Function at 0x506360
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.crypt32.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov ebx, 0x5a4d
test esi, esi
je 0x5067dd
movzx ecx, word [esi]
mov edx, ecx
cmp cx, bx
jne 0x5063f1
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5063f1
cmp eax, 0x7fffffff
jae 0x5063f1
cmp dword [eax + esi], 0x4550
jne 0x5063f1
lea ecx, ds:[eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x5063e3
cmp dword [ecx + 4], 0
je 0x5063e3
push 0
push str.CryptCATAdminCalcHashFromFileHandle
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov ecx, eax
movzx eax, word [esi]
jmp 0x5063f5
mov dword [0x5b4030], 0
mov eax, edx
jmp 0x506405
xor ecx, ecx
mov eax, edx
movzx eax, ax
mov dword [0x5b4030], ecx
cmp ax, bx
jne 0x50644c
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x50644c
cmp ecx, 0x7fffffff
jae 0x50644c
cmp dword [ecx + esi], 0x4550
jne 0x50644c
add ecx, 0x78
add ecx, esi
mov edx, dword [ecx]
test edx, edx
je 0x50644c
cmp dword [ecx + 4], 0
je 0x50644c
push 0
push str.CryptCATAdminCalcHashFromFileHandle2
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov ecx, eax
movzx eax, word [esi]
jmp 0x506451
movzx eax, ax
xor ecx, ecx
movzx edx, ax
mov dword [0x5b4004], ecx
cmp dx, bx
jne 0x5064b1
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5064b1
cmp eax, 0x7fffffff
jae 0x5064b1
cmp dword [eax + esi], 0x4550
jne 0x5064b1
lea ecx, ds:[eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x5064a3
cmp dword [ecx + 4], 0
je 0x5064a3
push 0
push str.CryptCATAdminAcquireContext
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov ecx, eax
movzx eax, word [esi]
jmp 0x5064b5
mov dword [0x5b4010], 0
mov eax, edx
jmp 0x5064c5
xor ecx, ecx
mov eax, edx
movzx eax, ax
mov dword [0x5b4010], ecx
cmp ax, bx
jne 0x50651b
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x50651b
cmp ecx, 0x7fffffff
jae 0x50651b
cmp dword [ecx + esi], 0x4550
jne 0x50651b
add ecx, 0x78
add ecx, esi
mov edx, dword [ecx]
test edx, edx
je 0x50650c
cmp dword [ecx + 4], 0
je 0x50650c
push 0
push str.CryptCATAdminAcquireContext2
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov ecx, eax
movzx eax, word [esi]
jmp 0x506520
mov dword [0x5b4028], 0
movzx eax, ax
jmp 0x50652e
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b4028], ecx
cmp ax, bx
jne 0x506582
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x506582
cmp ecx, 0x7fffffff
jae 0x506582
cmp dword [ecx + esi], 0x4550
jne 0x506582
add ecx, 0x78
add ecx, esi
mov edx, dword [ecx]
test edx, edx
je 0x506571
cmp dword [ecx + 4], 0
je 0x506571
push 0
push str.CryptCATAdminEnumCatalogFromHash
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov ecx, eax
movzx eax, word [esi]
jmp 0x506587
mov dword [0x5b4018], 0
movzx eax, ax
jmp 0x506595
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b4018], ecx
cmp ax, bx
jne 0x5065eb
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x5065eb
lea esp, [esp]
cmp ecx, 0x7fffffff
jae 0x5065eb
cmp dword [ecx + esi], 0x4550
jne 0x5065eb
add ecx, 0x78
add ecx, esi
mov edx, dword [ecx]
test edx, edx
je 0x5065dc
cmp dword [ecx + 4], 0
je 0x5065dc
push 0
push str.CryptCATCatalogInfoFromContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov ecx, eax
movzx eax, word [esi]
jmp 0x5065f0
mov dword [0x5b4008], 0
movzx eax, ax
jmp 0x5065fe
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b4008], ecx
cmp ax, bx
jne 0x506653
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x506653
cmp ecx, 0x7fffffff
jae 0x506653
cmp dword [ecx + esi], 0x4550
jne 0x506653
add ecx, 0x78
add ecx, esi
mov edx, dword [ecx]
test edx, edx
je 0x506644
cmp dword [ecx + 4], 0
je 0x506644
push 0
push str.CryptCATAdminReleaseCatalogContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov ecx, eax
movzx eax, word [esi]
jmp 0x506658
mov dword [0x5b3ffc], 0
movzx eax, ax
jmp 0x506666
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b3ffc], ecx
cmp ax, bx
jne 0x5066bb
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x5066bb
cmp ecx, 0x7fffffff
jae 0x5066bb
cmp dword [ecx + esi], 0x4550
jne 0x5066bb
add ecx, 0x78
add ecx, esi
mov edx, dword [ecx]
test edx, edx
je 0x5066ac
cmp dword [ecx + 4], 0
je 0x5066ac
push 0
push str.CryptCATAdminReleaseContext
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov ecx, eax
movzx eax, word [esi]
jmp 0x5066c0
mov dword [0x5b4000], 0
movzx eax, ax
jmp 0x5066ce
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b4000], ecx
cmp ax, bx
jne 0x506722
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x506722
cmp ecx, 0x7fffffff
jae 0x506722
cmp dword [ecx + esi], 0x4550
jne 0x506722
add ecx, 0x78
add ecx, esi
mov edx, dword [ecx]
test edx, edx
je 0x506711
cmp dword [ecx + 4], 0
je 0x506711
push 0
push str.WTHelperProvDataFromStateData
lea eax, [edx + esi]
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov edx, eax
movzx eax, word [esi]
jmp 0x506727
mov dword [0x5b402c], 0
movzx ecx, ax
jmp 0x506735
xor edx, edx
movzx eax, ax
movzx ecx, ax
mov dword [0x5b402c], edx
cmp cx, bx
jne 0x506785
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x506785
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x506785
cmp dword [eax + esi], 0x4550
jne 0x506785
lea ecx, [eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x506779
cmp dword [ecx + 4], 0
je 0x506779
push 0
push str.WTHelperGetProvSignerFromChain
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004b2920
movzx ecx, word [esi]
jmp 0x50678a
mov dword [0x5b400c], 0
jmp 0x506794
xor eax, eax
movzx ecx, cx
mov dword [0x5b400c], eax
cmp cx, bx
jne 0x5067d6
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5067d6
jmp 0x5067a0
cmp eax, 0x7fffffff
jae 0x5067d6
cmp dword [eax + esi], 0x4550
jne 0x5067d6
lea ecx, [eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x5067d6
cmp dword [ecx + 4], 0
je 0x5067d6
push 0
push str.WinVerifyTrust
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004b2920
jmp 0x5067d8
xor eax, eax
mov dword [0x5b4024], eax
lea ecx, [ecx]
test edi, edi
je 0x506908
movzx eax, word [edi]
mov edx, eax
cmp ax, bx
jne 0x506849
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x506849
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x506849
cmp dword [eax + edi], 0x4550
jne 0x506849
lea ecx, [eax + 0x78]
mov eax, dword [ecx + edi]
add ecx, edi
test eax, eax
je 0x50683b
cmp dword [ecx + 4], 0
je 0x50683b
push 0
push str.CertNameToStrW
add eax, edi
push eax
push ecx
mov ecx, edi
call fcn.004b2920
mov ecx, eax
movzx eax, word [edi]
jmp 0x50684d
mov dword [0x5b4014], 0
mov eax, edx
jmp 0x50685b
xor ecx, ecx
mov eax, edx
movzx eax, ax
mov dword [0x5b4014], ecx
cmp ax, bx
jne 0x5068a4
mov ecx, dword ds:[edi + 0x3c]
test ecx, ecx
je 0x5068a4
cmp ecx, 0x7fffffff
jae 0x5068a4
cmp dword [ecx + edi], 0x4550
jne 0x5068a4
add ecx, 0x78
add ecx, edi
mov edx, dword [ecx]
test edx, edx
je 0x5068a4
cmp dword [ecx + 4], 0
je 0x5068a4
push 0
push str.CertDuplicateCertificateContext
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004b2920
mov ecx, eax
movzx eax, word [edi]
jmp 0x5068a9
movzx eax, ax
xor ecx, ecx
mov dword [0x5b401c], ecx
cmp ax, bx
jne 0x506901
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x506901
jmp 0x5068c0
cmp eax, 0x7fffffff
jae 0x506901
cmp dword [eax + edi], 0x4550
jne 0x506901
lea ecx, [eax + 0x78]
mov eax, dword [ecx + edi]
add ecx, edi
test eax, eax
je 0x506901
cmp dword [ecx + 4], 0
je 0x506901
push 0
push str.CertFreeCertificateContext
add eax, edi
push eax
push ecx
mov ecx, edi
call fcn.004b2920
mov dword [0x5b4020], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [0x5b4020], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret