Function at 0x54e4e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0x800
push 0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x54e539
push 0x200
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x54e539
cmp dword [0x62fbb0], 0x3e
jae 0x54e537
push eax
push eax
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x54e539
xor esi, esi
push 0x800
push 0
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x54e58e
push 0x200
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x54e58e
cmp dword [0x62fbb0], 0x3e
jae 0x54e58c
push eax
push eax
push str.crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x54e58e
xor edi, edi
mov ebx, 0x5a4d
test esi, esi
je 0x54e8a1
jmp 0x54e5a0
cmp word [esi], bx
jne 0x54e5e2
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x54e5e2
cmp eax, 0x7fffffff
jae 0x54e5e2
cmp dword [eax + esi], 0x4550
jne 0x54e5e2
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e5e2
cmp dword [edx + 4], 0
je 0x54e5e2
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call fcn.00529280
nop
jmp 0x54e5e4
xor eax, eax
mov dword [0x638450], eax
mov ebx, esi
mov eax, 0x5a4d
mov ecx, 0x3c
cmp word [esi], ax
jne 0x54e63d
mov eax, dword ds:[ebx + ecx]
test eax, eax
je 0x54e63d
cmp eax, 0x7fffffff
jae 0x54e63d
cmp dword [eax + esi], 0x4550
jne 0x54e63d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e63d
cmp dword [edx + 4], 0
je 0x54e63d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminCalcHashFromFileHandle2
push eax
call fcn.00529280
jmp 0x54e63f
xor eax, eax
mov dword [0x638430], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e695
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e695
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x54e695
cmp dword [eax + esi], 0x4550
jne 0x54e695
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e695
cmp dword [edx + 4], 0
je 0x54e695
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext
push eax
call fcn.00529280
jmp 0x54e697
xor eax, eax
mov dword [0x638434], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e6e7
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e6e7
cmp eax, 0x7fffffff
jae 0x54e6e7
cmp dword [eax + esi], 0x4550
jne 0x54e6e7
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e6e7
cmp dword [edx + 4], 0
je 0x54e6e7
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminAcquireContext2
push eax
call fcn.00529280
jmp 0x54e6e9
xor eax, eax
mov dword [0x638448], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e73d
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e73d
cmp eax, 0x7fffffff
jae 0x54e73d
cmp dword [eax + esi], 0x4550
jne 0x54e73d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e73d
cmp dword [edx + 4], 0
je 0x54e73d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminEnumCatalogFromHash
push eax
call fcn.00529280
jmp 0x54e73f
xor eax, eax
mov dword [0x638438], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e795
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e795
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x54e795
cmp dword [eax + esi], 0x4550
jne 0x54e795
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e795
cmp dword [edx + 4], 0
je 0x54e795
push 0
add eax, esi
mov ecx, esi
push str.CryptCATCatalogInfoFromContext
push eax
call fcn.00529280
jmp 0x54e797
xor eax, eax
mov dword [0x63842c], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e7e7
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e7e7
cmp eax, 0x7fffffff
jae 0x54e7e7
cmp dword [eax + esi], 0x4550
jne 0x54e7e7
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e7e7
cmp dword [edx + 4], 0
je 0x54e7e7
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseCatalogContext
push eax
call fcn.00529280
jmp 0x54e7e9
xor eax, eax
mov dword [0x638424], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e83d
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e83d
cmp eax, 0x7fffffff
jae 0x54e83d
cmp dword [eax + esi], 0x4550
jne 0x54e83d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e83d
cmp dword [edx + 4], 0
je 0x54e83d
push 0
add eax, esi
mov ecx, esi
push str.CryptCATAdminReleaseContext
push eax
call fcn.00529280
jmp 0x54e83f
xor eax, eax
mov dword [0x638428], eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x54e895
mov eax, 0x3c
mov eax, dword [ebx + eax]
test eax, eax
je 0x54e895
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x54e895
cmp dword [eax + esi], 0x4550
jne 0x54e895
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x54e895
cmp dword [edx + 4], 0
je 0x54e895
push 0
add eax, esi
mov ecx, esi
push str.WinVerifyTrust
push eax
call fcn.00529280
jmp 0x54e897
xor eax, eax
mov dword [0x63844c], eax
mov ebx, 0x5a4d
test edi, edi
je 0x54e9e3
cmp word [edi], bx
jne 0x54e8ea
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x54e8ea
cmp eax, 0x7fffffff
jae 0x54e8ea
cmp dword [eax + edi], 0x4550
jne 0x54e8ea
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x54e8ea
cmp dword [edx + 4], 0
je 0x54e8ea
push 0
add eax, edi
mov ecx, edi
push str.CertNameToStrW
push eax
call fcn.00529280
jmp 0x54e8ec
xor eax, eax
mov ecx, edi
mov edx, 0x3c
mov dword [0x63843c], eax
cmp word [edi], bx
jne 0x54e987
mov eax, dword [ecx + edx]
test eax, eax
je 0x54e945
cmp eax, 0x7fffffff
jae 0x54e945
cmp dword ds:[eax + edi], 0x4550
jne 0x54e945
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x54e945
cmp dword [edx + 4], 0
je 0x54e945
push 0
add eax, edi
push str.CertGetEnhancedKeyUsage
push eax
call fcn.00529280
cmp word [edi], bx
jne 0x54e987
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x54e987
cmp eax, 0x7fffffff
jae 0x54e987
cmp dword ds:[eax + edi], 0x4550
jne 0x54e987
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x54e987
cmp dword [edx + 4], 0
je 0x54e987
push 0
add eax, edi
mov ecx, edi
push str.CertDuplicateCertificateContext
push eax
call fcn.00529280
jmp 0x54e989
xor eax, eax
mov dword [0x638440], eax
cmp word [edi], bx
jne 0x54e9da
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x54e9da
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x54e9da
cmp dword [eax + edi], 0x4550
jne 0x54e9da
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x54e9da
cmp dword [edx + 4], 0
je 0x54e9da
push 0
add eax, edi
mov ecx, edi
push str.CertFreeCertificateContext
push eax
call fcn.00529280
mov dword [0x638444], eax
jmp 0x54e9e8
xor eax, eax
mov dword [0x638444], eax
jmp 0x54e9e8
mov eax, dword [0x638444]
cmp dword [0x638450], 0
je 0x54ea55
cmp dword [0x638434], 0
je 0x54ea55
cmp dword [0x638438], 0
je 0x54ea55
cmp dword [0x63842c], 0
je 0x54ea55
cmp dword [0x638424], 0
je 0x54ea55
cmp dword [0x638428], 0
je 0x54ea55
cmp dword [0x63844c], 0
je 0x54ea55
cmp dword [0x63843c], 0
je 0x54ea55
cmp dword [0x638440], 0
je 0x54ea55
test eax, eax
je 0x54ea55
push 0x64
push 0x54fb00
push 0x54fac0
push 0x18
call sym.SystemInformer.exe_PhCreateHashtable
mov dword [0x6383cc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret