov esi, 0x4208ec
jmp 0x4a7637
cmp dword [ebp - 0x394], 2
mov esi, 0x420910
je 0x4a7637
mov esi, 0x420944
cmp dword [ebp - 0x410], 0
mov dword [ebp - 0x330], esi
jbe 0x4a78b9
xor edi, edi
inc edi
mov dword [ebp - 0x334], edi
cmp dword [ebp - 0x328], 0
mov dword [ebp - 0x384], edi
mov edi, 0x414974
jne 0x4a766a
lea edi, [ebp - 0x30]
mov eax, dword [ebp - 0x33c]
test eax, eax
je 0x4a7682
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x4a76a1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x35c], eax
push dword [ebp - 0x334]
lea eax, [ebp - 0x30]
push 0x42096c
push 0x26
push eax
call fcn.004444ad
add esp, 0x10
lea eax, [ebp - 0x398]
mov edx, esi
lea ecx, [ebp - 0x358]
push eax
lea eax, [ebp - 0x360]
push eax
push 0
lea eax, [ebp - 0x314]
push eax
push edi
call fcn.004a4dbc
mov esi, eax
test esi, esi
jne 0x4a7968
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a7703
push 0x420ff8
call fcn.004c5942
pop ecx
push edi
push dword [ebp - 0x330]
push 0x420894
call fcn.004c5942
mov esi, dword [ebp - 0x360]
add esp, 0xc
mov edx, dword [ebp - 0x398]
mov ecx, esi
mov dword [ebp - 0x33c], esi
call fcn.004a54a5
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0x398]
xor edx, edx
xor ecx, ecx
push esi
call fcn.0045bba5
mov esi, eax
test esi, esi
jne 0x4a795d
mov edi, dword [ebp - 0x334]
lea eax, [ebp - 0x54]
push edi
push 0x42097c
push 0x24
push eax
call fcn.004444ad
add esp, 0x10
lea eax, [ebp - 0x39c]
mov edx, 0x4208d0
lea ecx, [ebp - 0x358]
push eax
lea eax, [ebp - 0x35c]
push eax
push esi
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004a4dbc
mov esi, eax
test esi, esi
jne 0x4a7934
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a77c3
lea eax, [ebp - 0x54]
push eax
push 0x4208d0
push 0x420894
call fcn.004c5942
add esp, 0xc
cmp dword [0x51996c], 0
mov esi, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x368], eax
je 0x4a77f8
mov ecx, dword [0x5199c0]
mov edx, esi
push eax
or ecx, 0x1804
call fcn.004ca44f
mov ecx, 0x990
call fcn.004cf8b9
test eax, eax
jne 0x4a780b
mov eax, 0x420988
mov ecx, dword [ebp - 0x368]
mov edx, ebx
push 1
push 0xa400
push ecx
mov ecx, dword [ebp - 0x32c]
push esi
push dword [ebp - 0x398]
push dword [ebp - 0x33c]
push eax
call fcn.004a5a6d
mov esi, eax
test esi, esi
jne 0x4a7929
push edi
push 0x42096c
lea eax, [ebp - 0x30]
push 0x26
push eax
call fcn.004444ad
add esp, 0xc
lea eax, [ebp - 0x30]
push ebx
push ecx
push ecx
push eax
lea ecx, [ebp - 0x358]
call fcn.004a51fe
mov esi, eax
test esi, esi
jne 0x4a791e
lea eax, [ebp - 0x424]
mov edx, 0x420944
push eax
push esi
push ebx
push ecx
push 2
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x358]
call fcn.004a4fe5
mov esi, eax
test esi, esi
jne 0x4a7913
mov eax, dword [ebp - 0x384]
inc edi
mov esi, dword [ebp - 0x330]
mov dword [ebp - 0x334], edi
cmp eax, dword [ebp - 0x410]
jb 0x4a7653
mov edi, dword [ebp - 0x328]
test edi, edi
jne 0x4a79f6
lea eax, [ebp - 0x384]
mov edx, 0x4208ec
push eax
lea eax, [ebp - 0x3a0]
push eax
push edi
lea eax, [ebp - 0x314]
push eax
push 0x414974
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
mov esi, eax
test esi, esi
je 0x4a7985
push esi
push 0xf91013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x3b8], eax
jmp 0x4a8264
push esi
push 0xf81013e
jmp 0x4a825e
push esi
push 0xf76013e
jmp 0x4a825e
push esi
push 0xf67013e
jmp 0x4a825e
push esi
push 0xf52013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, dword [ebp - 0x39c]
mov ebx, dword [ebp - 0x35c]
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x368], ecx
jmp 0x4a8270
push esi
push 0xf47013e
jmp 0x4a825e
push esi
push 0xf36013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x33c], eax
jmp 0x4a8264
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a799f
push 0x420ff8
call fcn.004c5942
pop ecx
push 0x414974
push 0x4208ec
push 0x420894
call fcn.004c5942
mov esi, dword [ebp - 0x3a0]
add esp, 0xc
mov edx, dword [ebp - 0x384]
mov ecx, esi
mov dword [ebp - 0x3b8], esi
call fcn.004a54a5
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0x384]
xor edx, edx
xor ecx, ecx
push esi
call fcn.0045bba5
mov esi, eax
test esi, esi
je 0x4a79f6
push esi
push 0xf9f013e
jmp 0x4a825e
lea eax, [ebp - 0x334]
mov edx, 0x406d50
push eax
lea eax, [ebp - 0x3a4]
push eax
push 0
lea eax, [ebp - 0x314]
push eax
push 0x414974
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
mov esi, eax
test esi, esi
je 0x4a7a45
push esi
push 0xfad013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp - 0x36c], ecx
jmp 0x4a8264
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a7a5f
push 0x420ff8
call fcn.004c5942
pop ecx
push 0x414974
push 0x406d50
push 0x420894
call fcn.004c5942
mov esi, dword [ebp - 0x3a4]
add esp, 0xc
mov edx, dword [ebp - 0x334]
mov ecx, esi
mov dword [ebp - 0x36c], esi
call fcn.004a54a5
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0x334]
xor edx, edx
xor ecx, ecx
push esi
call fcn.0045bba5
mov esi, eax
test esi, esi
je 0x4a7ab6
push esi
push 0xfbb013e
jmp 0x4a825e
mov edx, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x36c]
call fcn.004a5b9b
test eax, eax
je 0x4a7ad7
push eax
push 0xfbe013e
call dword [sym.imp.certcli.dll_Ordinal_357]
test edi, edi
je 0x4a7bc0
lea eax, [ebp - 0x330]
mov edx, 0x42099c
push eax
lea eax, [ebp - 0x3e4]
push eax
push 0
lea eax, [ebp - 0x314]
push eax
push 0x414974
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
mov esi, eax
test esi, esi
je 0x4a7b2e
push esi
push 0xfcd013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp - 0x370], ecx
jmp 0x4a8264
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a7b48
push 0x420ff8
call fcn.004c5942
pop ecx
push 0x414974
push 0x42099c
push 0x420894
call fcn.004c5942
mov esi, dword [ebp - 0x3e4]
add esp, 0xc
mov edx, dword [ebp - 0x330]
mov ecx, esi
mov dword [ebp - 0x370], esi
call fcn.004a54a5
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0x330]
xor edx, edx
xor ecx, ecx
push esi
call fcn.0045bba5
mov esi, eax
test esi, esi
je 0x4a7b9f
push esi
push 0xfdb013e
jmp 0x4a825e
mov edx, dword [ebp - 0x330]
mov ecx, dword [ebp - 0x370]
call fcn.004a5b9b
test eax, eax
je 0x4a7bc0
push eax
push 0xfde013e
call dword [sym.imp.certcli.dll_Ordinal_357]
lea eax, [ebp - 0x3e0]
push eax
push ecx
lea eax, [ebp - 0x314]
push eax
push ecx
lea ecx, [ebp - 0x358]
call fcn.004a52b8
mov esi, eax
test esi, esi
je 0x4a7bfe
push esi
push 0xfeb013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x3c8], eax
jmp 0x4a8264
mov eax, dword [ebp - 0x3e0]
push eax
push 0x41d4d8
push 0x4209ac
push 0x4204c8
mov dword [ebp - 0x3c8], eax
call fcn.004c5942
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
push ecx
lea eax, [ebp - 0x314]
push eax
push ecx
lea ecx, [ebp - 0x358]
call fcn.004a5337
mov esi, eax
test esi, esi
je 0x4a7c4e
push esi
push 0xffa013e
jmp 0x4a825e
push dword [ebp - 0x414]
push 0x4209d4
push 0x4209ac
push 0x4209e8
call fcn.004c5942
mov esi, dword [ebp - 0x324]
add esp, 0x10
test edi, edi
je 0x4a7c9b
test ebx, ebx
je 0x4a8228
lea ecx, [ebp - 0x358]
call fcn.004a6d61
test eax, eax
je 0x4a8228
push eax
push 0x1007013e
jmp 0x4a8222
lea eax, [ebp - 0x328]
mov edx, 0x420a0c
push eax
push 0xe0000102
push ebx
push ecx
push 1
push 0x4208bc
lea ecx, [ebp - 0x358]
call fcn.004a4fe5
mov ecx, eax
test ecx, ecx
je 0x4a7cf6
xor edi, edi
mov dword [ebp - 0x338], 0xe0000102
mov dword [ebp - 0x328], edi
mov eax, 0x420a1c
cmp esi, 0x40
je 0x4a7ce7
mov eax, 0x420a44
push ecx
push 0x1022013e
push eax
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4a7cfc
mov edi, dword [ebp - 0x328]
lea eax, [ebp - 0x3d4]
mov edx, 0x420a0c
push eax
lea eax, [ebp - 0x3ec]
push eax
push 0xe0000102
lea eax, [ebp - 0x314]
push eax
push 0x420a6c
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
test eax, eax
je 0x4a7d4b
mov ecx, 0x420a94
cmp esi, 0x40
je 0x4a7d3e
mov ecx, 0x420ad0
push eax
push 0x1032013e
push ecx
call dword [sym.imp.certcli.dll_Ordinal_359]
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a7d77
push 0x420ff8
call fcn.004c5942
mov dword [esp], 0x420a0c
push 0x4205a0
call fcn.004c5942
pop ecx
pop ecx
push 0x420a6c
push 0x40aa64
call fcn.004c5942
mov esi, dword [ebp - 0x3ec]
mov dword [ebp - 0x3bc], esi
pop ecx
pop ecx
test esi, esi
je 0x4a7ecd
mov edx, dword [ebp - 0x3d4]
mov ecx, esi
call fcn.004a54a5
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0x3d4]
xor edx, edx
xor ecx, ecx
push esi
call fcn.0045bba5
mov esi, eax
test esi, esi
je 0x4a7dd0
push esi
push 0x1040013e
jmp 0x4a825e
lea eax, [ebp - 0x3dc]
mov edx, 0x420a0c
push eax
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x314]
push eax
push 0x420b0c
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
mov esi, eax
test esi, esi
je 0x4a7e2f
push esi
push 0x104a013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, dword [ebp - 0x3d8]
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x3c0], ecx
mov dword [ebp - 0x3c4], eax
jmp 0x4a8264
test ebx, ebx
je 0x4a7e4a
push 0x420b0c
push 0x420a0c
push 0x420894
call fcn.004c5942
add esp, 0xc
mov ecx, 0x98f
call fcn.004cf8b9
test eax, eax
jne 0x4a7e5d
mov eax, 0x4208ac
mov ecx, dword [ebp - 0x3dc]
mov edx, ebx
push 2
push 0x2400
push 1
push ecx
mov dword [ebp - 0x3c4], ecx
mov ecx, dword [ebp - 0x3d8]
push ecx
push dword [ebp - 0x3d4]
mov dword [ebp - 0x3c0], ecx
push dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x32c]
push eax
call fcn.004a572e
mov esi, eax
test esi, esi
je 0x4a7ecd
cmp dword [ebp - 0x324], 0x40
mov eax, 0x420b24
je 0x4a7eb3
mov eax, 0x420b50
push esi
push 0x1063013e
push eax
call dword [sym.imp.certcli.dll_Ordinal_359]
cmp dword [ebp - 0x32c], 0
jne 0x4a8264
test ebx, ebx
je 0x4a7ee8
push 0x4208d0
push 0x420a0c
push 0x420894
call fcn.004c5942
add esp, 0xc
lea eax, [ebp - 0x3d0]
mov edx, 0x420a0c
push eax
lea eax, [ebp - 0x3cc]
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x314]
push eax
push 0x4208d0
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
mov esi, eax
test edi, edi
je 0x4a7f4b
test esi, esi
je 0x4a7f4b
push esi
push 0x1079013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x378], eax
jmp 0x4a8264
mov eax, dword [ebp - 0x3cc]
xor edi, edi
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x328], edi
jbe 0x4a80cb
lea eax, [edi + 1]
push eax
push 0x420b7c
mov edi, eax
lea eax, [ebp - 0x80]
push 0x2a
push eax
call fcn.004444ad
add esp, 0x10
lea eax, [ebp - 0x3a8]
mov edx, 0x420910
lea ecx, [ebp - 0x358]
push eax
lea eax, [ebp - 0x364]
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004a4dbc
mov esi, eax
test esi, esi
jne 0x4a81eb
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a7fdd
push 0x420ff8
call fcn.004c5942
pop ecx
lea eax, [ebp - 0x80]
push eax
push 0x420910
push 0x420894
call fcn.004c5942
mov esi, dword [ebp - 0x364]
add esp, 0xc
mov edx, dword [ebp - 0x3a8]
mov ecx, esi
mov dword [ebp - 0x318], esi
call fcn.004a54a5
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0x3a8]
xor edx, edx
xor ecx, ecx
push esi
call fcn.0045bba5
mov esi, eax
test esi, esi
jne 0x4a81e3
mov ecx, 0x990
call fcn.004cf8b9
test eax, eax
jne 0x4a803f
mov eax, 0x420988
mov ecx, dword [ebp - 0x32c]
mov edx, ebx
push 1
push 0xa400
push dword [ebp - 0x328]
push dword [ebp - 0x378]
push dword [ebp - 0x374]
push dword [ebp - 0x3a8]
push dword [ebp - 0x318]
push eax
call fcn.004a572e
mov esi, eax
test esi, esi
je 0x4a80a5
cmp dword [ebp - 0x324], 0x40
mov eax, 0x420b90
je 0x4a808b
mov eax, 0x420bc0
push esi
push 0x10af013e
push eax
call dword [sym.imp.certcli.dll_Ordinal_359]
cmp dword [ebp - 0x32c], 0
jne 0x4a8264
push dword [ebp - 0x318]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x364], eax
cmp edi, dword [ebp - 0x328]
jb 0x4a7f71
mov edi, dword [ebp - 0x324]
mov esi, 0x420bf0
mov eax, esi
cmp edi, 0x40
je 0x4a80e2
mov eax, 0x420c30
push dword [ebp - 0x338]
lea ecx, [ebp - 0x314]
push ecx
push ebx
push eax
push ecx
lea ecx, [ebp - 0x358]
call fcn.004a68fe
test eax, eax
je 0x4a8118
cmp edi, 0x40
je 0x4a810b
mov esi, 0x420c30
push eax
push 0x10ca013e
push esi
call dword [sym.imp.certcli.dll_Ordinal_359]
lea eax, [ebp - 0x32c]
mov esi, 0x420c9c
push eax
lea eax, [ebp - 0x3f0]
mov edx, 0x420a0c
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x314]
push eax
push esi
lea ecx, [ebp - 0x358]
call fcn.004a4dbc
test eax, eax
je 0x4a8169
mov ecx, 0x420cd0
cmp edi, 0x40
je 0x4a815c
mov ecx, 0x420d18
push eax
push 0x10da013e
push ecx
call dword [sym.imp.certcli.dll_Ordinal_359]
push 0x406520
call fcn.004c5942
pop ecx
test ebx, ebx
je 0x4a8195
push 0x420ff8
call fcn.004c5942
mov dword [esp], 0x420a0c
push 0x4205a0
call fcn.004c5942
pop ecx
pop ecx
push esi
push 0x40aa64
call fcn.004c5942
mov ebx, dword [ebp - 0x3f0]
mov dword [ebp - 0x3f4], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x4a8228
mov edx, dword [ebp - 0x32c]
mov ecx, ebx
call fcn.004a54a5
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0x32c]
xor edx, edx
xor ecx, ecx
push ebx
call fcn.0045bba5
mov esi, eax
test esi, esi
je 0x4a820b
push esi
push 0x10e8013e
jmp 0x4a825e
push esi
push 0x109a013e
jmp 0x4a825e
push esi
push 0x108c013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edi, dword [ebp - 0x364]
mov ebx, dword [ebp - 0x31c]
mov edx, dword [ebp - 0x320]
jmp 0x4a8276
mov edx, dword [ebp - 0x32c]
mov ecx, ebx
call fcn.004a5b9b
test eax, eax
je 0x4a8228
push eax
push 0x10eb013e
call dword [sym.imp.certcli.dll_Ordinal_357]
push 0x406520
call fcn.004c5942
pop ecx
xor esi, esi
jmp 0x4a8264
push edi
push edi
mov ecx, 0x98b
call fcn.004cf8b9
push eax
push 0x420698
call fcn.004c5942
add esp, 0x10
mov eax, 0x8007000d
push eax
push 0xe32013e
mov esi, eax
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edx, dword [ebp - 0x320]
mov ebx, dword [ebp - 0x31c]
mov edi, dword [ebp - 0x318]
mov ecx, 0x208
lea eax, [ebp - 0x28c]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x4a8281
test edx, edx
je 0x4a8295
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x3ac]
test eax, eax
je 0x4a82a6
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x4a82c6
mov ecx, dword [ebp - 0x368]
mov eax, ebx
test ecx, ecx
je 0x4a82bf
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x4a82b6
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x3b0]
test ecx, ecx
je 0x4a82ec
mov edx, dword [ebp - 0x3b4]
mov eax, ecx
test edx, edx
je 0x4a82e5
mov byte [eax], 0
inc eax
sub edx, 1
jne 0x4a82dc
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x3b8]
test eax, eax
je 0x4a82fd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x36c]
test eax, eax
je 0x4a830e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x370]
test eax, eax
je 0x4a831f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x33c]
test eax, eax
je 0x4a8330
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x3bc]
test eax, eax
je 0x4a8341
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x3c0]
test ecx, ecx
je 0x4a8367
mov edx, dword [ebp - 0x3c4]
mov eax, ecx
test edx, edx
je 0x4a8360
mov byte [eax], 0
inc eax
sub edx, 1
jne 0x4a8357
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x4a8372
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x374]
test ecx, ecx
je 0x4a8398
mov edx, dword [ebp - 0x378]
mov eax, ecx
test edx, edx
je 0x4a8391
mov byte [eax], 0
inc eax
sub edx, 1
jne 0x4a8388
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x3f4]
test eax, eax
je 0x4a83a9
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x4a83ba
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x37c], 0
je 0x4a83cf
push dword [ebp - 0x37c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x310], 0
je 0x4a83e4
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea eax, [ebp - 0x30c]
push eax
call fcn.004367a0
cmp dword [ebp - 0x380], 0
je 0x4a8407
push 0
push dword [ebp - 0x380]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x358], 0xffffffff
je 0x4a841b
lea ecx, [ebp - 0x358]
call fcn.004df04e
mov ebx, dword [ebp - 0x3f8]
test ebx, ebx
je 0x4a843c
cmp dword [0x519984], 0
jne 0x4a8435
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 8]
pop edi
mov dword [0x5199d8], eax
xor ecx, ebp
mov eax, esi
pop esi
pop ebx
call fcn.005036b0
leave
ret 4