Function at 0x404b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4811c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x10
push str._DumpEntityTrust
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x404be1
push eax
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x264]
push eax
call fcn.004042d0
mov esi, eax
test esi, esi
je 0x404b7b
push esi
push str.Failed_to_query_installation_details___d__n
call fcn.00405650
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x264]
test bl, 2
je 0x404b94
push str.Platform_certificates_are_trusted_n
call fcn.00405650
add esp, 4
test bl, 4
je 0x404ba6
push str.Consumer_product_certificates_are_trusted_n
call fcn.00405650
add esp, 4
test bl, 8
je 0x404bb8
push str.Enterprise_product_certificates_are_trusted_n
call fcn.00405650
add esp, 4
test bl, 1
pop ebx
je 0x405394
push str.Warning__An_unkown_product_GUID_was_detected__n
call fcn.00405650
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push 0xe
push str._ResetVTPCache
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x404c4e
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x264]
push eax
call fcn.004018a0
mov esi, eax
test esi, esi
je 0x404c38
push str.VtpUtilsControlCreate_n
call fcn.00405650
add esp, 4
push esi
call fcn.00403140
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x264]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, dword [ebp - 0x264]
jmp 0x40538f
push 8
push str._dumpbin
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x404cf6
push eax
push eax
push 2
push eax
push eax
push 0x40000000
push dword [0x481c94]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404cb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [0x481c94]
push str.Creating_the_certificate_store_file__S_failed___u._n
call fcn.00405650
add esp, 0xc
or eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x264]
push eax
push dword [0x484054]
push 0x484050
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Successfully_created_bin_file_n
call fcn.00405650
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push 0x10
push str._DecodeActiveBin
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x404d1f
push dword [0x481c94]
call fcn.004011f0
jmp 0x405145
push 0xe
push str._setsearchpath
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x404e01
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x260]
push eax
call fcn.004018a0
mov esi, eax
test esi, esi
jne 0x404c12
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x404d87
push str.GetVtpServiceVersionData_returned_NULL
call fcn.00405650
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push eax
push str.VTP_VERSION:__S_n
call fcn.00405650
mov ecx, dword [ebp - 0x260]
add esp, 8
mov eax, dword [ecx]
push dword [0x481c7c]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x260]
mov esi, eax
mov edx, dword [ecx]
call dword [edx + 4]
test esi, esi
je 0x404ddc
push str.SetCertificateSearchPath_failed._n
call fcn.00405650
add esp, 4
push esi
call fcn.00403140
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push dword [0x481c7c]
push str._S_set_succesfully_n
call fcn.00405650
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push 0xe
push str._getsearchpath
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x404ee2
push 0x258
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00423060
add esp, 0xc
mov dword [ebp - 0x260], 0
lea eax, [ebp - 0x260]
push eax
call fcn.004018a0
mov esi, eax
test esi, esi
jne 0x404c12
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x404d67
push eax
push str.VTP_VERSION:__S_n
call fcn.00405650
mov ecx, dword [ebp - 0x260]
lea edx, [ebp - 0x25c]
add esp, 8
mov eax, dword [ecx]
push 0x12c
push edx
call dword [eax + 0x10]
mov ecx, dword [ebp - 0x260]
mov esi, eax
mov edx, dword [ecx]
call dword [edx + 4]
test esi, esi
je 0x404ebc
push esi
push str.Vtp_SetCertificateSearchPath_returned_error__d_n
call fcn.00405650
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x25c]
push eax
push str.The_SearchPath_is__S_n
call fcn.00405650
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push 0xa
push str._loadcerts
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x404f87
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x260]
push eax
call fcn.004018a0
mov esi, eax
test esi, esi
jne 0x404c12
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x404d67
push eax
push str.VTP_VERSION:__S_n
call fcn.00405650
mov ecx, dword [ebp - 0x260]
add esp, 8
mov eax, dword [ecx]
push dword [0x481c7c]
