Function at 0x48d2c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x32c]
push edi
push eax
call fcn.00488090
lea ecx, [ebp - 0x32c]
push ecx
call fcn.00488060
lea edx, [ebp - 0x32c]
push edx
call fcn.00488030
add esp, 0xc
cmp dword [ebp - 0x318], 8
jb 0x48d317
mov eax, dword [ebp - 0x32c]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.004887d0
lea ecx, [ebp - 0x32d]
call fcn.00488a70
lea ecx, [ebp - 0x32d]
call fcn.00488240
lea ecx, [ebp - 0x32d]
call fcn.00488aa0
lea ecx, [ebp - 0x32d]
call fcn.00488240
mov ecx, str.SeDebugPrivilege
call fcn.00488b70
call fcn.0048ba30
mov edi, dword [sym.imp.MSVCR100.dll__wcsnicmp]
push 0x16
push str._KsomiscProcDelddeexec
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x48d3ad
call fcn.00450310
test al, al
jne 0x48d394
push esi
call fcn.0048cf90
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 0x10
call fcn.0046f660
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 0x10
push 0xa
push str._verifysn
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x48d3dc
add esi, 0x14
push esi
call fcn.0048ca20
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 0x10
push 0x103
lea ecx, [ebp - 0x107]
push 0
mov edi, 1
push ecx
mov dword [ebp - 0x344], edi
mov byte [ebp - 0x108], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x344]
lea eax, [ebp - 0x108]
push edx
lea ecx, [ebp - 0x35c]
mov dword [ebp - 0x348], eax
call fcn.00402fc0
call fcn.0048cc80
push esi
push str._ksomisc_begin__cmdline:_s
push str.wWinMain
push 0x1e3
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomiscksomisc.cpp
push 4
call fcn.00487a00
mov eax, dword [sym.imp.MSVCR100.dll___argc]
mov ecx, dword [eax]
mov edx, dword [sym.imp.MSVCR100.dll___wargv]
mov eax, dword [edx]
mov ecx, dword [eax + ecx*4 - 4]
push str._forceperusermode
push ecx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 0x20
test eax, eax
jne 0x48d4f3
push str._forceperusermode
push esi
call dword [sym.imp.MSVCR100.dll_wcsstr]
add esp, 8
xor edx, edx
mov word [eax], dx
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48d4a0
sub eax, edx
sar eax, 1
lea ecx, [eax - 1]
test ecx, ecx
js 0x48d4e2
movzx eax, word [esi + ecx*2]
cmp eax, 9
je 0x48d4d8
cmp eax, 0xa
je 0x48d4d8
cmp eax, 0xb
je 0x48d4d8
cmp eax, 0xc
je 0x48d4d8
cmp eax, 0xd
je 0x48d4d8
cmp eax, 0x20
jne 0x48d4e2
xor eax, eax
mov word [esi + ecx*2], ax
sub ecx, edi
jns 0x48d4b6
mov eax, dword [sym.imp.MSVCR100.dll___argc]
dec dword [eax]
call fcn.00433460
jmp 0x48d787
call fcn.00438260
test al, al
je 0x48d516
call fcn.004383a0
test al, al
je 0x48d657
call fcn.00433ab0
cmp eax, edi
jne 0x48d657
call fcn.00450310
test al, al
jne 0x48d657
call fcn.00450320
test al, al
jne 0x48d657
call fcn.00451670
test al, al
jne 0x48d54a
push esi
call fcn.0044fed0
add esp, 4
test eax, eax
je 0x48d657
push str.Need_higher_privileges.
push str.wWinMain
push 0x207
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomiscksomisc.cpp
push 7
call fcn.00487a00
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call sub.MSVCR100.dll_memset
add esp, 0x20
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [sym.imp.MSVCR100.dll___argc]
mov dword [ebp - 0x334], 0
cmp dword [ecx], 3
jne 0x48d5ca
mov edx, dword [sym.imp.MSVCR100.dll___wargv]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
push str._addsn
push ecx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x48d5cc
xor edi, edi
call fcn.00488ad0
test eax, eax
mov eax, str.Run__UserAdmin
jne 0x48d5df
mov eax, str.Run__UserSystem
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x340], esp
push eax
call fcn.00405cd0
push esi
call fcn.0044fed0
add esp, 4
push eax
mov edx, edi
neg edx
sbb edx, edx
lea eax, [ebp - 0x334]
and edx, eax
push edx
push 0
lea ecx, [ebp - 0x310]
push esi
push ecx
call fcn.00451f20
add esp, 0x30
test eax, eax
jns 0x48d64c
test edi, edi
je 0x48d62d
mov dword [ebp - 0x334], 1
push eax
push str.Failed_run_ksomisc.exe_elevated:_0x_08x.
push str.wWinMain
push 0x216
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomiscksomisc.cpp
push 0
call fcn.00487a00
add esp, 0x18
mov esi, dword [ebp - 0x334]
jmp 0x48d842
call fcn.00438260
test al, al
jne 0x48d787
call fcn.00450310
test al, al
jne 0x48d787
call fcn.00450320
test al, al
je 0x48d787
call fcn.00451670
test al, al
je 0x48d787
push ecx
mov dword [ebp - 0x340], esp
mov eax, esp
push 0
push ecx
mov dword [eax], 0
mov dword [eax], 0x103
mov eax, esp
mov dword [ebp - 0x34c], esp
push 0
lea edx, [ebp - 0x340]
push str.You_are_not_using_an_administrator_account._Some_features_are_not_available.
push edx
mov dword [eax], 0x400
call fcn.0042f0b0
add esp, 0xc
push eax
push 0
lea eax, [ebp - 0x338]
push str.WPS_Office_General_Repair_Configuration_Tools
push eax
call fcn.0042f0b0
add esp, 0xc
push eax
push edi
lea ecx, [ebp - 0x324]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QMessageBox::constructor_enum_QMessageBox::Icon__class_QString_const___class_QString_const___class_QFlags_enum_QMessageBox::StandardButton___class_QWidget___class_QFlags_enum_Qt::WindowType__]
lea ecx, [ebp - 0x338]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x340]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x334]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QIcon::constructor_void_]
push str.:_ksomisc_maindlg.ico
lea ecx, [ebp - 0x338]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_char_const__]
push edi
push 0
lea ecx, [ebp - 0x350]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSize::constructor_void_]
push eax
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x334]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QIcon::addFile_class_QString_const___class_QSize_const___enum_QIcon::Mode__enum_QIcon::State_]
lea ecx, [ebp - 0x338]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea edx, [ebp - 0x334]
push edx
lea ecx, [ebp - 0x324]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QWidget::setWindowIcon_class_QIcon_const__]
lea ecx, [ebp - 0x324]
call dword [sym.imp.QtCore4.dll_public:_int___thiscall_QDialog::exec_void_]
lea ecx, [ebp - 0x334]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QIcon::destructor_void_]
lea ecx, [ebp - 0x324]
call dword [sym.imp.QtCore4.dll_public_virtual:_void___thiscall_QMessageBox::destructor_void_]
push 0
mov dword [ebp - 0x33c], 0xffffffff
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x48d82c
mov eax, dword [ebp + 8]
push 0
push eax
push 0
mov ecx, 0x5649c4
call fcn.00489510
test eax, eax
js 0x48d82c
mov ecx, dword [sym.imp.MSVCR100.dll___argc]
cmp dword [ecx], edi
jle 0x48d7fa
mov edx, dword [sym.imp.MSVCR100.dll___wargv]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
push str._apicompkdetype
push ecx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x48d7fa
mov edx, dword [sym.imp.MSVCR100.dll___wargv]
mov eax, dword [edx]
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
push eax
call fcn.00415650
add esp, 8
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x33c]
push ecx
push esi
mov edi, eax
mov dword [ebp - 0x33c], 0
call fcn.004895e0
add esp, 8
test edi, edi
je 0x48d82c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 0x5649c4
call fcn.0048a1a0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [ebp - 0x33c]
lea ecx, [ebp - 0x35c]
call fcn.004024f0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 0x10