Function at 0x48dab0
Capabilities:
Create process on windows
Get session user name
Get token membership
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x33c
mov ebx, dword [eax + 0x54]
test ebx, ebx
je 0x48dde0
mov ebx, eax
mov dword [esp + 4], 0
mov eax, dword [eax + 0x50]
mov esi, edx
mov dword [ebp - 0x2f0], ecx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__access]
cmp eax, 0xffffffff
je 0x48dde0
mov eax, esi
test al, al
jne 0x48ddb0
lea eax, [ebp - 0x258]
mov edi, 0x500
mov dword [ebp - 0x11c], 0
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x11c]
mov word [ebp - 0x118], di
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x21c], eax
test eax, eax
jne 0x48ddf0
lea eax, [ebp - 0x278]
mov ecx, eax
mov dword [ebp - 0x2f4], eax
call fcn.004990b0
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [ebx + 0xd4]
mov edi, eax
cmp eax, 4
je 0x48e149
lea eax, [ebp - 0x250]
mov byte [ebp - 0x250], 0
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], 0
cmp edi, 3
je 0x48e7e0
mov eax, dword [ebp - 0x2f0]
lea esi, [ebp - 0x21c]
mov dword [esp + 4], str.Discard_version_
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.0054a860
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x218]
cmp eax, 9
jbe 0x48eebf
mov dword [esp + 4], 0xa
mov ecx, esi
mov dword [esp], str.__by_user.
call fcn.004e3cf8
lea esi, [ebp - 0x114]
lea edx, [eax + 8]
sub esp, 8
mov dword [ebp - 0x11c], esi
mov ecx, dword [eax]
mov dword [ebp - 0x300], esi
cmp ecx, edx
je 0x48ecd0
mov dword [ebp - 0x11c], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x114], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x118], ecx
mov dword [eax], edx
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0x11c]
cmp edx, dword [ebp - 0x300]
je 0x48eca5
mov ecx, dword [ebp - 0x114]
mov esi, dword [ebp - 0x118]
mov dword [ebp - 0x2f0], ecx
cmp eax, dword [ebp - 0x2f8]
je 0x48eba0
mov dword [ebp - 0x254], esi
mov esi, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x250], esi
test eax, eax
je 0x48ebb2
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x48dd04
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x214]
cmp eax, edx
je 0x48dd1c
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov byte [esp + 8], 0
mov esi, dword [ebp - 0x300]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc8218f
mov dword [esp], 0xc8218f
mov dword [ebp - 0x11c], esi
call fcn.005465a0
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
xor ecx, ecx
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
lea edx, [ebp - 0x258]
mov dword [esp], ebx
call fcn.0048d2f0
mov eax, dword [ebp - 0x11c]
cmp eax, esi
je 0x48dd82
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x2f8]
je 0x48dd98
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov ecx, dword [ebp - 0x2f4]
call fcn.00499140
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2f0]
lea ecx, [ebx + 0xa0]
mov dword [esp], eax
call fcn.00492800
sub esp, 4
test al, al
je 0x48daf8
mov edi, 3
jmp 0x48dde5
mov edi, 5
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x258]
lea esi, [ebp - 0x21c]
mov dword [esp], 0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
sub esp, 0xc
test eax, eax
jne 0x48de22
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x258]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x278]
sub esp, 4
mov ecx, eax
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x304], edi
call fcn.004990b0
test edi, edi
je 0x48db99
xor eax, eax
lea edi, [ebp - 0x218]
mov ecx, 0x3f
mov dword [ebp - 0x21c], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2e8]
mov dword [esp], esi
mov dword [ebp - 0x2e8], 0x100
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x2b8]
sub esp, 8
mov edx, esi
mov dword [ebp - 0x2c0], eax
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x48dea2
mov ecx, eax
mov byte [esp + 8], 0
shr ecx, 0x10
test eax, 0x8080
mov dword [esp], esi
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea ecx, [ebp - 0x2c0]
sbb edx, 3
mov dword [esp + 4], edx
call fcn.005465a0
sub esp, 0xc
mov dword [esp], str.netapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov edi, eax
test eax, eax
je 0x48e9dc
