Function at 0x6d203890
Capabilities:
Create process on windows
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1fd0]
mov eax, 0x2050
call fcn.6d20a9b0
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x1fcc], eax
push ebx
push esi
push edi
mov esi, 0x7ff
xor ebx, ebx
push esi
lea eax, [ebp + 0x17cd]
push ebx
push eax
mov dword [ebp - 0x40], 1
mov byte [ebp + 0x17cc], bl
call fcn.6d20a0b0
push esi
lea eax, [ebp + 0x7cd]
push ebx
push eax
mov byte [ebp + 0x7cc], bl
call fcn.6d20a0b0
push esi
lea eax, [ebp - 0x33]
push ebx
push eax
mov byte [ebp - 0x34], bl
call fcn.6d20a0b0
add esp, 0x24
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push ebx
push 0x6d221b1c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edi, [esi + 1]
test eax, eax
jne 0x6d20398f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x17cc]
push eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], edi
push ebx
jmp 0x6d203979
lea eax, [ebp + 0x17cc]
push eax
push 0x6d221b34
push 0x6d221b4c
lea eax, [ebp - 0x34]
push edi
push eax
call fcn.6d2165d4
lea eax, [ebp + 0x7cc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.6d2165d4
add esp, 0x1c
test eax, eax
jne 0x6d203986
inc dword [ebp - 0x44]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x17cc]
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x6d203932
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x7cc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6d203998
sub eax, edx
je 0x6d203a93
push str._bin_ssvagent.exe
lea eax, [ebp + 0x7cc]
push edi
push eax
call fcn.6d2165d4
push 0x3c
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.6d20a0b0
push esi
lea eax, [ebp + 0xfcd]
push ebx
push eax
mov dword [ebp - 0x80], 0x3c
mov byte [ebp + 0xfcc], bl
call fcn.6d20a0b0
push str._high__jpisetup__new
lea eax, [ebp + 0xfcc]
push edi
push eax
call fcn.6d2165d4
add esp, 0x30
lea eax, [ebp + 0xfcc]
cmp dword [ebp + 0x1fd8], ebx
je 0x6d203a0a
push str.__enablefx
jmp 0x6d203a0f
push str.__disablefx
push edi
push eax
call fcn.6d2165d4
add esp, 0xc
call fcn.6d2165d4
mov dword [ebp - 0x74], str.runas
test eax, eax
jne 0x6d203a30
mov dword [ebp - 0x74], str.open
lea eax, [ebp + 0x7cc]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0xfcc]
mov dword [ebp - 0x6c], eax
xor esi, esi
lea eax, [ebp - 0x80]
inc esi
push eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x7c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x6d203a96
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x48], ebx
je 0x6d203a86
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x38], ebx
sete al
mov dword [ebp - 0x40], eax
jmp 0x6d203a96
mov dword [ebp - 0x40], ebx
mov ecx, dword [ebp + 0x1fcc]
mov eax, dword [ebp - 0x40]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d20a065
add ebp, 0x1fd0
leave
ret