Function at 0x48e980
Capabilities:
Create process on windows
Get session user name
Get token membership
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x33c
mov ebx, dword [eax + 0x54]
test ebx, ebx
je 0x48ecb0
mov ebx, eax
mov dword [esp + 4], 0
mov eax, dword [eax + 0x50]
mov esi, edx
mov dword [ebp - 0x2f0], ecx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__access]
cmp eax, 0xffffffff
je 0x48ecb0
mov eax, esi
test al, al
jne 0x48ec80
lea eax, [ebp - 0x258]
mov edi, 0x500
mov dword [ebp - 0x11c], 0
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x11c]
mov word [ebp - 0x118], di
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x21c], eax
test eax, eax
jne 0x48ecc0
lea eax, [ebp - 0x278]
mov ecx, eax
mov dword [ebp - 0x2f4], eax
call fcn.00499f80
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [ebx + 0xd4]
mov edi, eax
cmp eax, 4
je 0x48f019
lea eax, [ebp - 0x250]
mov byte [ebp - 0x250], 0
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], 0
cmp edi, 3
je 0x48f6b0
mov eax, dword [ebp - 0x2f0]
lea esi, [ebp - 0x21c]
mov dword [esp + 4], str.Discard_version_
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.0054b7e0
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x218]
cmp eax, 9
jbe 0x48fd8f
mov dword [esp + 4], 0xa
mov ecx, esi
mov dword [esp], str.__by_user.
call fcn.004e4bc8
lea esi, [ebp - 0x114]
lea edx, [eax + 8]
sub esp, 8
mov dword [ebp - 0x11c], esi
mov ecx, dword [eax]
mov dword [ebp - 0x300], esi
cmp ecx, edx
je 0x48fba0
mov dword [ebp - 0x11c], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x114], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x118], ecx
mov dword [eax], edx
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0x11c]
cmp edx, dword [ebp - 0x300]
je 0x48fb75
mov ecx, dword [ebp - 0x114]
mov esi, dword [ebp - 0x118]
mov dword [ebp - 0x2f0], ecx
cmp eax, dword [ebp - 0x2f8]
je 0x48fa70
mov dword [ebp - 0x254], esi
mov esi, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x250], esi
test eax, eax
je 0x48fa82
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x48ebd4
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x214]
cmp eax, edx
je 0x48ebec
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov byte [esp + 8], 0
mov esi, dword [ebp - 0x300]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc833af
mov dword [esp], 0xc833af
mov dword [ebp - 0x11c], esi
call fcn.00547520
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
xor ecx, ecx
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
lea edx, [ebp - 0x258]
mov dword [esp], ebx
call fcn.0048e1c0
mov eax, dword [ebp - 0x11c]
cmp eax, esi
je 0x48ec52
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x2f8]
je 0x48ec68
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov ecx, dword [ebp - 0x2f4]
call fcn.0049a010
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2f0]
lea ecx, [ebx + 0xa0]
mov dword [esp], eax
call fcn.004936d0
sub esp, 4
test al, al
je 0x48e9c8
mov edi, 3
jmp 0x48ecb5
mov edi, 5
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x258]
lea esi, [ebp - 0x21c]
mov dword [esp], 0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
sub esp, 0xc
test eax, eax
jne 0x48ecf2
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x258]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x278]
sub esp, 4
mov ecx, eax
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x304], edi
call fcn.00499f80
test edi, edi
je 0x48ea69
xor eax, eax
lea edi, [ebp - 0x218]
mov ecx, 0x3f
mov dword [ebp - 0x21c], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2e8]
mov dword [esp], esi
mov dword [ebp - 0x2e8], 0x100
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x2b8]
sub esp, 8
mov edx, esi
mov dword [ebp - 0x2c0], eax
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x48ed72
mov ecx, eax
mov byte [esp + 8], 0
shr ecx, 0x10
test eax, 0x8080
mov dword [esp], esi
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea ecx, [ebp - 0x2c0]
sbb edx, 3
mov dword [esp + 4], edx
call fcn.00547520
sub esp, 0xc
mov dword [esp], str.netapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov edi, eax
test eax, eax
je 0x48f8ac
mov dword [esp + 4], str.NetUserGetInfo
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [ebp - 0x308], eax
mov dword [esp + 4], str.NetApiBufferFree
mov dword [esp], edi
call esi
mov esi, dword [ebp - 0x308]
sub esp, 8
mov dword [ebp - 0x30c], eax
test esi, esi
je 0x48f8a0
test eax, eax
je 0x48f8a0
lea eax, [ebp - 0x114]
mov edx, dword [ebp - 0x2bc]
mov byte [esp + 8], 0
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x290], 0
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.005475e0
lea eax, [ebp - 0x250]
sub esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x118]
mov word [ebp - 0x250], cx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x318], eax
call eax
mov dword [ebp - 0x310], eax
lea eax, [eax + 1]
sub esp, 0x18
cmp eax, 0x3ffffffe
ja 0x550cc9
lea ecx, [eax + eax]
mov dword [esp], ecx
mov dword [ebp - 0x314], ecx
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov esi, eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x118]
mov edx, dword [ebp - 0x310]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp + 0x14], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x318]
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x314]
xor edx, edx
sub esp, 0x18
mov word [esi + eax - 2], dx
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x254]
cmp eax, edx
ja 0x48fdb3
mov dword [esp + 4], eax
lea ecx, [ebp - 0x258]
mov dword [esp], esi
call fcn.004e4b80
sub esp, 8
mov dword [esp], esi
call sub.libstdc_6.dll_operator_delete___void_
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x48ef88
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
lea eax, [ebp - 0x290]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x258]
mov dword [esp], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x308]
call eax
test eax, eax
jne 0x48f970
mov eax, dword [ebp - 0x290]
cmp dword [eax + 0xc], 2
mov dword [esp], eax
sete dl
mov eax, dword [ebp - 0x30c]
mov esi, edx
call eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x2f8]
je 0x48eff7
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x2c0]
lea edi, [ebp - 0x2b8]
cmp eax, edi
je 0x48f00f
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, esi
test al, al
je 0x48ea69
mov eax, dword [ebx + 0x18]
call fcn.0048dd70
mov edi, dword [ebp - 0x2f4]
mov eax, dword [ebx + 0xd8]
xor ecx, ecx
mov dword [esp], 0
mov edx, 3
mov dword [esp + 4], edi
call fcn.0048e120
mov dword [esp], 0
call sub.msvcrt.dll_time
mov ecx, 0xd
mov dword [ebx + 0x4c], 0
cdq
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], edx
mov dword [ebp - 0x2fc], edx
lea edx, [ebp - 0x250]
mov dword [ebp - 0x300], eax
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x50]
mov dword [esp + 8], 0x104
mov dword [ebp - 0x258], 0x3c
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x24c], str.runas
mov dword [ebp - 0x254], 0x40
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
jne 0x48f4c0
mov byte [esp + 8], 0
lea eax, [ebp - 0x2d0]
lea ecx, [ebp - 0x2d8]
mov dword [esp + 4], 0xc833af
mov dword [esp], 0xc833af
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x2d8], eax
call fcn.00547520
lea eax, [ebp - 0x2a0]
sub esp, 0xc
lea esi, [ebp - 0x2a8]
mov dword [ebp - 0x2f0], eax
mov byte [esp + 8], 0
mov eax, dword [ebp - 0x2f0]
mov ecx, esi
mov dword [esp + 4], 0xc83478
mov dword [esp], str._adminoption_1__updateyes__instdir
mov dword [ebp - 0x2a8], eax
call fcn.00547520
sub esp, 0xc
cmp dword [ebp - 0x2a4], 0x7fffffff
je 0x48fd83
mov dword [esp + 4], 1
mov ecx, esi
mov dword [esp], 0xc83479
call fcn.004e4bc8
mov eax, dword [ebp - 0x2d4]
sub esp, 8
mov ecx, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2d8]
mov dword [esp], eax
call fcn.004e4bc8
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2a4]
sub esp, 8
cmp eax, 1
jbe 0x48fd77
mov dword [esp + 4], 2
mov ecx, esi
mov dword [esp], 0xc8347b
call fcn.004e4bc8
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2a4]
sub esp, 8
cmp eax, 3
jbe 0x48fd6b
mov dword [esp + 4], 4
mov ecx, esi
mov dword [esp], str._D_
call fcn.004e4bc8
mov eax, dword [ebp - 0x2d4]
sub esp, 8
mov ecx, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2d8]
mov dword [esp], eax
call fcn.004e4bc8
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2a4]
sub esp, 8
cmp eax, 1
jbe 0x48fd5f
mov dword [esp + 4], 2
mov ecx, esi
mov dword [esp], 0xc8347b
call fcn.004e4bc8
mov edx, dword [ebp - 0x304]
sub esp, 8
test edx, edx
jne 0x48f25d
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2a4]
cmp eax, 0xe
jbe 0x48fd9b
mov dword [esp + 4], 0xf
mov ecx, esi
mov dword [esp], str.__runAsNonAdmin
call fcn.004e4bc8
sub esp, 8
lea edi, [ebx + 8]
lea esi, [ebx + 0x70]
mov dword [ebx + 0x4c], 0
mov eax, dword [ebp - 0x2a8]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [ebp - 0x244], eax
call fcn.00494b20
lea eax, [ebp - 0x258]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
sub esp, 4
test eax, eax
jne 0x48f870
mov dword [esp], 0
call sub.msvcrt.dll_time
mov edi, dword [ebp - 0x2f4]
mov ecx, 3
cdq
sub eax, dword [ebp - 0x300]
sbb edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2fc], edx
fild qword [ebp - 0x300]
mov edx, 4
mov dword [esp + 4], edi
fstp dword [esp]
mov eax, dword [ebx + 0xd8]
call fcn.0048e120
mov eax, dword [ebx + 0xd8]
test eax, eax
je 0x48f48c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x4c7
je 0x48f980
cmp eax, 2
je 0x48fcc0
mov byte [esp + 8], 0
lea edi, [ebp - 0x290]
lea eax, [ebp - 0x288]
mov dword [esp + 4], 0xc8350d
mov ecx, edi
mov dword [esp], str.Setup_package_error_code_is
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x290], eax
call fcn.00547520
sub esp, 0xc
lea eax, [ebp - 0x11c]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0xc8350e
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x48dd50
mov dword [esp], eax
call fcn.0053daf0
mov eax, dword [ebp - 0x118]
mov ecx, edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.004e4bc8
mov eax, dword [ebp - 0x11c]
lea edi, [ebp - 0x114]
sub esp, 8
mov dword [ebp - 0x300], edi
cmp eax, edi
je 0x48f3ae
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov byte [esp + 8], 0
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc833af
mov dword [esp], 0xc833af
mov dword [ebp - 0x11c], eax
call fcn.00547520
mov edx, dword [ebp - 0x290]
lea edi, [ebp - 0x214]
sub esp, 0xc
mov eax, 0xffffffff
mov dword [ebp - 0x21c], edi
test edx, edx
je 0x48f40d
mov dword [esp], edx
mov dword [ebp - 0x304], edx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x304]
add eax, edx
mov byte [esp + 8], 0
lea esi, [ebp - 0x21c]
mov dword [esp + 4], eax
mov ecx, esi
mov dword [esp], edx
call fcn.00547520
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
mov ecx, 2
mov edx, esi
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
mov dword [esp], ebx
call fcn.0048e1c0
mov eax, dword [ebp - 0x21c]
cmp eax, edi
je 0x48f460
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x48f476
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x290]
cmp eax, dword [ebp - 0x2f8]
je 0x48f48c
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov edi, 6
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x2f0]
je 0x48f4a7
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x308]
jne 0x48ec60
jmp 0x48ec68
lea eax, [ebp - 0x2a0]
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2a8], eax
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x48f4d8
mov ecx, eax
mov byte [esp + 8], 0
lea esi, [ebp - 0x2a8]
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea eax, [ebp - 0x11c]
mov ecx, esi
sbb edx, 3
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00547520
sub esp, 0xc
mov eax, esi
call fcn.0048de60
mov dword [esp + 4], 0xffffffff
mov ecx, esi
lea edi, [ebp - 0x290]
mov dword [esp], 0x5c
call fcn.004e4dc8
mov ecx, dword [ebp - 0x2a4]
lea edx, [ebp - 0x288]
sub esp, 8
mov dword [ebp - 0x2f8], edx
cmp eax, ecx
mov dword [ebp - 0x290], edx
mov edx, dword [ebp - 0x2a8]
cmova eax, ecx
mov byte [esp + 8], 0
mov ecx, edi
mov dword [esp], edx
add eax, edx
mov dword [esp + 4], eax
call fcn.00547520
sub esp, 0xc
mov eax, dword [ebp - 0x2a8]
mov edx, dword [ebp - 0x290]
cmp edx, dword [ebp - 0x2f8]
je 0x48fc10
mov edi, dword [ebp - 0x288]
mov dword [ebp - 0x308], edi
mov edi, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x2f0]
je 0x48fbd0
mov dword [ebp - 0x2a4], edi
mov edi, dword [ebp - 0x308]