mov dword [esp + 4], str.NetUserGetInfo
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [ebp - 0x308], eax
mov dword [esp + 4], str.NetApiBufferFree
mov dword [esp], edi
call esi
mov esi, dword [ebp - 0x308]
sub esp, 8
mov dword [ebp - 0x30c], eax
test esi, esi
je 0x48e9d0
test eax, eax
je 0x48e9d0
lea eax, [ebp - 0x114]
mov edx, dword [ebp - 0x2bc]
mov byte [esp + 8], 0
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x290], 0
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00546660
lea eax, [ebp - 0x250]
sub esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x118]
mov word [ebp - 0x250], cx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x318], eax
call eax
mov dword [ebp - 0x310], eax
lea eax, [eax + 1]
sub esp, 0x18
cmp eax, 0x3ffffffe
ja 0x54fd39
lea ecx, [eax + eax]
mov dword [esp], ecx
mov dword [ebp - 0x314], ecx
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov esi, eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x118]
mov edx, dword [ebp - 0x310]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp + 0x14], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x318]
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x314]
xor edx, edx
sub esp, 0x18
mov word [esi + eax - 2], dx
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x254]
cmp eax, edx
ja 0x48eee3
mov dword [esp + 4], eax
lea ecx, [ebp - 0x258]
mov dword [esp], esi
call fcn.004e3cb0
sub esp, 8
mov dword [esp], esi
call sub.libstdc_6.dll_operator_delete___void_
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x48e0b8
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
lea eax, [ebp - 0x290]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x258]
mov dword [esp], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x308]
call eax
test eax, eax
jne 0x48eaa0
mov eax, dword [ebp - 0x290]
cmp dword [eax + 0xc], 2
mov dword [esp], eax
sete dl
mov eax, dword [ebp - 0x30c]
mov esi, edx
call eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x2f8]
je 0x48e127
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x2c0]
lea edi, [ebp - 0x2b8]
cmp eax, edi
je 0x48e13f
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, esi
test al, al
je 0x48db99
mov eax, dword [ebx + 0x18]
call fcn.0048cea0
mov edi, dword [ebp - 0x2f4]
mov eax, dword [ebx + 0xd8]
xor ecx, ecx
mov dword [esp], 0
mov edx, 3
mov dword [esp + 4], edi
call fcn.0048d250
mov dword [esp], 0
call sub.msvcrt.dll_time
mov ecx, 0xd
mov dword [ebx + 0x4c], 0
cdq
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], edx
mov dword [ebp - 0x2fc], edx
lea edx, [ebp - 0x250]
mov dword [ebp - 0x300], eax
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x50]
mov dword [esp + 8], 0x104
mov dword [ebp - 0x258], 0x3c
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x24c], str.runas
mov dword [ebp - 0x254], 0x40
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
jne 0x48e5f0
mov byte [esp + 8], 0
lea eax, [ebp - 0x2d0]
lea ecx, [ebp - 0x2d8]
mov dword [esp + 4], 0xc8218f
mov dword [esp], 0xc8218f
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x2d8], eax
call fcn.005465a0
lea eax, [ebp - 0x2a0]
sub esp, 0xc
lea esi, [ebp - 0x2a8]
mov dword [ebp - 0x2f0], eax
mov byte [esp + 8], 0
mov eax, dword [ebp - 0x2f0]
mov ecx, esi
mov dword [esp + 4], 0xc82258
mov dword [esp], str._adminoption_1__updateyes__instdir
mov dword [ebp - 0x2a8], eax
call fcn.005465a0
sub esp, 0xc
cmp dword [ebp - 0x2a4], 0x7fffffff
je 0x48eeb3
mov dword [esp + 4], 1
mov ecx, esi
mov dword [esp], 0xc82259
call fcn.004e3cf8
mov eax, dword [ebp - 0x2d4]
sub esp, 8
mov ecx, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2d8]
mov dword [esp], eax
call fcn.004e3cf8
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2a4]
sub esp, 8
cmp eax, 1
jbe 0x48eea7
mov dword [esp + 4], 2
mov ecx, esi
mov dword [esp], 0xc8225b
call fcn.004e3cf8
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2a4]
sub esp, 8
cmp eax, 3
jbe 0x48ee9b
mov dword [esp + 4], 4
mov ecx, esi
mov dword [esp], str._D_
call fcn.004e3cf8
mov eax, dword [ebp - 0x2d4]
sub esp, 8
mov ecx, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2d8]
mov dword [esp], eax
call fcn.004e3cf8
