Function at 0x47c810
Capabilities:
Check for sandbox username or hostname
Decode data using base64 via winapi
Get session information
Get session user name
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1005c
call fcn.00494470
mov eax, dword [0x5142b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push str._Inside_InstallCertificate_method___n
mov dword [ebp - 0x10034], eax
mov dword [ebp - 0x10048], esi
mov dword [ebp - 0x1004c], edi
mov dword [ebp - 0x10050], ecx
mov dword [ebp - 0x10054], edx
call fcn.00423db0
xor ebx, ebx
lea eax, [ebp - 0x1003c]
push eax
push edi
mov dword [ebp - 0x10040], ebx
mov dword [ebp - 0x10038], ebx
mov dword [ebp - 0x1002c], ebx
mov dword [ebp - 0x10044], ebx
mov dword [ebp - 0x10030], 1
mov dword [ebp - 0x1003c], ebx
call fcn.004628e0
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push ebx
push SQLAllocStmt
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x1005c], edi
cmp edi, ebx
je 0x47d04a
cmp edi, 0xffffffff
je 0x47d04a
lea ecx, [ebp - 0x10028]
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x47c8ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_get_Certificate_File_Attributes.._error__ld__n
jmp 0x47d056
mov edx, esi
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov esi, eax
push esi
push str.InstallCertificate:_Certificate_file_Extension____s__n
mov dword [ebp - 0x10058], esi
call fcn.00423db0
add esp, 8
mov ecx, str..cer
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47c934
test dl, dl
je 0x47c930
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47c934
add eax, 2
add ecx, 2
test dl, dl
jne 0x47c914
xor eax, eax
jmp 0x47c939
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47cd0b
mov ecx, str..crt
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47c968
test dl, dl
je 0x47c964
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47c968
add eax, 2
add ecx, 2
test dl, dl
jne 0x47c948
xor eax, eax
jmp 0x47c96d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47cd0b
push 0xb
push 1
call fcn.00491e51
mov esi, eax
mov eax, dword [ebp - 0x10008]
add eax, 3
push eax
push 1
call fcn.00491e51
add esp, 0x10
push 0
push esi
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x10008]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47c9be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_Read_Certificate_File.._error__ld__n
jmp 0x47d056
mov edx, dword [ebp - 0x1003c]
push 0
push edx
push esi
call dword [sym.imp.CRYPT32.dll_PFXVerifyPassword]
test eax, eax
jne 0x47cc71
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10030], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [0x513c54]
cmp eax, 2
jne 0x47ca27
mov eax, dword [ebp - 0x10048]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47ca00
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 0x1004c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47ca14
sub eax, esi
lea eax, [eax + edx + 0xc8]
push eax
jmp 0x47ca61
cmp eax, 1
jne 0x47ca6d
mov eax, dword [ebp - 0x10048]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47ca35
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 0x1004c]
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47ca50
sub eax, esi
lea ecx, [eax + edx + 0xc8]
push ecx
push 1
call fcn.00491e51
mov ebx, eax
add esp, 8
mov edx, dword [ebp - 0x10034]
push 0x4fbcc0
push edx
call fcn.00496915
mov esi, eax
add esp, 8
test esi, esi
je 0x47d064
jmp 0x47ca90
mov edx, str.Active_Directory_User_Object
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x47cab7
test al, al
je 0x47cab3
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x47cab7
add ecx, 2
add edx, 2
test al, al
jne 0x47ca97
xor eax, eax
jmp 0x47cabc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47caec
cmp dword [ebp + 0x20], eax
jne 0x47caec
mov eax, dword [ebp - 0x10054]
push 0x4fbcc0
push 0
mov dword [eax], 1
call fcn.00496915
mov dword [ebp - 0x1002c], 1
jmp 0x47cc5f
mov eax, dword [0x513c54]
cmp eax, 2
jne 0x47cb42
push esi
call fcn.0047bfa0
mov ecx, dword [ebp - 0x1004c]
mov edx, dword [ebp - 0x10048]
push eax
push ecx
push edx
push str.powershell.exe_Import_PfxCertificate__FilePath__s__Password__ConvertTo_SecureString__String__s__AsPlainText__Force___CertStoreLocation_Cert:CurrentUser_s
push ebx
call fcn.00492848
mov ecx, dword [0x515c78]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x32
lea eax, [ebp - 0x10030]
push eax
push ebx
push 0
push ecx
call fcn.00477b50
add esp, 0x44
jmp 0x47cc35
cmp eax, 1
jne 0x47cc53
xor eax, eax
push esi
mov dword [ebp - 0x10050], eax
mov dword [ebp - 0x10034], eax
call fcn.0047bfa0
mov edx, dword [ebp - 0x1004c]
push eax
mov eax, dword [ebp - 0x10048]
push edx
push eax
push str.powershell.exe_Import_PfxCertificate__FilePath__s__Password__ConvertTo_SecureString__String__s__AsPlainText__Force___CertStoreLocation_Cert:LocalMachine_s
push ebx
call fcn.00492848
add esp, 0x18
call fcn.00477450
mov esi, eax
call fcn.00477950
lea ecx, [ebp - 0x10050]
push ecx
lea edx, [ebp - 0x10034]
push edx
push 5
push esi
push 0
mov edi, eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
mov eax, dword [ebp - 0x10034]
push eax
push str.ExecuteScript_:_The_active_session_User_name_is_given_by__s__n
call fcn.00423db0
push edi
push esi
push str.Active_Console_Id:__d_and_Active_Session_Id_:__d_n
call fcn.00423db0
mov eax, dword [ebp - 0x10034]
add esp, 0x14
test eax, eax
je 0x47cc04
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47cbd0
sub eax, edx
je 0x47cc04
push 0
push 0
push 0
push 0
push esi
push 0
push 0x3c
lea ecx, [ebp - 0x10030]
push ecx
push ebx
push 0
call fcn.00478480
add esp, 0x28
mov dword [ebp - 0x1002c], eax
mov esi, eax
jmp 0x47cc3d
call fcn.0045e190
push 0
push 0
push 0
push 0
push edi
push 0
push 0x3c
test eax, eax
je 0x47cc23
lea edx, [ebp - 0x10030]
push edx
jmp 0x47cc2a
lea eax, [ebp - 0x10030]
push eax
push ebx
push 0
call fcn.00478480
add esp, 0x28
mov esi, eax
mov dword [ebp - 0x1002c], esi
push esi
push str.InstallCertificate:_Cannot_User_Import_PFX_Certificate_using_powershell_command_error__ld__n
call fcn.00423ad0
add esp, 8
test esi, esi
jne 0x47d064
push 0x4fbcc0
push 0
call fcn.00496915
mov esi, eax
add esp, 8
test esi, esi
jne 0x47ca90
jmp 0x47d064
cmp dword [ebp + 0x24], 1
jne 0x47cc82
mov ecx, dword [ebp - 0x1003c]
push 1
push ecx
jmp 0x47cc8b
mov edx, dword [ebp - 0x1003c]
push 0
push edx
push esi
call dword [sym.imp.CRYPT32.dll_PFXImportCertStore]
mov dword [ebp - 0x10040], eax
test eax, eax
jne 0x47ccad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_Import_PFX_Certificate.._error__ld__n
jmp 0x47d056
push esi
call fcn.0048efd8
add esp, 4
mov eax, dword [ebp - 0x10034]
push 0x4fbcc0
push eax
call fcn.00496915
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x47d064
mov ecx, str.Active_Directory_User_Object
mov eax, ebx
jmp 0x47cce0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47ce03
test dl, dl
je 0x47cd04
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47ce03
add eax, 2
add ecx, 2
test dl, dl
jne 0x47cce0
xor eax, eax
jmp 0x47ce08
mov ecx, dword [ebp - 0x10008]
push 0
lea eax, [ebp - 0x10044]
push eax
push ecx
lea edx, [ebp - 0x10004]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47cd3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_Read_Certificate_File.._error__ld__n
jmp 0x47d056
mov eax, dword [ebp - 0x10044]
mov edi, dword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
push eax
lea ecx, [ebp - 0x10004]
push ecx
push 0x10001
call edi
mov dword [ebp - 0x10038], eax
test eax, eax
jne 0x47ccb6
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [ebp - 0x1002c], eax
cmp eax, 0x8009310b
jne 0x47cdf8
mov esi, dword [ebp - 0x10044]
push 0
push 0
lea edx, [ebp - 0x10044]
push edx
lea esi, [ebp + esi - 0x10004]
push esi
lea ecx, [ebp - 0x10004]
push 6
mov eax, esi
sub eax, ecx
push eax
mov edx, ecx
push edx
mov dword [ebp - 0x1002c], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
mov eax, dword [ebp - 0x10044]
jne 0x47cdd0
test eax, eax
je 0x47cdd0
call ebx
push eax
push str.InstallCertificate:_CryptStringToBinary_failed_with_error__ld__n
jmp 0x47d056
push eax
push esi
push 0x10001
call edi
mov dword [ebp - 0x10038], eax
test eax, eax
jne 0x47ccb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_create_Certificate_context.._error__ld__n
jmp 0x47d056
push eax
push str.InstallCertificate:_Cannot_create_Certificate_context.._error__ld__n
jmp 0x47d05c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47ce3c
cmp dword [ebp + 0x20], eax
jne 0x47ce3c
mov ecx, dword [ebp - 0x10054]
push 0x4fbcc0
push eax
mov dword [ecx], 1
call fcn.00496915
add esp, 8
mov ebx, eax
mov dword [ebp - 0x1002c], 1
jmp 0x47d040
push ebx
call fcn.0047bac0
push ebx
push str.InstallCertificate:_Store_Name___s___n
mov esi, eax
call fcn.00423960
mov edx, dword [ebp - 0x10050]
add esp, 0xc
push esi
push edx
push 0
push 0x10001
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov edi, eax
mov dword [ebp - 0x10034], edi
test edi, edi
jne 0x47ce8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 0x1002c], eax
push str.InstallCertificate:_Error_in_opening_certificate_store___s_.._error__ld__n
jmp 0x47d007
mov esi, dword [ebp - 0x10058]
mov ecx, str..cer
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47cec0
test dl, dl
je 0x47cebc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47cec0
add eax, 2
add ecx, 2
test dl, dl
jne 0x47cea0
xor eax, eax
jmp 0x47cec5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47cfa7
mov ecx, str..crt
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47cef4
test dl, dl
je 0x47cef0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47cef4
add eax, 2
add ecx, 2
test dl, dl
jne 0x47ced4
xor eax, eax
jmp 0x47cef9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47cfa7
mov eax, dword [ebp - 0x10038]
mov ecx, dword [ebp - 0x10040]
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov esi, eax
test esi, esi
je 0x47cf9b
push 0
push 4
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x47cf87
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1002c], edi
cmp edi, 0x80092005
je 0x47cf60
push edi
push ebx
push str.InstallCertificate:_Certificate_cannot_be_added_to_the_store___s_.._error__ld__n
mov dword [ebp - 0x10030], 0
call fcn.00423ad0
add esp, 0xc
jmp 0x47cf6d
push str.InstallCertificate:_Certificate_already_exist_in_this_store__n
call fcn.00423db0
add esp, 4
push edi
call fcn.00463420
push eax
push str.Error_Message:__s__n
call fcn.00423ad0
mov edi, dword [ebp - 0x10034]
add esp, 0xc
mov edx, dword [ebp - 0x10040]
push esi
push edx
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov esi, eax
test esi, esi
jne 0x47cf1f
mov dword [ebp - 0x10038], 0
jmp 0x47d00f
mov eax, dword [ebp - 0x10038]
push 0
push 4
push eax
push edi
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x47d00f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x1002c], esi
cmp esi, 0x80092005
je 0x47cfee
push esi
push ebx
push str.InstallCertificate:_Certificate_cannot_be_added_to_the_store___s_.._error__ld__n
mov dword [ebp - 0x10030], 0
call fcn.00423ad0
add esp, 0xc
jmp 0x47cffb
push str.InstallCertificate:_Certificate_already_exist_in_this_store__n
call fcn.00423db0
add esp, 4
push esi
call fcn.00463420
push eax
push str.Error_Message:__s
call fcn.00423ad0
add esp, 0xc
cmp dword [ebp - 0x10030], 0
jne 0x47d022
mov dword [ebp - 0x10030], 1
push 0x4fbcc0
push 0
call fcn.00496915
add esp, 8
mov ebx, eax
test edi, edi
je 0x47d040
push 0
push edi
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
test ebx, ebx
jne 0x47ccd4
jmp 0x47d064
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallCertificate:_Cannot_get_certificate_file_handle.._error__ld__n
mov dword [ebp - 0x1002c], eax
call fcn.00423ad0
add esp, 8
mov ecx, dword [ebp - 0x1005c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10038]
pop edi
pop esi
pop ebx
test eax, eax
je 0x47d085
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [ebp - 0x10040]
test eax, eax
je 0x47d098
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov eax, dword [ebp - 0x1003c]
test eax, eax
je 0x47d0b5
push eax
call fcn.0048efd8
add esp, 4
mov dword [ebp - 0x1003c], 0
push str._End_of_InstallCertificate_method___n
call fcn.00423db0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1002c]
xor ecx, ebp
add esp, 4
call fcn.0048ed61
mov esp, ebp
pop ebp
ret