Function at 0x565e20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0x800
push 0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x565e79
push 0x200
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x565e79
cmp dword [0x62dbb0], 0x3e
jae 0x565e77
push eax
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x565e79
xor esi, esi
push 0x800
push 0
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x565ece
push 0x200
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x565ece
cmp dword [0x62dbb0], 0x3e
jae 0x565ecc
push eax
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x565ece
xor edi, edi
mov ebx, 0x5a4d
test esi, esi
je 0x5661e1
jmp 0x565ee0
cmp word [esi], bx
jne 0x565f22
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x565f22
cmp eax, 0x7fffffff
jae 0x565f22
cmp dword [eax + esi], 0x4550
jne 0x565f22
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565f22
cmp dword [edx + 4], 0
je 0x565f22
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call fcn.005281c0
nop
jmp 0x565f24
xor eax, eax
mov dword [0x636520], eax
mov ebx, esi
mov eax, 0x5a4d
mov ecx, 0x3c
cmp word [esi], ax
jne 0x565f7d
mov eax, dword ds:[ebx + ecx]
test eax, eax
je 0x565f7d
cmp eax, 0x7fffffff
jae 0x565f7d
cmp dword [eax + esi], 0x4550
jne 0x565f7d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565f7d
cmp dword [edx + 4], 0
je 0x565f7d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle2
push eax
call fcn.005281c0
jmp 0x565f7f
xor eax, eax
mov dword [0x636500], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x565fd5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x565fd5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x565fd5
cmp dword [eax + esi], 0x4550
jne 0x565fd5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x565fd5
cmp dword [edx + 4], 0
je 0x565fd5
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext
push eax
call fcn.005281c0
jmp 0x565fd7
xor eax, eax
mov dword [0x636504], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566027
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x566027
cmp eax, 0x7fffffff
jae 0x566027
cmp dword [eax + esi], 0x4550
jne 0x566027
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566027
cmp dword [edx + 4], 0
je 0x566027
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext2
push eax
call fcn.005281c0
jmp 0x566029
xor eax, eax
mov dword [0x636518], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x56607d
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x56607d
cmp eax, 0x7fffffff
jae 0x56607d
cmp dword [eax + esi], 0x4550
jne 0x56607d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x56607d
cmp dword [edx + 4], 0
je 0x56607d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminEnumCatalogFromHash
push eax
call fcn.005281c0
jmp 0x56607f
xor eax, eax
mov dword [0x636508], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x5660d5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x5660d5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x5660d5
cmp dword [eax + esi], 0x4550
jne 0x5660d5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x5660d5
cmp dword [edx + 4], 0
je 0x5660d5
push 0
add eax, esi
mov ecx, esi
push str.CryptCATCatalogInfoFromContext
push eax
call fcn.005281c0
jmp 0x5660d7
xor eax, eax
mov dword [0x6364fc], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x566127
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x566127
cmp eax, 0x7fffffff
jae 0x566127
cmp dword [eax + esi], 0x4550
jne 0x566127
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x566127
cmp dword [edx + 4], 0
je 0x566127
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseCatalogContext
push eax
call fcn.005281c0
jmp 0x566129
xor eax, eax
mov dword [0x6364f4], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x56617d
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x56617d
cmp eax, 0x7fffffff
jae 0x56617d
cmp dword [eax + esi], 0x4550
jne 0x56617d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x56617d
cmp dword [edx + 4], 0
je 0x56617d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseContext
push eax
call fcn.005281c0
jmp 0x56617f
xor eax, eax
mov dword [0x6364f8], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x5661d5
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x5661d5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x5661d5
cmp dword [eax + esi], 0x4550
jne 0x5661d5
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x5661d5
cmp dword [edx + 4], 0
je 0x5661d5
push 0
add eax, esi
mov ecx, esi
push str.WinVerifyTrust
push eax
call fcn.005281c0
jmp 0x5661d7
xor eax, eax
mov dword [0x63651c], eax
mov ebx, 0x5a4d
test edi, edi
je 0x566323
cmp word [edi], bx
jne 0x56622a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x56622a
cmp eax, 0x7fffffff
jae 0x56622a
cmp dword [eax + edi], 0x4550
jne 0x56622a
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x56622a
cmp dword [edx + 4], 0
je 0x56622a
push 0
add eax, edi
mov ecx, edi
push str.CertNameToStrW
push eax
call fcn.005281c0
jmp 0x56622c
xor eax, eax
mov ecx, edi
mov edx, 0x3c
mov dword [0x63650c], eax
cmp word [edi], bx
jne 0x5662c7
mov eax, dword [ecx + edx]
test eax, eax
je 0x566285
cmp eax, 0x7fffffff
jae 0x566285
cmp dword ds:[eax + edi], 0x4550
jne 0x566285
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x566285
cmp dword [edx + 4], 0
je 0x566285
push 0
add eax, edi
push str.CertGetEnhancedKeyUsage
push eax
call fcn.005281c0
cmp word [edi], bx
jne 0x5662c7
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x5662c7
cmp eax, 0x7fffffff
jae 0x5662c7
cmp dword ds:[eax + edi], 0x4550
jne 0x5662c7
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5662c7
cmp dword [edx + 4], 0
je 0x5662c7
push 0
add eax, edi
mov ecx, edi
push str.CertDuplicateCertificateContext
push eax
call fcn.005281c0
jmp 0x5662c9
xor eax, eax
mov dword [0x636510], eax
cmp word [edi], bx
jne 0x56631a
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x56631a
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x56631a
cmp dword [eax + edi], 0x4550
jne 0x56631a
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x56631a
cmp dword [edx + 4], 0
je 0x56631a
push 0
add eax, edi
mov ecx, edi
push str.CertFreeCertificateContext
push eax
call fcn.005281c0
mov dword [0x636514], eax
jmp 0x566328
xor eax, eax
mov dword [0x636514], eax
jmp 0x566328
mov eax, dword [0x636514]
cmp dword [0x636520], 0
je 0x566395
cmp dword [0x636504], 0
je 0x566395
cmp dword [0x636508], 0
je 0x566395
cmp dword [0x6364fc], 0
je 0x566395
cmp dword [0x6364f4], 0
je 0x566395
cmp dword [0x6364f8], 0
je 0x566395
cmp dword [0x63651c], 0
je 0x566395
cmp dword [0x63650c], 0
je 0x566395
cmp dword [0x636510], 0
je 0x566395
test eax, eax
je 0x566395
push 0x64
push 0x567440
push 0x567400
push 0x18
call sym.SystemInformer.exe_PhCreateHashtable
mov dword [0x63649c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret