Function at 0x46a270
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be748
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6c0
mov eax, dword [0x4f7108]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x6c8], edi
mov dword [ebp - 0x6cc], edi
mov dword [ebp - 0x6d0], edi
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x6c0], 0
push 0x30
mov dword [ebp - 0x6b0], 0
mov dword [ebp - 0x6ac], 0xf
mov byte [ebp - 0x6c0], 0
call fcn.0047e643
add esp, 4
mov dword [ebp - 0x6b0], 0x28
mov esi, eax
mov dword [ebp - 0x6ac], 0x2f
push 0x28
push str.Microsoft_Code_Signing_PCA__expires_2012
push esi
call fcn.00483a80
mov byte [esi + 0x28], 0
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov dword [ebp - 0x6c4], 2
mov dword [ebp - 4], 1
push 0x14
mov dword [ebp - 0x6a8], 1
mov dword [ebp - 0x28], 0xc0ad5172
mov dword [ebp - 0x24], 0x40cf32f7
mov dword [ebp - 0x20], 0xe362e49e
mov dword [ebp - 0x1c], 0x5499bb35
mov dword [ebp - 0x18], 0xfd42d4f
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x69c], 0
call fcn.0047e643
add esp, 4
mov dword [ebp - 0x6a4], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x6a0], eax
lea esi, [eax + 0x14]
push 0x14
push ecx
push eax
mov dword [ebp - 0x69c], esi
call fcn.00483a80
add esp, 0xc
mov dword [ebp - 0x6a0], esi
mov dword [ebp - 0x6c4], 6
mov dword [ebp - 4], 2
mov dword [ebp - 0x698], 0
push 0x50
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x684], 0xf
mov byte [ebp - 0x698], 0
call fcn.0047e643
add esp, 4
mov dword [ebp - 0x688], 0x44
mov esi, eax
mov dword [ebp - 0x684], 0x4f
push 0x44
push str.Microsoft_Windows_Verification_PCA__expires_Sun_Mar_15_18:05:41_2016
push esi
call fcn.00483a80
mov byte [esi + 0x44], 0
add esp, 0xc
mov dword [ebp - 0x698], esi
mov dword [ebp - 0x6c4], 0xe
mov byte [ebp - 4], 3
push 0x14
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x28], 0x86d2a2b1
mov dword [ebp - 0x24], 0x1bb4b695
mov dword [ebp - 0x20], 0xfb6a490a
mov dword [ebp - 0x1c], 0xede5e91e
mov dword [ebp - 0x18], 0xa9c44732
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 0
call fcn.0047e643
add esp, 4
mov dword [ebp - 0x67c], eax
push 0x14
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x678], eax
push ecx
lea esi, [eax + 0x14]
push eax
mov dword [ebp - 0x674], esi
call fcn.00483a80
add esp, 0xc
mov dword [ebp - 0x678], esi
mov dword [ebp - 0x6c4], 0x1e
mov byte [ebp - 4], 4
mov dword [ebp - 0x670], 0
push 0x40
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 0xf
mov byte [ebp - 0x670], 0
call fcn.0047e643
add esp, 4
mov dword [ebp - 0x660], 0x3c
mov esi, eax
mov dword [ebp - 0x65c], 0x3f
push 0x3c
push str.Microsoft_Code_Signing_PCA__expires_Sun_Jan_25_19:32:32_2017
push esi
call fcn.00483a80
mov byte [esi + 0x3c], 0
add esp, 0xc
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x6c4], 0x3e
mov byte [ebp - 4], 5
push 0x14
mov dword [ebp - 0x658], 1
mov dword [ebp - 0x28], 0x7bf9550
mov dword [ebp - 0x24], 0x76990d1b
mov dword [ebp - 0x20], 0x84e00ae4
mov dword [ebp - 0x1c], 0xd2e1f412
mov dword [ebp - 0x18], 0x8cb5af41
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0
call fcn.0047e643
add esp, 4
mov dword [ebp - 0x654], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x650], eax
lea esi, [eax + 0x14]
push 0x14
push ecx
push eax
mov dword [ebp - 0x64c], esi
call fcn.00483a80
add esp, 0xc
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x6c4], 0x7e
mov byte [ebp - 4], 6
mov dword [ebp - 0x648], 0
push 0x40
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.0047e643
add esp, 4
mov dword [ebp - 0x638], 0x3c
mov esi, eax
mov dword [ebp - 0x634], 0x3f
push 0x3c
push str.Microsoft_Windows_PCA_2010__expires_Sun_Jul__6_16:50:23_2025
push esi
call fcn.00483a80
mov byte [esi + 0x3c], 0
add esp, 0xc
mov dword [ebp - 0x648], esi
mov dword [ebp - 0x6c4], 0xfe
mov byte [ebp - 4], 7
mov dword [ebp - 0x630], 1
push 0x12
push 0x52
push 0xa0
push 0x50
push 0x54
push 0xd5
push 0x65
push 0x56
push 0x6f
push 0xd5
push 0x9e
push 0x20
push 0xa6
push 0xcb
push 0x17
push 0xad
push 0xb6
push 0x5e
push 0x62
push 0x69
push 0xef
push 0x6e
push 0x9e
push 0x15
push 0x89
push 0x59
push 0xe7
push 0x70
push 0x96
push 0x66
push 0xc9
mov edx, 0x90
lea ecx, [ebp - 0x62c]
call fcn.0046be90
add esp, 0x7c
push 0x3c
mov edx, str.Microsoft_Code_Signing_PCA__expires_Sun_Apr_26_03:00:00_2012
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x620]
call fcn.0042fd30
add esp, 4
push 0xfc
push 0xfc
push 0x86
push 0xb7
push 0x76
push 0x37
push 0x59
push 0xd8
push 0x12
push 6
push 0xcd
push 0x90
push 0x9f
push 0xf4
push 0x9d
push 0x98
push 0x72
push 0xe3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x604]
push 0x50
mov edx, 0x9d
mov dword [ebp - 0x608], 1
call fcn.0046bd90
add esp, 0x4c
push 0x41
mov edx, str.Microsoft_Update_Signing_CA_1.1__expires_Sun_May__9_19:28:13_2021
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x5f8]
call fcn.0042fd30
add esp, 4
push 0xdb
push 0x43
push 0xcc
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x5e0], 1
push 0xf
push 0x1f
push 0xa
push 0x5c
push 0
push 0xe5
push 0xe3
push 0x3a
push 0xcd
push 0x88
push 0xa2
push 0x74
push 0x49
push 0x87
push 0x43
push 0x16
mov edx, 0xe0
lea ecx, [ebp - 0x5dc]
call fcn.0046bd90
add esp, 0x4c
push 0x41
mov edx, str.Microsoft_Update_Signing_CA_2.1__expires_Sun_Jun_19_16:03:47_2027
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x5d0]
call fcn.0042fd30
add esp, 4
push 0x9d
push 0x30
push 0xe2
push 0x94
push 0x73
push 0x54
push 0xa8
push 0x79
push 0x78
push 0xfc
push 0xd1
push 0x92
push 0x7b
push 0x91
push 0xd6
push 0x2d
push 0x71
push 0x56
push 0x5c
push 0xe2
push 0xf7
push 0xde
push 0xa4
push 0x36
push 0x3f
push 0xcc
push 0x48
push 0x73
push 0x4f
push 0xe4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5b4]
push 0x21
mov edx, 0x5d
mov dword [ebp - 0x5b8], 1
call fcn.0046be90
add esp, 0x7c
push 0x41
mov edx, str.Microsoft_Update_Signing_CA_2.2__expires_Sun_Jun_19_19:03:56_2027
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x5a8]
call fcn.0042fd30
add esp, 4
push 0x5b
push 0x23
push 0x85
push 0x8c
push 0xe8
push 0xe
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x590], 1
push 0x5e
push 0xd8
push 0xdd
push 0xb0
push 0x99
push 0xd4
push 0xe9
push 0x71
push 0xe7
push 4
push 0x93
push 0x30
push 0x2e
push 0xca
push 0xd3
push 0xd6
push 0x7b
push 0x4d
push 0xe3
push 0x2c
push 0xbb
push 0x15
push 0xf1
push 0xcc
push 0x7d
mov edx, 0x72
lea ecx, [ebp - 0x58c]
call fcn.0046be90
add esp, 0x7c
push 0x41
mov edx, str.Microsoft_Update_Signing_CA_2.3__expires_Sun_Jun_19_19:04:17_2027
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x580]
call fcn.0042fd30
add esp, 4
push 0x73
push 0xba
push 0xc4
push 0x39
push 0xec
push 0xee
push 0xdc
push 0x43
push 0x5a
push 0x3e
push 8
push 0xd9
push 0x52
push 0x95
push 0x25
push 0xd7
push 0xbf
push 0x5b
push 0x86
push 0xd4
push 0x31
push 0xa6
push 0x13
push 0xe6
push 0xb0
push 0x13
push 0x63
push 0x71
push 0x55
push 0xaa
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x564]
push 0x96
mov edx, 0xc8
mov dword [ebp - 0x568], 1
call fcn.0046be90
add esp, 0x7c
push 0x4d
mov edx, str.Microsoft_Windows_Phone_Production_PCA_2012__expires_Sun_Jul_24_18:33:56_2027
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x558]
call fcn.0042fd30
add esp, 4
push 0xad
push 0xd6
push 0xd6
push 0xa5
push 0xda
push 0x57
push 0xcd
push 0xca
push 0x29
push 0x26
push 0xaa
push 0xcb
push 0xde
push 0x62
push 0x78
push 0xda
push 0x5c
push 0x52
push 8
push 0xc
push 0x47
push 0x10
push 0xa4
push 0xe8
push 0x57
push 0xee
push 0xf1
push 0x5b
push 0xe9
push 0x56
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x53c]
push 0x61
mov edx, 0xa2
mov dword [ebp - 0x540], 1
call fcn.0046be90
add esp, 0x7c
push 0x4b
mov edx, str.Microsoft_Windows_Production_PCA_2011__expires_Sun_Oct_19_14_:_51_:_42_2026
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x530]
call fcn.0042fd30
add esp, 4
push 0x46
push 0x21
push 3
push 0x7a
push 0x63
push 0x50
push 0x44
push 0x2a
push 0x10
push 0xf3
push 0x1d
push 0x15
push 0xc7
push 0x6a
push 0xd7
push 0xc2
push 0x4d
push 0x50
push 0x50
push 0xff
push 0x3e
push 0x4b
push 0x38
push 0x96
push 0xe8
push 0xd
push 0x86
push 0x7c
push 0x10
push 0xbe
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x514]
push 0x80
mov edx, 0x4e
mov dword [ebp - 0x518], 1
call fcn.0046be90
add esp, 0x7c
push 0x40
mov edx, str.Microsoft_Code_Signing_PCA__expires_Sun_Aug_31_18_:_29_:_32_2020
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x508]
call fcn.0042fd30
add esp, 4
push 0xde
push 7
push 0x3a
push 0xf6
push 2
push 0x24
push 0x72
push 0x21
push 0x83
push 0x22
push 0xc7
push 0x61
push 0x22
push 0xde
push 0x12
push 0x76
push 0x3f
push 0x3a
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x4ec]
push 0x54
mov edx, 0x27
mov dword [ebp - 0x4f0], 1
call fcn.0046bd90
add esp, 0x4c
push 0x45
mov edx, str.Microsoft_Code_Signing_PCA_2010__expires_Sun_Jul__6_16_:_50_:_17_2025
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x4e0]
call fcn.0042fd30
add esp, 4
push 0x95
push 0x81
push 0xbd
push 0x92
push 0xb4
push 0x79
push 0xe0
push 0xe1
push 0xb7
push 0x2c
push 0x6b
push 0xe0
push 0x1f
push 0x1a
push 0x45
push 0xc1
push 0x9c
push 0x60
push 0x37
push 0xde
push 0x50
push 0xdf
push 0x49
push 0xea
push 0x47
push 0x42
push 0xa7
push 0x22
push 0xb9
push 0xf4
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x4c4]
push 0x1a
mov edx, 0x12
mov dword [ebp - 0x4c8], 1
call fcn.0046be90
add esp, 0x7c
mov byte [ebp - 4], 0x1a
push 0x45
mov edx, str.Microsoft_Code_Signing_PCA_2011__expires_Sun_Jul__8_17_:_09_:_09_2026
lea ecx, [ebp - 0x4b8]
call fcn.0042fd30
add esp, 4
push 0x6e
push 0xf2
push 0x8b
push 0xfe
push 0x14
push 0x2d
push 0x4a
push 0x54
push 0xf9
push 0x30
push 0xe6
push 7
push 0x13
push 0x7d
push 0x5e
push 0x53
push 0x62
push 0x54
push 0x50
push 0x1c
push 0xde
push 0xfd
push 0xce
push 0xc8
push 0xdd
push 0xab
push 0xd9
push 0x3a
push 0xa4
push 0x17
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x49c]
push 0xf7
mov edx, 0xf6
mov dword [ebp - 0x4a0], 1
call fcn.0046be90
add esp, 0x7c
push 0x48
mov edx, str.Microsoft_Windows_Verification_PCA__expires_Sun_May__9_19_:_28_:_13_2021
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x490]
call fcn.0042fd30
add esp, 4
push 0x18
push 0xf9
push 0x74
push 0x97
push 0xd5
push 0x2b
push 0xfc
push 0x41
push 0x30
push 0x2c
push 0x4c
push 0x39
push 0xa5
push 0x9a
push 0xc1
push 0xbd
push 2
push 0x5c
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x474]
push 0x5e
mov edx, 0x26
mov dword [ebp - 0x478], 1
call fcn.0046bd90
add esp, 0x4c
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x468]
push 0x52
mov edx, str.Microsoft_Windows_Hardware_Compatibility_PCA__expires_Sun_Jun__4_17_:_15_:_46_2020
call fcn.0042fd30
add esp, 4
push 0xc
push 0xad
push 0x15
push 0x66
push 0xbe
push 2
push 0xb4
push 0xee
push 0xc7
push 0x82
push 0x58
push 0x4d
push 0xda
push 0xb0
push 0x39
push 0xa6
push 0xa9
push 0x42
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x44c]
push 0x32
mov edx, 0x6b
mov dword [ebp - 0x450], 2
call fcn.0046bd90
add esp, 0x4c
push 0x51
mov edx, str.Microsoft_Windows_Verification_Intermediate_PCA__expires_Sun_Apr_26_03:00:00_2010
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x440]
call fcn.0042fd30
add esp, 4
push 0x61
push 0xf
push 0xcb
push 0x5b
push 0x6e
push 0xe9
push 0x86
push 0xa
push 0x55
push 0x34
push 0x55
push 7
push 0xb9
push 0xcf
push 0x25
push 0x3d
push 0x42
push 0x75
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x424]
push 0x26
mov edx, 0x58
mov dword [ebp - 0x428], 1
call fcn.0046bd90
add esp, 0x4c
push 0x4a
mov edx, str.Microsoft_Marketplace_Production_CA_2011__expires_Sun_Nov_14_16:01:45_2021
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x418]
call fcn.0042fd30
add esp, 4
push 0x95
push 0xa4
push 0xe8
push 0xe6
push 0x76
push 0xef
push 0xac
push 0xa2
push 6
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x400], 1
push 0x15
push 0x46
push 0x15
push 0xc5
push 0x2a
push 0x2b
push 0xf9
push 0xab
push 0x56
push 0x2a
push 0xb5
push 0x2c
push 0x39
push 1
push 0xc1
push 0xb3
push 0x8f
push 0x4d
push 0x93
push 0x7b
push 0xb2
push 0x35
mov edx, 0x64
lea ecx, [ebp - 0x3fc]
call fcn.0046be90
add esp, 0x7c
push 0x40
mov edx, str.Microsoft_MarketPlace_PCA_2011__expires_Sun_Mar_28_14:19:39_2031
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x3f0]
call fcn.0042fd30
add esp, 4
push 0x78
push 0x13
push 0x72
push 0x17
push 0xee
push 0x72
push 0x3f
push 0x5f
push 0xb5
push 0xad
push 0xdc
push 0xa2
push 0x4d
push 0x55
push 0x1a
push 0xcb
push 0x50
push 0x20
push 0x8a
push 0x73
push 0x9b
push 0xbf
push 0xd3
push 0xb2
push 0x86
push 0x91
push 0xa0
push 0xcc
push 0x3d
push 0xde
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x3d4]
push 0x9e
mov edx, 0xfc
mov dword [ebp - 0x3d8], 1
call fcn.0046be90
add esp, 0x7c
push 0x3d
mov edx, str.Microsoft_Windows_Third_Party_Component_CA_2012__expires_2027
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x3c8]
call fcn.0042fd30
add esp, 4
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x3b0], 2
push 0x46
push 0xdd
push 2
