Function at 0x6d6a133c
Capabilities:
Create process on windows
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1fd0]
mov eax, 0x2050
call fcn.6d6a89f0
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x1fcc], eax
push ebx
push esi
push edi
mov esi, 0x7ff
xor ebx, ebx
push esi
lea eax, [ebp + 0x17cd]
push ebx
push eax
mov dword [ebp - 0x40], 1
mov byte [ebp + 0x17cc], bl
call fcn.6d6a8a20
push esi
lea eax, [ebp + 0x7cd]
push ebx
push eax
mov byte [ebp + 0x7cc], bl
call fcn.6d6a8a20
push esi
lea eax, [ebp - 0x33]
push ebx
push eax
mov byte [ebp - 0x34], bl
call fcn.6d6a8a20
add esp, 0x24
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push ebx
push 0x6d6d48cc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edi, [esi + 1]
test eax, eax
jne 0x6d6a143b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x17cc]
push eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], edi
push ebx
jmp 0x6d6a1425
lea eax, [ebp + 0x17cc]
push eax
push 0x6d6d48e4
push 0x6d6d48fc
lea eax, [ebp - 0x34]
push edi
push eax
call fcn.6d6bdb83
lea eax, [ebp + 0x7cc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.6d6bdb83
add esp, 0x1c
test eax, eax
jne 0x6d6a1432
inc dword [ebp - 0x44]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x17cc]
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x6d6a13de
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x7cc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6d6a1444
sub eax, edx
je 0x6d6a153f
push str._bin_ssvagent.exe
lea eax, [ebp + 0x7cc]
push edi
push eax
call fcn.6d6bdb83
push 0x3c
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.6d6a8a20
push esi
lea eax, [ebp + 0xfcd]
push ebx
push eax
mov dword [ebp - 0x80], 0x3c
mov byte [ebp + 0xfcc], bl
call fcn.6d6a8a20
push str._high__jpisetup__new
lea eax, [ebp + 0xfcc]
push edi
push eax
call fcn.6d6bdb83
add esp, 0x30
lea eax, [ebp + 0xfcc]
cmp dword [ebp + 0x1fd8], ebx
je 0x6d6a14b6
push str.__enablefx
jmp 0x6d6a14bb
push str.__disablefx
push edi
push eax
call fcn.6d6bdb83
add esp, 0xc
call fcn.6d6bdb83
mov dword [ebp - 0x74], str.runas
test eax, eax
jne 0x6d6a14dc
mov dword [ebp - 0x74], str.open
lea eax, [ebp + 0x7cc]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0xfcc]
mov dword [ebp - 0x6c], eax
xor esi, esi
lea eax, [ebp - 0x80]
inc esi
push eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x7c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x6d6a1542
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x48], ebx
je 0x6d6a1532
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x38], ebx
sete al
mov dword [ebp - 0x40], eax
jmp 0x6d6a1542
mov dword [ebp - 0x40], ebx
mov ecx, dword [ebp + 0x1fcc]
mov eax, dword [ebp - 0x40]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d6a886c
add ebp, 0x1fd0
leave
ret