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x260]
mov esi, eax
mov edx, dword [ecx]
call dword [edx + 4]
test esi, esi
je 0x404f68
push str.LoadMcAfeeCerts_failed._n
jmp 0x404dbc
push str.Trusted_Certs_were_added_to_VTP_n
call fcn.00405650
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push 0x10
push str._GetAndLoadCerts
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x404fb6
push dword [0x481c98]
call fcn.00405800
mov esi, eax
test esi, esi
je 0x404f68
jmp 0x404dc4
push 0xf
push str._ValidateModule
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x4050bc
mov edi, dword [0x481c80]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x260]
push eax
call fcn.00401940
mov esi, eax
test esi, esi
je 0x405012
push esi
push str.VtpValidationControlCreate_failed.___d_
call fcn.00405650
add esp, 8
push esi
call fcn.00403140
xor al, al
jmp 0x405145
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x405040
push str.GetVtpServiceVersionData_returned_NULL
call fcn.00405650
mov ecx, dword [ebp - 0x260]
add esp, 4
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
jmp 0x405145
push eax
push str.VTP_VERSION:__S_n
call fcn.00405650
mov ecx, dword [ebp - 0x260]
lea edx, [ebp - 0x264]
add esp, 8
mov eax, dword [ecx]
push edx
push 1
push edi
call dword [eax + 0x20]
mov esi, eax
test esi, esi
je 0x40508e
push str.ValidateModule__
call fcn.00405650
add esp, 4
push esi
call fcn.00403140
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
jmp 0x405145
push dword [ebp - 0x264]
lea ecx, [ebp - 0x268]
call fcn.004040d0
mov ecx, dword [ebp - 0x264]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
jmp 0x405145
push 0xd
push str._ValidateCert
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x4050e8
push dword [0x481c84]
push dword [0x482248]
call fcn.004037c0
jmp 0x405145
push 0x13
push str._AddRemoveCertPrivs
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x40511a
push dword [0x48224c]
push dword [0x481c84]
push dword [0x482248]
call fcn.004033d0
jmp 0x405145
push 0x10
push str._ValidateProcess
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x40515f
push eax
push dword [0x481c88]
push dword [0x482248]
call fcn.00403ca0
test al, al
je 0x405365
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push 0x12
push str._GetVtpVersionData
push dword [0x481c78]
call fcn.00406e60
add esp, 0xc
test eax, eax
jne 0x405200
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x260]
push eax
call fcn.00401940
test eax, eax
je 0x4051b3
push eax
push str.VtpValidationControlCreate_failed.___d__n
call fcn.00405650
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x4051ed
push str.GetVtpServiceVersionData_returned_NULL_n
call fcn.00405650
mov ecx, dword [ebp - 0x260]
add esp, 4
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push eax
push str.VTP_VERSION:__S_n
call fcn.00405650
add esp, 8
jmp 0x405389
push str._GetCertChain
push dword [0x481c78]
call fcn.00440675
add esp, 8
test eax, eax
jne 0x405394
mov edi, dword [0x481c80]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x264], eax
cmp dword [0x482248], eax
jne 0x405255
push str._GetCertChain_not_available_in_static_mode_n
call fcn.00405650
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x260]
push eax
call fcn.00401940
mov esi, eax
test esi, esi
je 0x40528e
push esi
push str.VtpValidationControlCreate_failed.___d_
call fcn.00405650
add esp, 8
push esi
call fcn.00403140
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x4052c8
push str.GetVersionData_returned_NULL
call fcn.00405650
mov ecx, dword [ebp - 0x260]
add esp, 4
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push eax
push str.VTP_VERSION:__S_n
call fcn.00405650
push edi
push str.Getting_certificate_chains_for__S_n
call fcn.00405650
mov ecx, dword [ebp - 0x260]
lea edx, [ebp - 0x264]
add esp, 0x10
mov eax, dword [ecx]
push edx
push 0
push edi
call dword [eax + 0x24]
mov esi, eax
test esi, esi
je 0x40532d
push str.GetCertChains__
call fcn.00405650
add esp, 4
push esi
call fcn.00403140
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x264]
call fcn.00402bb0
test al, al
jne 0x405378
push str.PrintCertChains_failed_n
call fcn.00405650
mov ecx, dword [ebp - 0x260]
add esp, 4
mov eax, dword [ecx]
push dword [ebp - 0x264]
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x260]
push dword [ebp - 0x264]
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x260]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0042111c
mov esp, ebp
pop ebp
ret