push 0xdf
push 0x7f
push 0x54
push 0x13
push 0x68
push 0x82
push 0xaf
push 0x5e
push 0xfb
push 0x32
push 0xaa
push 6
push 0x77
push 0x91
push 0x72
push 0xe1
push 0xb8
push 0x1a
push 0x60
push 0xcc
push 0x1d
push 0x5c
push 0xc5
push 0x10
push 0xe3
push 0xd0
push 0xaf
push 0xc1
mov edx, 0xce
lea ecx, [ebp - 0x3ac]
call fcn.0046be90
add esp, 0x7c
push 0x3d
mov edx, str.Microsoft_Windows_Third_Party_Component_CA_2013__expires_2028
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x3a0]
call fcn.0042fd30
add esp, 4
push 0xd1
push 0xae
push 0x47
push 0x75
push 0x7e
push 0x99
push 0x8b
push 0xc8
push 0x47
push 0x20
push 0x11
push 0x6a
push 0xac
push 0x5a
push 0xad
push 0x6c
push 0x4a
push 0xd
push 0xef
push 0x84
push 0xf
push 0xc9
push 0x3f
push 0xac
push 0xa9
push 0x6f
push 0xe8
push 0x6d
push 0x4c
push 0xe4
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x384]
push 0x5e
mov edx, 0xc5
mov dword [ebp - 0x388], 2
call fcn.0046be90
add esp, 0x7c
mov byte [ebp - 4], 0x2a
push 0x3d
mov edx, str.Microsoft_Windows_Third_Party_Component_CA_2014__expires_2029
lea ecx, [ebp - 0x378]
call fcn.0042fd30
add esp, 4
push 0xae
push 0xf0
push 0x9c
push 0x96
push 0xbd
push 0xbb
push 0xee
push 0x6f
push 0x12
push 0x55
push 0x41
push 0x75
push 0xb2
push 0x78
push 3
push 0xe9
push 0x55
push 0x49
push 0xb6
push 0x6f
push 0x6f
push 0xbc
push 0x18
push 0xf8
push 0x8e
push 8
push 0x74
push 0x90
push 0x4d
push 0x9e
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x35c]
push 0xbe
mov edx, 0xd8
mov dword [ebp - 0x360], 2
call fcn.0046be90
add esp, 0x7c
push 0x23
mov edx, str.Mcafee_sha1_cert_expires_2017_03_04
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x350]
call fcn.0042fd30
add esp, 4
push 0x9e
push 0x6f
push 0xed
push 0xde
push 0x21
push 0xbc
push 0xa0
push 0x97
push 0xe2
push 0xb7
push 0x8e
push 0x2e
push 0xc8
push 0xe2
push 0xfe
push 0x55
push 9
push 0xd4
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x334]
push 0xc1
mov edx, 0x32
mov dword [ebp - 0x338], 0
call fcn.0046bd90
add esp, 0x4c
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x328]
push 0x23
mov edx, str.Mcafee_sha1_cert_expires_2019_07_21
call fcn.0042fd30
add esp, 4
push 0xb0
push 0x63
push 0xc3
push 0x13
push 0xd5
push 0x16
push 0x8d
push 0xad
push 0x47
push 0x39
push 0x26
push 0x3c
push 0xb6
push 0x3f
push 0x1a
push 0x44
push 0xde
push 0x64
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x30c]
push 0x36
mov edx, 0xce
mov dword [ebp - 0x310], 0
call fcn.0046bd90
add esp, 0x4c
push 0x25
mov edx, str.Mcafee_sha256_cert_expires_2019_07_21
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x300]
call fcn.0042fd30
add esp, 4
push 0x31
push 0x10
push 0xbe
push 0x48
push 0xe1
push 0x31
push 0xc0
push 0x31
push 8
push 0x10
push 0xa3
push 0x30
push 0x67
push 0x5e
push 0x7f
push 0x14
push 0xa3
push 0x69
push 0x1c
push 0xa4
push 0x40
push 0x8f
push 0xfd
push 0x9d
push 0x55
push 0x10
push 0x45
push 0x92
push 0x88
push 0xb5
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x2e4]
push 0x1b
mov edx, 0x32
mov dword [ebp - 0x2e8], 0
call fcn.0046be90
add esp, 0x7c
push 0x38
mov edx, str.McAfee_Code_Signing_CA__expires_Sun_May_30_06:48:38_2020
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x2d8]
call fcn.0042fd30
add esp, 4
push 0x59
push 0x41
push 1
push 0x20
push 0xb0
push 0x9f
push 0x5a
push 0x60
push 0x87
push 0x60
push 0x4d
push 0x9b
push 0x35
push 0x13
push 0xd4
push 0x57
push 0xbf
push 0x93
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x2bc]
push 0x80
mov edx, 0x53
mov dword [ebp - 0x2c0], 0
call fcn.0046bd90
add esp, 0x4c
push 0x27
mov edx, str.McAfee_LLC_sha1_cert_expires_02_26_2022
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x2b0]
call fcn.0042fd30
add esp, 4
push 0x99
push 0x17
push 0x84
push 0x8f
push 0x37
push 0x87
push 0x5f
push 0xbf
push 3
push 0xd4
push 0xe8
push 0xd6
push 0x7a
push 0xda
push 0x1e
push 0x32
push 0x9b
push 0xd7
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x294]
push 0x21
mov edx, 0x65
mov dword [ebp - 0x298], 0
call fcn.0046bd90
add esp, 0x4c
push 0x27
mov edx, str.McAfee_LLC_sha2_cert_expires_02_03_2022
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x288]
call fcn.0042fd30
add esp, 4
push 0xa
push 0x9f
push 0xac
push 0xd7
push 0x6b
push 0x89
push 0x9c
push 0xb8
push 0xc0
push 0xdb
push 0x39
push 3
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x270], 0
push 0x5f
push 0x59
push 0x61
push 0xe8
push 0x81
push 0x60
push 0x6f
push 0xb7
push 0x33
push 0x6a
push 0x21
push 0x62
push 0x4d
push 0x64
push 0xd4
push 0xfc
push 0xf0
push 0x70
push 0x24
mov edx, 0xd0
lea ecx, [ebp - 0x26c]
call fcn.0046be90
add esp, 0x7c
push 0x2f
mov edx, str.McAfee_LLC_Code_Signing_CA_2_expires_10_26_2024
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x260]
call fcn.0042fd30
mov byte [ebp - 4], 0x39
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x248], 0
push eax
push ecx
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x58], 0xe4de2d35
mov dword [ebp - 0x54], 0xe4777819
mov dword [ebp - 0x50], 0x61a0393
mov dword [ebp - 0x4c], 0xf39f913f
mov dword [ebp - 0x48], 0xcd3ffae4
mov dword [ebp - 0x44], 0x5fe79d9c
mov dword [ebp - 0x40], 0xcb4ea1c2
mov dword [ebp - 0x3c], 0xc37bebcf
mov dword [ebp - 0x38], 0x10e576a7
mov dword [ebp - 0x34], 0x37da6a19
mov dword [ebp - 0x30], 0xdd21a756
mov dword [ebp - 0x2c], 0xb32baeb6
call fcn.0046d5b0
mov dword [ebp - 0x6c4], 0x1fe
push 0x1d
mov edx, str.McAfee_PPL_expires_05_20_2028
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x238]
call fcn.0042fd30
add esp, 4
push 0xf1
push 0x72
push 0xb8
push 0xaa
push 0x41
push 0x72
push 0xc9
push 0x80
push 0xe0
push 0xc9
push 0x8d
push 0x67
push 0x91
push 0xcd
push 0x9e
push 0xb8
push 0xde
push 0x73
push 0x6e
push 0x37
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0x220], 0
push 0xce
push 0xce
push 0xc0
push 0x8f
push 0xa
push 0x7e
push 0x72
push 0xf3
push 0x70
push 0x67
push 5
mov edx, 0xfb
lea ecx, [ebp - 0x21c]
call fcn.0046be90
add esp, 0x7c
push 0x26
mov edx, str.McAfee_Inc_sha1_cert_expires_7_12_2022
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x210]
call fcn.0042fd30
add esp, 4
push 0x7e
push 0x89
push 0x8f
push 0x8c
push 0xc3
push 0x5a
push 0xf4
push 0x13
push 9
push 0x2b
push 0xd6
push 0xb5
push 0x90
push 0xba
push 0xd
push 0x42
push 0x36
push 0xb3
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x1f4]
push 0xaa
mov edx, 0xd4
mov dword [ebp - 0x1f8], 0
call fcn.0046bd90
add esp, 0x4c
push 0x26
mov edx, str.McAfee_Inc_sha2_cert_expires_7_12_2022
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x1e8]
call fcn.0042fd30
add esp, 4
push 0x5a
push 0xc6
push 0x4f
push 0x62
push 0x60
push 0x2a
push 0x49
push 0x7f
push 0
push 0x35
push 0x67
push 0x7d
push 0xd8
push 0x78
push 0x6c
push 0xc6
push 0xe0
push 0x73
push 0x33
push 0x65
push 0x31
push 0xb2
push 0xa4
mov byte [ebp - 4], 0x3f
mov dword [ebp - 0x1d0], 0
push 0xf
push 0x85
push 0xb7
push 0xfb
push 0xaf
push 0xad
push 3
push 0x92
mov edx, 0xa0
lea ecx, [ebp - 0x1cc]
call fcn.0046be90
add esp, 0x7c
push 0x26
mov edx, str.McAfee_LLC_sha2_cert_expires_2_26_2022
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x1c0]
call fcn.0042fd30
add esp, 4
push 0xf0
push 0xff
push 0x5a
push 0xf5
push 0x41
push 0xf2
push 0xe7
push 0xa2
push 0x88
push 0xbb
push 0x96
push 0x31
push 0x16
push 0xf8
push 0x73
push 0x3d
push 0x2b
push 0x50
push 0xec
push 0x64
push 0x4b
push 0x66
push 0xe8
push 0x6a
push 0x7c
push 0x7d
push 0x2c
push 0xbe
push 0x1c
push 0x93
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x1a4]
push 0x91
mov edx, 0xd1
mov dword [ebp - 0x1a8], 0
call fcn.0046be90
add esp, 0x7c
push 0x28
mov edx, str.McAfee__Inc._sha2_cert_expires_2_25_2022
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x198]
call fcn.0042fd30
add esp, 4
push 0xc4
push 0x7d
push 0x93
push 0x50
push 0x87
push 0x6a
push 0x27
push 0x1f
push 0x63
push 0x90
push 0xe
push 0x1b
push 0x4f
push 0xb6
mov byte [ebp - 4], 0x43
mov dword [ebp - 0x180], 0
push 0x89
push 0x56
push 0x88
push 0x23
push 0x8c
push 3
push 0x7a
push 0xab
push 0xf
push 0x23
push 0x18
push 0x92
push 0xdb
push 7
push 0xea
push 0xcf
push 0x1c
mov edx, 0xc6
lea ecx, [ebp - 0x17c]
call fcn.0046be90
add esp, 0x7c
push 0x28
mov edx, str.McAfee__LLC._sha2_cert_expires_3_11_2024
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x170]
call fcn.0042fd30
add esp, 4
push 0xd1
push 0x4a
push 0x3e
push 0x7a
push 0x92
push 0x93
push 0x21
push 0x86
push 0x50
push 0xf9
push 0xb8
push 0x15
push 0xb6
push 0xac
push 0x3a
push 0x34
push 0x67
push 0x46
push 0x74
push 0x92
push 0xcf
push 0x95
push 0x7e
push 0x93
push 0x69
push 0xc3
push 0xe1
push 0x82
push 0x93
push 0xd8
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x154]
push 0x2b
mov edx, 0x80
mov dword [ebp - 0x158], 0
call fcn.0046be90
add esp, 0x7c
push 0x29
mov edx, str.McAfee__LLC._sha2_cert_expires_02_03_2022
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x148]
call fcn.0042fd30
add esp, 4
push 0xa
push 0x9f
push 0xac
push 0xd7
push 0x6b
mov byte [ebp - 4], 0x47
mov dword [ebp - 0x130], 0
push 0x89
push 0x9c
push 0xb8
push 0xc0
push 0xdb
push 0x39
push 3
push 0x5f
push 0x59
push 0x61
push 0xe8
push 0x81
push 0x60
push 0x6f
push 0xb7
push 0x33
push 0x6a
push 0x21
push 0x62
push 0x4d
push 0x64
push 0xd4
push 0xfc
push 0xf0
push 0x70
push 0x24
mov edx, 0xd0
lea ecx, [ebp - 0x12c]
call fcn.0046be90
add esp, 0x7c
push 0x31
mov edx, str.Microsoft_Development_PCA_2014_expires_05_28_2029
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x120]
call fcn.0042fd30
add esp, 4
push 0x4f
push 0x94
push 0x73
push 0xd4
push 0x13
push 0x50
push 0x32
push 0x80
push 0xe7
push 0x2c
push 0xe3
push 0xbd
push 0xe5
push 0x26
push 0x8e
push 0xc
push 0xa3
push 0x20
push 0x84
push 0xd1
push 0x5d
push 0x8c
push 0xec
push 0x14
push 0x5e
push 0xd
push 0x23
push 0x78
push 0xfc
push 0x7d
