Function at 0x4bdf1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x5184d0]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
mov ebx, edx
mov dword [esp + 0x30], ecx
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov esi, dword [ebp + 8]
inc edx
shl eax, 0x10
or eax, dword [ebp + 0x18]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x2c]
push eax
xor ecx, ecx
push ecx
push edx
push 2
push dword [ebp + 0x20]
mov edi, ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x80], ecx
call dword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
jne 0x4bdfd2
call fcn.004c73cc
mov esi, eax
push esi
push 0x70200c9
jmp 0x4be019
push dword [esp + 0x2c]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x44], eax
test eax, eax
jne 0x4bdff5
mov ecx, 0x8007000e
push ecx
mov esi, ecx
push 0x70900c9
jmp 0x4be019
lea ecx, [esp + 0x2c]
push ecx
push eax
push 1
push 2
push dword [ebp + 0x20]
call dword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
jne 0x4be024
call fcn.004c73cc
mov esi, eax
push esi
push 0x71400c9
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4be739
and dword [esp + 0x7c], edi
lea edi, [esp + 0x88]
mov eax, dword [ebp + 0xc]
push 6
pop ecx
mov dword [esp + 0x84], esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0x80], eax
lea eax, [esp + 0xb0]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0xb8]
push eax
push ecx
push 0
lea eax, [esp + 0x74]
push eax
push 0x1b
pop edx
call fcn.004c6016
test eax, eax
jne 0x4be085
call fcn.004c73cc
mov esi, eax
push esi
push 0x72800c9
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4be735
and dword [esp + 0xac], 0
xor ecx, ecx
mov eax, dword [ebp + 0x18]
inc ecx
mov dword [esp + 0xa8], 0x40ccd0
mov edi, ecx
test eax, eax
je 0x4be0ef
test ebx, ebx
je 0x4be0ef
lea eax, [esp + 0xc0]
mov ecx, ebx
push eax
lea edx, [esp + 0xc8]
call fcn.004bd5a4
mov esi, eax
test esi, esi
je 0x4be0d5
push esi
push 0x73600c9
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4be70a
and dword [esp + 0xbc], 0
xor esi, esi
push 2
mov dword [esp + 0xbc], 0x40e6fc
pop edi
jmp 0x4be0f9
xor esi, esi
test eax, eax
je 0x4be115
test ebx, ebx
je 0x4be115
cmp dword [ebp + 0x14], 0
jne 0x4be115
mov eax, dword [ebx + 0xc]
push dword [eax + 0x6c]
push dword [eax + 0x68]
push 0x405554
call dword [sym.imp.CRYPT32.dll_CertFindExtension]
mov esi, eax
mov ebx, edi
mov dword [esp + 0x54], edi
shl ebx, 4
lea ecx, [esp + 0xb0]
lea eax, [esp + 0xb4]
add ecx, ebx
add eax, ebx
test esi, esi
je 0x4be1cf
mov eax, dword [esi + 8]
mov dword [ecx], eax
push dword [esi + 8]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + ebx + 0xb4], eax
test eax, eax
jne 0x4be16b
mov ecx, 0x8007000e
push ecx
mov esi, ecx
push 0x75100c9
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4be706
push dword [esi + 8]
push dword [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0xb8]
and dword [esp + ebx + 0xac], 0
shl eax, 4
add eax, ecx
mov dword [esp + ebx + 0xa8], 0x405554
mov ebx, dword [esp + 0x30]
mov edx, eax
mov ecx, ebx
mov dword [esp + 0x10], eax
call fcn.004df458
mov esi, eax
mov ecx, ebx
mov edx, esi
call fcn.004bd635
test esi, esi
je 0x4be1ef
push esi
push 0x76700c9
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [esp + 0x54]
jmp 0x4be1fc
push ecx
mov edx, eax
lea ecx, [esp + 0x8c]
call fcn.004c7faf
mov esi, eax
test esi, esi
je 0x4be17a
push esi
push 0x75e00c9
jmp 0x4be160
mov eax, dword [esp + 0x10]
mov dword [eax], 0x427744
lea eax, [edi + 1]
lea edi, [eax + 1]
mov eax, edi
lea ecx, [esp + 0xa8]
shl eax, 4
add eax, ecx
mov ecx, ebx
mov edx, eax
mov dword [esp + 0x10], eax
call fcn.004e057e
mov esi, eax
mov ecx, ebx
mov edx, esi
call fcn.004bd635
test esi, esi
je 0x4be237
push esi
push 0x77000c9
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4be242
mov eax, dword [esp + 0x10]
inc edi
mov dword [eax], 0x427750
mov eax, edi
lea ecx, [esp + 0xa8]
shl eax, 4
add eax, ecx
mov ecx, ebx
mov edx, eax
mov dword [esp + 0x10], eax
call fcn.004dfff9
mov esi, eax
mov ecx, ebx
mov edx, esi
call fcn.004bd635
test esi, esi
je 0x4be27a
push esi
push 0x77b00c9
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4be285
mov eax, dword [esp + 0x10]
inc edi
mov dword [eax], 0x40cc58
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
lea eax, [esp + 0x5c]
push eax
lea edx, [esp + 0x64]
call fcn.004e02e2
mov esi, eax
mov ecx, ebx
mov edx, esi
call fcn.004bd635
test esi, esi
je 0x4be2b5
push esi
push 0x78900c9
call dword [sym.imp.certcli.dll_Ordinal_357]
lea eax, [esp + 0x40]
mov dl, 1
push eax
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.004e0f2f
mov esi, eax
mov ecx, ebx
mov edx, esi
call fcn.004bd635
test esi, esi
je 0x4be2e3
push esi
push 0x78d00c9
call dword [sym.imp.certcli.dll_Ordinal_357]
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x4be2f0
mov esi, 0x406624
lea eax, [esp + 0x20]
push eax
push 0xe0
push 0
push esi
call dword [sym.imp.certcli.dll_CAFindCertTypeByName]
test eax, eax
jne 0x4be451
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x24]
call dword [sym.imp.certcli.dll_CAGetCertTypeExtensions]
mov esi, eax
test esi, esi
je 0x4be331
push esi
push 0x7a100c9
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4be6e4
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xa8]
mov ebx, edi
xor ecx, ecx
shl ebx, 4
add eax, ebx
push eax
call fcn.004dfe2b
mov esi, eax
test esi, esi
je 0x4be367
cmp esi, 0xe0000102
je 0x4be367
push 1
push esi
push 0xb030191
call dword [sym.imp.certcli.dll_Ordinal_358]
mov ecx, dword [esp + 0x30]
mov edx, esi
call fcn.004bd635
test esi, esi
js 0x4be3b7
mov eax, dword [esp + 0x14]
push dword [eax + 4]
push dword [eax]
push 0x41e3bc
call dword [sym.imp.CRYPT32.dll_CertFindExtension]
test eax, eax
je 0x4be3b4
mov ecx, dword [esp + ebx + 0xb4]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + ebx + 0xb0]
mov dword [eax + 8], ecx
and dword [esp + ebx + 0xb4], 0
and dword [esp + ebx + 0xb0], 0
jmp 0x4be3c3
inc edi
jmp 0x4be3c3
push esi
push 0x7bb00c9
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [esp + 0x14]
mov ecx, 0x10000
mov eax, dword [eax]
cmp eax, ecx
ja 0x4be441
cmp edi, ecx
ja 0x4be441
add eax, edi
shl eax, 4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [esp + 0x60], ebx
test ebx, ebx
jne 0x4be400
mov ecx, 0x8007000e
push ecx
mov esi, ecx
push 0x7cb00c9
jmp 0x4be326
mov esi, edi
lea eax, [esp + 0xa8]
shl esi, 4
push esi
push eax
push ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [ecx]
shl eax, 4
push eax
push dword [ecx + 4]
lea eax, [esi + ebx]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [eax]
add eax, edi
mov dword [esp + 0x28], ebx
jmp 0x4be510
mov esi, 0x80070216
push esi
push 0x7c300c9
jmp 0x4be326
push eax
push 0x7d800c9
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, edi
lea edx, [esp + 0xa8]
shl eax, 4
mov ecx, esi
add edx, eax
call fcn.004cd535
mov esi, eax
test esi, esi
je 0x4be483
push esi
push 0x7e000c9
jmp 0x4be326
push ecx
push dword [ebp + 0x2c]
inc edi
lea eax, [esp + 0xb8]
push dword [esp + 0x50]
mov esi, edi
lea edx, [esp + 0xc0]
shl esi, 4
add eax, esi
add edx, esi
push eax
call fcn.004bf8c1
test eax, eax
jne 0x4be4bf
call fcn.004c73cc
mov esi, eax
push esi
push 0x7ed00c9
jmp 0x4be326
and dword [esp + esi + 0xac], 0
lea edx, [esp + 0xa8]
inc edi
mov dword [esp + esi + 0xa8], 0x40ff38
mov eax, edi
mov ecx, ebx
shl eax, 4
add edx, eax
call fcn.004dffcf
mov esi, eax
mov ecx, ebx
mov edx, esi
call fcn.004bd635
test esi, esi
je 0x4be502
push esi
push 0x7f700c9
jmp 0x4be326
inc edi
lea ecx, [esp + 0xa8]
mov eax, edi
mov dword [esp + 0x28], ecx
mov esi, dword [esp + 0x18]
mov dword [esp + 0x24], eax
test esi, esi
je 0x4be576
mov ebx, dword [esp + 0x40]
push ebx
push esi
push 0x42777c
call dword [sym.imp.CRYPT32.dll_CertFindExtension]
test eax, eax
je 0x4be53c
mov eax, dword [eax + 0xc]
neg eax
sbb eax, eax
and dword [esp + 0x34], eax
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x3c]
mov ecx, dword [esp + 0x24]
push eax
lea eax, [esp + 0x4c]
push eax
push ebx
push esi
call fcn.004cd74e
mov esi, eax
test esi, esi
je 0x4be566
push esi
push 0x81000c9
jmp 0x4be326
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
test eax, eax
je 0x4be5aa
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x54]
push eax
push ecx
push 0
lea eax, [esp + 0x34]
push eax
push 5
pop edx
call fcn.004c6016
test eax, eax
jne 0x4be5aa
call fcn.004c73cc
mov esi, eax
push esi
push 0x82200c9
jmp 0x4be326
lea edx, [esp + 0x68]
lea ecx, [esp + 0x6c]
call fcn.004cd411
mov esi, eax
test esi, esi
je 0x4be5c8
push esi
push 0x82900c9
jmp 0x4be326
xor edx, edx
lea eax, [esp + 0x138]
xor ecx, ecx
mov dword [esp + 0xa4], eax
inc edx
mov dword [esp + 0xa0], ecx
cmp dword [esp + 0x50], ecx
je 0x4be60e
lea eax, [esp + 0x4c]
mov dword [esp + 0x138], 0x40ff44
mov ecx, edx
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], eax
mov dword [esp + 0xa0], ecx
cmp dword [esp + 0x34], 0
je 0x4be63d
imul eax, ecx, 0xc
inc ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + eax + 0x138], 0x42777c
mov dword [esp + eax + 0x13c], edx
lea edx, [esp + 0x68]
mov dword [esp + eax + 0x140], edx
mov ebx, dword [esp + 0x70]
lea eax, [esp + 0x38]
push eax
push 0
push 0
push ebx
lea eax, [esp + 0x8c]
push eax
push 4
push 1
push 2
push dword [ebp + 0x20]
call dword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
jne 0x4be678
call fcn.004c73cc
mov esi, eax
push esi
push 0x84b00c9
jmp 0x4be326
push dword [esp + 0x38]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x4be69c
mov ecx, 0x8007000e
push ecx
mov esi, ecx
push 0x85200c9
jmp 0x4be326
lea eax, [esp + 0x38]
push eax
push esi
push 0
push ebx
lea eax, [esp + 0x8c]
push eax
push 4
push 1
push 2
push dword [ebp + 0x20]
call dword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
jne 0x4be6d2
call fcn.004c73cc
mov esi, eax
push esi
push 0x86100c9
jmp 0x4be326
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
mov dword [eax], esi
xor esi, esi
mov eax, dword [esp + 0x38]
mov dword [ecx], eax
cmp dword [esp + 0x1c], 0
je 0x4be6f5
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esp + 0x58]
test edx, edx
je 0x4be706
mov ecx, dword [esp + 0x5c]
call fcn.004e02a8
test edi, edi
je 0x4be726
lea ebx, [esp + 0xb4]
cmp dword [ebx], 0
je 0x4be71e
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 0x10
sub edi, 1
jne 0x4be711
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4be735
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4be748
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esp + 0x40]
mov ecx, edi
call fcn.004e0c35
cmp dword [esp + 0x50], 0
je 0x4be764
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x6c], 0
je 0x4be775
push dword [esp + 0x6c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4be784
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4be7af
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4be7a8
lea edx, [esp + 0x24]
cmp edx, ecx
je 0x4be7a8
push ecx
push eax
call dword [sym.imp.certcli.dll_CAFreeCertTypeExtensions]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.certcli.dll_CACloseCertType]
lea eax, [esp + 0x64]
mov edx, 0x896
push eax
push 0
push 0
push 1
push 0xef
push esi
mov ecx, 0xc9
call fcn.004e9b0c
mov ecx, dword [esp + 0x15c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005036b0
mov esp, ebp
pop ebp
ret 0x30