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2a4]
sub esp, 8
cmp eax, 1
jbe 0x48ee8f
mov dword [esp + 4], 2
mov ecx, esi
mov dword [esp], 0xc8225b
call fcn.004e3cf8
mov edx, dword [ebp - 0x304]
sub esp, 8
test edx, edx
jne 0x48e38d
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2a4]
cmp eax, 0xe
jbe 0x48eecb
mov dword [esp + 4], 0xf
mov ecx, esi
mov dword [esp], str.__runAsNonAdmin
call fcn.004e3cf8
sub esp, 8
lea edi, [ebx + 8]
lea esi, [ebx + 0x70]
mov dword [ebx + 0x4c], 0
mov eax, dword [ebp - 0x2a8]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [ebp - 0x244], eax
call fcn.00493c50
lea eax, [ebp - 0x258]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
sub esp, 4
test eax, eax
jne 0x48e9a0
mov dword [esp], 0
call sub.msvcrt.dll_time
mov edi, dword [ebp - 0x2f4]
mov ecx, 3
cdq
sub eax, dword [ebp - 0x300]
sbb edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2fc], edx
fild qword [ebp - 0x300]
mov edx, 4
mov dword [esp + 4], edi
fstp dword [esp]
mov eax, dword [ebx + 0xd8]
call fcn.0048d250
mov eax, dword [ebx + 0xd8]
test eax, eax
je 0x48e5bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x4c7
je 0x48eab0
cmp eax, 2
je 0x48edf0
mov byte [esp + 8], 0
lea edi, [ebp - 0x290]
lea eax, [ebp - 0x288]
mov dword [esp + 4], 0xc822ed
mov ecx, edi
mov dword [esp], str.Setup_package_error_code_is
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x290], eax
call fcn.005465a0
sub esp, 0xc
lea eax, [ebp - 0x11c]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0xc822ee
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x48ce80
mov dword [esp], eax
call fcn.0053cb70
mov eax, dword [ebp - 0x118]
mov ecx, edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.004e3cf8
mov eax, dword [ebp - 0x11c]
lea edi, [ebp - 0x114]
sub esp, 8
mov dword [ebp - 0x300], edi
cmp eax, edi
je 0x48e4de
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov byte [esp + 8], 0
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc8218f
mov dword [esp], 0xc8218f
mov dword [ebp - 0x11c], eax
call fcn.005465a0
mov edx, dword [ebp - 0x290]
lea edi, [ebp - 0x214]
sub esp, 0xc
mov eax, 0xffffffff
mov dword [ebp - 0x21c], edi
test edx, edx
je 0x48e53d
mov dword [esp], edx
mov dword [ebp - 0x304], edx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x304]
add eax, edx
mov byte [esp + 8], 0
lea esi, [ebp - 0x21c]
mov dword [esp + 4], eax
mov ecx, esi
mov dword [esp], edx
call fcn.005465a0
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
mov ecx, 2
mov edx, esi
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
mov dword [esp], ebx
call fcn.0048d2f0
mov eax, dword [ebp - 0x21c]
cmp eax, edi
je 0x48e590
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x48e5a6
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x290]
cmp eax, dword [ebp - 0x2f8]
je 0x48e5bc
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov edi, 6
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x2f0]
je 0x48e5d7
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x308]
jne 0x48dd90
jmp 0x48dd98
lea eax, [ebp - 0x2a0]
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2a8], eax
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x48e608
mov ecx, eax
mov byte [esp + 8], 0
lea esi, [ebp - 0x2a8]
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea eax, [ebp - 0x11c]
mov ecx, esi
sbb edx, 3
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.005465a0
sub esp, 0xc
mov eax, esi
call fcn.0048cf90
mov dword [esp + 4], 0xffffffff
mov ecx, esi
lea edi, [ebp - 0x290]
mov dword [esp], 0x5c
call fcn.004e3ef8
mov ecx, dword [ebp - 0x2a4]
lea edx, [ebp - 0x288]
sub esp, 8
mov dword [ebp - 0x2f8], edx
cmp eax, ecx
mov dword [ebp - 0x290], edx
mov edx, dword [ebp - 0x2a8]
cmova eax, ecx
mov byte [esp + 8], 0
mov ecx, edi
mov dword [esp], edx
add eax, edx
mov dword [esp + 4], eax
call fcn.005465a0
sub esp, 0xc
mov eax, dword [ebp - 0x2a8]
mov edx, dword [ebp - 0x290]
cmp edx, dword [ebp - 0x2f8]
je 0x48ed40
mov edi, dword [ebp - 0x288]
mov dword [ebp - 0x308], edi
mov edi, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x2f0]
je 0x48ed00
mov dword [ebp - 0x2a4], edi
mov edi, dword [ebp - 0x308]
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 0x2a0], edi
test eax, eax
je 0x48ed18
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x28c], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x290]
cmp eax, dword [ebp - 0x2f8]
je 0x48e746
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov edi, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x2a8]
cmp byte [eax + edi - 1], 0x5c
je 0x48e7a2
cmp eax, dword [ebp - 0x2f0]
mov edx, 0xf
lea ecx, [edi + 1]
cmovne edx, dword [ebp - 0x2a0]
mov dword [ebp - 0x2f8], ecx
cmp ecx, edx
ja 0x48ea70
mov byte [eax + edi], 0x5c
mov edi, dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2a4], edi
mov byte [eax + edi], 0
mov eax, dword [ebp - 0x2a8]
mov edi, dword [ebp - 0x2a4]
lea edx, [ebp - 0x2d0]
mov dword [ebp - 0x308], edx
mov dword [ebp - 0x2d8], edx
cmp eax, dword [ebp - 0x2f0]
je 0x48ed60
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d4], edi
jmp 0x48e242
lea eax, [ebx + 0x50]
lea esi, [ebx + 0xa0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2f0]
mov ecx, esi
mov dword [esp], eax
call fcn.00493700
sub esp, 8
lea eax, [ebx + 0x88]
mov ecx, esi
mov dword [esp], eax
call fcn.00492830
mov eax, dword [ebp - 0x2f0]
sub esp, 4
lea esi, [ebp - 0x21c]
mov dword [esp + 4], str.Skip_version_
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.0054a860
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x218]
cmp eax, 9
jbe 0x48eed7
mov dword [esp + 4], 0xa
mov ecx, esi
mov dword [esp], str.__by_user.
call fcn.004e3cf8
lea esi, [ebp - 0x114]
lea edx, [eax + 8]
sub esp, 8
mov dword [ebp - 0x11c], esi
mov ecx, dword [eax]
mov dword [ebp - 0x300], esi
cmp ecx, edx
je 0x48edc0
mov dword [ebp - 0x11c], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x114], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x118], ecx
mov dword [eax], edx
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0x11c]
cmp edx, dword [ebp - 0x300]
je 0x48ed95
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x2f0], esi
mov esi, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x2f8]
je 0x48eb62
mov dword [ebp - 0x254], esi
mov esi, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x250], esi
test eax, eax
je 0x48eb7a
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x48e92f
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x214]
cmp eax, edx
je 0x48e947
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov byte [esp + 8], 0
mov esi, dword [ebp - 0x300]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc8218f
mov dword [esp], 0xc8218f
mov dword [ebp - 0x11c], esi
call fcn.005465a0
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
xor ecx, ecx
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
lea edx, [ebp - 0x258]
mov dword [esp], ebx
call fcn.0048d2f0
jmp 0x48dd70
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x2fc]
mov dword [ebx + 0x4c], eax
mov eax, dword [ebp - 0x300]
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x68], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00493c50
xor edi, edi
jmp 0x48e5c1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
lea eax, [ebp - 0x2dc]
lea edi, [ebp - 0x2e4]
mov dword [ebp - 0x2e4], 0
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x2e0]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2e0], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call esi
mov eax, dword [ebp - 0x2e4]
sub esp, 0x1c
test eax, eax
jne 0x48ebd0
mov eax, dword [ebp - 0x2c0]
lea edi, [ebp - 0x2b8]
cmp eax, edi
je 0x48db99
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
jmp 0x48db99
mov dword [esp + 0xc], 1
mov ecx, esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.004e3ce0
sub esp, 0x10
mov eax, dword [ebp - 0x2a8]
jmp 0x48e77c
xor esi, esi
jmp 0x48e105
mov byte [esp + 8], 0
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc8218f
mov dword [esp], 0xc8218f
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x11c], eax
call fcn.005465a0
sub esp, 0xc
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x214]
mov byte [esp + 8], 0
mov ecx, esi
mov dword [esp + 4], 0xc822a6
mov dword [esp], str.Setup_package_elevation_permission_denied_by_user.
mov dword [ebp - 0x21c], edi
call fcn.005465a0
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
mov ecx, 2
mov edx, esi
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
mov dword [esp], ebx
call fcn.0048d2f0
mov eax, dword [ebp - 0x21c]
cmp eax, edi
je 0x48eb4b
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
jne 0x48e5b4
jmp 0x48e5bc
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x300], eax
jmp 0x48e90c
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], ecx
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x300], eax
jmp 0x48dce1
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x2e0]
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov dword [ebp - 0x2f8], eax
lea edx, [ebp - 0x2dc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x300]
mov dword [esp + 0x18], edx
lea edx, [ebp - 0x2e0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp], 0
call esi
sub esp, 0x1c
test eax, eax
je 0x48ed35
mov eax, dword [ebp - 0x300]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
sub esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48ed35
mov dword [ebp - 0x11c], 0
mov ecx, 0x500
mov word [ebp - 0x118], cx
mov edi, dword [esi]
test edi, edi
je 0x48ee7e
mov eax, 1
test eax, eax
sete al
mov esi, eax
mov eax, dword [ebp - 0x300]
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x2f8]
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete___void_
jmp 0x48e127
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x258]
mov dword [esp], eax
call fcn.004e3cf0
mov eax, dword [ebp - 0x11c]
sub esp, 4
jmp 0x48dce1
mov ecx, dword [eax + 8]
mov dword [ebp - 0x114], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x110], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10c], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x108], ecx
jmp 0x48dc63
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x2f8], eax
jmp 0x48e723
xor esi, esi
jmp 0x48ec84
mov dword [esp], edi
mov ecx, esi
call fcn.004e3cf0
mov eax, dword [ebp - 0x290]
sub esp, 4
jmp 0x48e723
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2c4], eax
jmp 0x48e7d2
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x258]
mov dword [esp], eax
call fcn.004e3cf0
mov eax, dword [ebp - 0x11c]
sub esp, 4
jmp 0x48e90c
mov ecx, dword [eax + 8]
mov dword [ebp - 0x114], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x110], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10c], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x108], ecx
jmp 0x48e88e
mov byte [esp + 8], 0
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0xc8218f
mov dword [esp], 0xc8218f
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x11c], eax
call fcn.005465a0
sub esp, 0xc
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x214]
mov byte [esp + 8], 0
mov ecx, esi
mov dword [esp + 4], 0xc822d0
mov dword [esp], str.Setup_package_file_to_execute_not_found.
mov dword [ebp - 0x21c], edi
call fcn.005465a0
mov eax, dword [ebx + 0xd8]
sub esp, 0xc
mov ecx, 2
mov edx, esi
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x2f4]
mov dword [esp], ebx
call fcn.0048d2f0
jmp 0x48eb39
cmp word [esi + 4], 0x500
jne 0x48ec78
jmp 0x48ec7d
mov dword [esp], 0xc82190
call fcn.004e3bd8
mov dword [esp], 0xc82190
call fcn.004e3bd8
mov dword [esp], 0xc82190
call fcn.004e3bd8
mov dword [esp], 0xc82190
call fcn.004e3bd8
mov dword [esp], 0xc82190
call fcn.004e3bd8
mov dword [esp], 0xc82190
call fcn.004e3bd8
mov dword [esp], 0xc82190
call fcn.004e3bd8
mov dword [esp], 0xc82190
call fcn.004e3bd8
mov ebx, eax
jmp 0x54fc28
mov eax, dword [ebp - 0x2c0]
lea edi, [ebp - 0x2b8]
cmp eax, edi
jne 0x54fc20
jmp 0x54fc28
call sub.libstdc_6.dll___cxa_throw_bad_array_new_length
mov ebx, eax
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x2f8]
je 0x54fd56
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x300]
je 0x54fd20
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
jmp 0x54fd20