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x104]
push 0x86
mov edx, 0x2c
mov dword [ebp - 0x108], 1
call fcn.0046be90
add esp, 0x7c
push 0x28
mov edx, str.McAfee__LLC._sha2_cert_expires_10_4_2024
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xf8]
call fcn.0042fd30
add esp, 4
push 0xc6
push 0x41
push 0xd5
push 0xbf
push 0xf7
push 0x90
push 0xc
push 0x53
push 5
push 0xb0
push 0x54
push 0xe9
push 0x90
push 0xb1
push 0xb6
push 0x33
push 0xad
push 0x43
push 0xbc
push 0x76
push 0x39
push 0x5b
push 0x1b
push 0xb6
push 0
push 0xc3
push 0x17
push 0x1b
push 0x65
push 0xbc
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0xdc]
push 0x49
mov edx, 0x6b
mov dword [ebp - 0xe0], 0
call fcn.0046be90
add esp, 0x7c
push 0x29
mov edx, str.McAfee__Inc._sha2_cert_expires_06_14_2025
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0xd0]
call fcn.0042fd30
add esp, 4
push 0x72
push 0x38
push 0x62
push 0x93
push 0xb6
push 0xb8
push 0xbd
push 0x53
push 0x99
push 0xe6
push 0xe9
push 0x86
push 0x94
push 0xd3
push 0x1c
push 0x7f
push 0xb5
push 0x82
push 0xad
push 0xc9
push 0x79
push 0x88
push 0x55
push 0x13
push 0x15
push 0x7b
push 0x42
push 0xcb
push 0xf
push 0xab
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb8], 0
mov edx, 0xdc
push 0x76
call fcn.0046be90
add esp, 0x7c
push 0x28
mov edx, str.McAfee__LLC_sha2_cert_expires_10_13_2026
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xa8]
call fcn.0042fd30
add esp, 4
push 0xff
push 0xe6
push 0x70
push 0x8a
push 0xad
push 0xfd
push 0x87
push 0xae
push 0xbc
push 0x4e
push 0x9b
push 0x9b
push 3
push 0xcb
push 0x1f
push 0xa1
push 0x5d
push 0x60
push 0xe0
push 0xe4
push 0xf6
push 0xdb
push 0xc
push 0xa
push 0xb1
push 0x7f
push 0xed
push 0x13
push 0xfe
push 0xf7
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x8c]
push 0xd2
mov edx, 0x83
mov dword [ebp - 0x90], 0
call fcn.0046be90
add esp, 0x7c
push 0x31
mov edx, str.Windows_UEFI_CA_2023_sha2_cert_expires_06_14_2035
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x80]
call fcn.0042fd30
add esp, 4
push 0xf8
push 0x29
push 0xd6
push 0x8d
push 0x77
push 0x81
push 0x8a
push 0xcc
push 0x11
push 0x98
push 0x8a
push 0xba
push 0x89
push 0x7e
push 0x77
push 0x4c
push 0xa7
push 0x79
push 0x38
push 0xd8
push 0xd3
push 0xca
push 0x66
mov byte [ebp - 4], 0x51
mov dword [ebp - 0x68], 1
push 0x67
push 0x60
push 0x6e
push 0x2c
push 0xd3
push 0x98
push 0x9e
push 0xf2
mov edx, 0x81
lea ecx, [ebp - 0x64]
call fcn.0046be90
add esp, 0x7c
mov dword [ebp - 4], 0x52
push 0x668
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.0047e643
mov dword [edi], eax
add esp, 4
mov dword [edi + 4], eax
add eax, 0x668
mov dword [edi + 8], eax
mov dword [ebp - 0x6cc], edi
mov esi, dword [edi]
lea edi, [ebp - 0x6c0]
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x54
nop dword [eax + eax]
push edi
mov ecx, esi
call fcn.0046def0
add esi, 0x28
lea eax, [ebp - 0x58]
add edi, 0x28
mov dword [ebp - 0x1c], esi
cmp edi, eax
jne 0x46bd20
mov edi, dword [ebp - 0x6c8]
mov dword [edi + 4], esi
push 0x4584d0
push 0x29
push 0x28
lea eax, [ebp - 0x6c0]
mov dword [ebp - 0x6c4], 0x1ff
push eax
mov byte [ebp - 4], 0
call fcn.0047e6c8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047e22a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret