Function at 0x6d59f890
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x3044
call fcn.6d5ca7f0
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x3040], eax
push ebx
push esi
push edi
xor eax, eax
push 0xffe
push eax
lea ecx, [esp + 0x2056]
push ecx
mov word [esp + 0x2058], ax
call sub.MSVCR100.dll_memset
xor edx, edx
push 0xffe
push edx
lea eax, [esp + 0x62]
push eax
mov word [esp + 0x64], dx
call sub.MSVCR100.dll_memset
push 0
push 1
lea ecx, [esp + 0x206c]
push 0x800
push ecx
call sym.deploy.dll_getLatestInstalledVersion
push 0
lea edx, [esp + 0x2078]
push edx
lea eax, [esp + 0x7c]
push 0x800
push eax
call fcn.6d5a5ca0
add esp, 0x38
test eax, eax
jne 0x6d59f94d
push 0x800
lea ecx, [esp + 0x50]
push ecx
push 1
push 0x6d5cec6c
call fcn.6d594030
lea edi, [esp + 0x5c]
add esp, 0x10
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x6d59f935
mov ecx, 7
mov esi, 0x6d5d0358
jmp 0x6d59f96a
lea edi, [esp + 0x4c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x6d59f954
mov ecx, 9
mov esi, str._bin_ssvagent.exe
lea edx, [esp + 0x204c]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.6d5941f0
mov bl, byte [esp + 0x3060]
add esp, 4
test eax, eax
je 0x6d59f9aa
test bl, bl
je 0x6d59f9ae
mov eax, 2
mov ecx, dword [esp + 0x304c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x3044
ret 0xc
test bl, bl
je 0x6d59f98b
push 0x3c
lea eax, [esp + 0x14]
push 0
push eax
call sub.MSVCR100.dll_memset
xor ecx, ecx
push 0xffe
push ecx
lea edx, [esp + 0x1062]
push edx
mov dword [esp + 0x28], 0x3c
mov word [esp + 0x1064], cx
call sub.MSVCR100.dll_memset
lea edi, [esp + 0x1064]
add esp, 0x18
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x6d59f9f0
mov ecx, 0xc
mov esi, str._high__jpisetup__fullreg
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.6d5934e0
mov dword [esp + 0x1c], str.runas
test eax, eax
jne 0x6d59fa23
mov dword [esp + 0x1c], str.open
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x104c]
add eax, 0xfffffffe
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], 0x40
test bl, bl
je 0x6d59fa80
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x6d59fa50
mov ecx, dword [str.__new]
mov edx, dword [0x6d5d02f8]
mov dword [eax], ecx
mov ecx, dword [0x6d5d02fc]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
jmp 0x6d59faa6
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x6d59fa80
mov edx, dword [str.__old]
mov ecx, dword [0x6d5d02ec]
mov dword [eax], edx
mov edx, dword [0x6d5d02f0]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea ecx, [esp + 0x10]
lea eax, [esp + 0x104c]
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x6d59fafd
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], 1
test eax, eax
je 0x6d59faf4
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x48]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
jmp 0x6d59f990
mov eax, 1
jmp 0x6d59f990