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 0x2a0], edi
test eax, eax
je 0x48fbe8
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x28c], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x290]
cmp eax, dword [ebp - 0x2f8]
je 0x48f616
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov edi, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x2a8]
cmp byte [eax + edi - 1], 0x5c
je 0x48f672
cmp eax, dword [ebp - 0x2f0]
mov edx, 0xf
lea ecx, [edi + 1]
cmovne edx, dword [ebp - 0x2a0]
mov dword [ebp - 0x2f8], ecx
cmp ecx, edx
ja 0x48f940
mov byte [eax + edi], 0x5c
mov edi, dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2a4], edi
mov byte [eax + edi], 0
mov eax, dword [ebp - 0x2a8]
mov edi, dword [ebp - 0x2a4]
lea edx, [ebp - 0x2d0]
mov dword [ebp - 0x308], edx
mov dword [ebp - 0x2d8], edx
cmp eax, dword [ebp - 0x2f0]
je 0x48fc30
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d4], edi
jmp 0x48f112
lea eax, [ebx + 0x50]
lea esi, [ebx + 0xa0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2f0]
mov ecx, esi
mov dword [esp], eax
call fcn.004945d0
sub esp, 8
lea eax, [ebx + 0x88]
mov ecx, esi
mov dword [esp], eax
call fcn.00493700
mov eax, dword [ebp - 0x2f0]
sub esp, 4
lea esi, [ebp - 0x21c]
mov dword [esp + 4], str.Skip_version_
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.0054b7e0
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x218]
cmp eax, 9
jbe 0x48fda7
mov dword [esp + 4], 0xa
mov ecx, esi
mov dword [esp], str.__by_user.
call fcn.004e4bc8
lea esi, [ebp - 0x114]
lea edx, [eax + 8]
sub esp, 8
mov dword [ebp - 0x11c], esi
mov ecx, dword [eax]
mov dword [ebp - 0x300], esi
cmp ecx, edx
je 0x48fc90
mov dword [ebp - 0x11c], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x114], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x118], ecx
mov dword [eax], edx
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0x11c]
cmp edx, dword [ebp - 0x300]
je 0x48fc65
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x2f0], esi
mov esi, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x2f8]
je 0x48fa32
mov dword [ebp - 0x254], esi
mov esi, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x250], esi
test eax, eax
je 0x48fa4a
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x48f7ff
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x214]
cmp eax, edx
je 0x48f817
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov byte [esp + 8], 0
mov esi, dword [ebp - 0x300]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc833af
mov dword [esp], 0xc833af
mov dword [ebp - 0x11c], esi
call fcn.00547520
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
xor ecx, ecx
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
lea edx, [ebp - 0x258]
mov dword [esp], ebx
call fcn.0048e1c0
jmp 0x48ec40
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x2fc]
mov dword [ebx + 0x4c], eax
mov eax, dword [ebp - 0x300]
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x68], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00494b20
xor edi, edi
jmp 0x48f491
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
lea eax, [ebp - 0x2dc]
lea edi, [ebp - 0x2e4]
mov dword [ebp - 0x2e4], 0
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x2e0]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2e0], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call esi
mov eax, dword [ebp - 0x2e4]
sub esp, 0x1c
test eax, eax
jne 0x48faa0
mov eax, dword [ebp - 0x2c0]
lea edi, [ebp - 0x2b8]
cmp eax, edi
je 0x48ea69
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
jmp 0x48ea69
mov dword [esp + 0xc], 1
mov ecx, esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.004e4bb0
sub esp, 0x10
mov eax, dword [ebp - 0x2a8]
jmp 0x48f64c
xor esi, esi
jmp 0x48efd5
mov byte [esp + 8], 0
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc833af
mov dword [esp], 0xc833af
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x11c], eax
call fcn.00547520
sub esp, 0xc
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x214]
mov byte [esp + 8], 0
mov ecx, esi
mov dword [esp + 4], 0xc834c6
mov dword [esp], str.Setup_package_elevation_permission_denied_by_user.
mov dword [ebp - 0x21c], edi
call fcn.00547520
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
mov ecx, 2
mov edx, esi
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
mov dword [esp], ebx
call fcn.0048e1c0
mov eax, dword [ebp - 0x21c]
cmp eax, edi
je 0x48fa1b
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
jne 0x48f484
jmp 0x48f48c
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x300], eax
jmp 0x48f7dc
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], ecx
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x300], eax
jmp 0x48ebb1
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x2e0]
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov dword [ebp - 0x2f8], eax
lea edx, [ebp - 0x2dc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x300]
mov dword [esp + 0x18], edx
lea edx, [ebp - 0x2e0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp], 0
call esi
sub esp, 0x1c
test eax, eax
je 0x48fc05
mov eax, dword [ebp - 0x300]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
sub esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48fc05
mov dword [ebp - 0x11c], 0
mov ecx, 0x500
mov word [ebp - 0x118], cx
mov edi, dword [esi]
test edi, edi
je 0x48fd4e
mov eax, 1
test eax, eax
sete al
mov esi, eax
mov eax, dword [ebp - 0x300]
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x2f8]
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete___void_
jmp 0x48eff7
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x258]
mov dword [esp], eax
call fcn.004e4bc0
mov eax, dword [ebp - 0x11c]
sub esp, 4
jmp 0x48ebb1
mov ecx, dword [eax + 8]
mov dword [ebp - 0x114], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x110], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10c], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x108], ecx
jmp 0x48eb33
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x2f8], eax
jmp 0x48f5f3
xor esi, esi
jmp 0x48fb54
mov dword [esp], edi
mov ecx, esi
call fcn.004e4bc0
mov eax, dword [ebp - 0x290]
sub esp, 4
jmp 0x48f5f3
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2c4], eax
jmp 0x48f6a2
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x258]
mov dword [esp], eax
call fcn.004e4bc0
mov eax, dword [ebp - 0x11c]
sub esp, 4
jmp 0x48f7dc
mov ecx, dword [eax + 8]
mov dword [ebp - 0x114], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x110], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10c], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x108], ecx
jmp 0x48f75e
mov byte [esp + 8], 0
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc833af
mov dword [esp], 0xc833af
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x11c], eax
call fcn.00547520
sub esp, 0xc
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x214]
mov byte [esp + 8], 0
mov ecx, esi
mov dword [esp + 4], 0xc834f0
mov dword [esp], str.Setup_package_file_to_execute_not_found.
mov dword [ebp - 0x21c], edi
call fcn.00547520
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
mov ecx, 2
mov edx, esi
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
mov dword [esp], ebx
call fcn.0048e1c0
jmp 0x48fa09
cmp word [esi + 4], 0x500
jne 0x48fb48
jmp 0x48fb4d
mov dword [esp], 0xc833b0
call fcn.004e4aa8
mov dword [esp], 0xc833b0
call fcn.004e4aa8
mov dword [esp], 0xc833b0
call fcn.004e4aa8
mov dword [esp], 0xc833b0
call fcn.004e4aa8
mov dword [esp], 0xc833b0
call fcn.004e4aa8
mov dword [esp], 0xc833b0
call fcn.004e4aa8
mov dword [esp], 0xc833b0
call fcn.004e4aa8
mov dword [esp], 0xc833b0
call fcn.004e4aa8
mov ebx, eax
jmp 0x550bb8
mov eax, dword [ebp - 0x2c0]
lea edi, [ebp - 0x2b8]
cmp eax, edi
jne 0x550bb0
jmp 0x550bb8
call sub.libstdc_6.dll___cxa_throw_bad_array_new_length
mov ebx, eax
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x2f8]
je 0x550ce6
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x550cb0
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
jmp 0x550cb0