Function at 0x70260d80
Capabilities:
Allocate thread local storage
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x314
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x310], eax
mov eax, dword [0x7035979c]
push ebx
push esi
push edi
test eax, eax
jne 0x70260ff9
mov ebx, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esp + 0xc], eax
or eax, 0xffffffff
mov ecx, 0x40
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
xor edi, edi
call ebx
mov dword [esp + edi*4 + 0x10], eax
cmp eax, 0xffffffff
je 0x70260dda
cmp eax, 0x40
ja 0x70260dda
inc edi
cmp edi, 0x40
jl 0x70260dc4
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WINTRUST.DLL
call esi
mov ebx, eax
test ebx, ebx
je 0x70260fde
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminAcquireContext
push ebx
call edi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [0x70359760], eax
call edi
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
mov dword [0x70359764], eax
call edi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [0x70359768], eax
call edi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [0x7035976c], eax
call edi
push str.WinVerifyTrust
push ebx
mov dword [0x70359770], eax
call edi
cmp dword [0x70359760], 0
mov dword [0x70359774], eax
je 0x70260fde
cmp dword [0x70359764], 0
je 0x70260fde
cmp dword [0x70359768], 0
je 0x70260fde
cmp dword [0x7035976c], 0
je 0x70260fde
cmp dword [0x70359770], 0
je 0x70260fde
test eax, eax
je 0x70260fde
push 0x208
lea eax, [esp + 0x114]
push 0
push eax
call fcn.702e95e0
lea ecx, [esp + 0x11c]
add esp, 0xc
test ecx, ecx
je 0x70260fde
push 0x104
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x70260fde
push str.Crypt32.dll
lea eax, [esp + 0x114]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x70260fde
lea edx, [esp + 0x110]
push edx
call esi
mov ebx, eax
test ebx, ebx
je 0x70260fde
push str.CryptMsgClose
push ebx
call edi
push str.CertCloseStore
push ebx
mov dword [0x70359778], eax
call edi
push str.CryptMsgGetParam
push ebx
mov dword [0x7035977c], eax
call edi
push str.CryptQueryObject
push ebx
mov dword [0x70359780], eax
call edi
push str.CryptDecodeObject
push ebx
mov dword [0x70359784], eax
call edi
push str.CertFreeCertificateContext
push ebx
mov dword [0x70359788], eax
call edi
push str.CertGetNameStringW
push ebx
mov dword [0x7035978c], eax
call edi
push str.CertGetNameStringA
push ebx
mov dword [0x70359790], eax
call edi
push str.CertFindCertificateInStore
push ebx
mov dword [0x70359794], eax
call edi
cmp dword [0x70359778], 0
mov dword [0x70359798], eax
je 0x70260fde
cmp dword [0x7035977c], 0
je 0x70260fde
cmp dword [0x70359780], 0
je 0x70260fde
cmp dword [0x70359784], 0
je 0x70260fde
cmp dword [0x70359788], 0
je 0x70260fde
cmp dword [0x7035978c], 0
je 0x70260fde
cmp dword [0x70359790], 0
je 0x70260fde
cmp dword [0x70359794], 0
je 0x70260fde
test eax, eax
je 0x70260fde
mov ebx, dword [sym.imp.KERNEL32.dll_TlsFree]
mov esi, 1
xor edi, edi
mov eax, dword [esp + edi*4 + 0x10]
cmp eax, 0xffffffff
je 0x70260feb
push eax
call ebx
inc edi
cmp edi, 0x40
jl 0x70260fca
jmp 0x70260feb
lea ebx, [esp + 0x10]
call fcn.70202630
mov esi, dword [esp + 0xc]
neg esi
sbb esi, esi
add esi, 2
mov eax, esi
mov dword [0x7035979c], eax
xor ecx, ecx
cmp eax, 1
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret