Function at 0x1000f590
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x3044
call fcn.100378e0
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x3040], eax
push ebx
push esi
push edi
xor eax, eax
push 0xffe
push eax
lea ecx, [esp + 0x2056]
push ecx
mov word [esp + 0x2058], ax
call sub.MSVCR100.dll_memset
xor edx, edx
push 0xffe
push edx
lea eax, [esp + 0x62]
push eax
mov word [esp + 0x64], dx
call sub.MSVCR100.dll_memset
push 0
push 1
lea ecx, [esp + 0x206c]
push 0x800
push ecx
call sym.deploy.dll_getLatestInstalledVersion
push 0
lea edx, [esp + 0x2078]
push edx
lea eax, [esp + 0x7c]
push 0x800
push eax
call fcn.10015430
add esp, 0x38
test eax, eax
jne 0x1000f64d
push 0x800
lea ecx, [esp + 0x50]
push ecx
push 1
push 0x1003bb30
call fcn.10004030
lea edi, [esp + 0x5c]
add esp, 0x10
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1000f635
mov ecx, 7
mov esi, 0x1003d1b0
jmp 0x1000f66a
lea edi, [esp + 0x4c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1000f654
mov ecx, 9
mov esi, str._bin_ssvagent.exe
lea edx, [esp + 0x204c]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.100041f0
mov bl, byte [esp + 0x3060]
add esp, 4
test eax, eax
je 0x1000f6aa
test bl, bl
je 0x1000f6ae
mov eax, 2
mov ecx, dword [esp + 0x304c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003779c
add esp, 0x3044
ret 0xc
test bl, bl
je 0x1000f68b
push 0x3c
lea eax, [esp + 0x14]
push 0
push eax
call sub.MSVCR100.dll_memset
xor ecx, ecx
push 0xffe
push ecx
lea edx, [esp + 0x1062]
push edx
mov dword [esp + 0x28], 0x3c
mov word [esp + 0x1064], cx
call sub.MSVCR100.dll_memset
lea edi, [esp + 0x1064]
add esp, 0x18
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1000f6f0
mov ecx, 0xc
mov esi, str._high__jpisetup__fullreg
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.100034e0
mov dword [esp + 0x1c], str.runas
test eax, eax
jne 0x1000f723
mov dword [esp + 0x1c], str.open
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x104c]
add eax, 0xfffffffe
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], 0x40
test bl, bl
je 0x1000f780
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x1000f750
mov ecx, dword [str.__new]
mov edx, dword [0x1003d150]
mov dword [eax], ecx
mov ecx, dword [0x1003d154]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
jmp 0x1000f7a6
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x1000f780
mov edx, dword [str.__old]
mov ecx, dword [0x1003d144]
mov dword [eax], edx
mov edx, dword [0x1003d148]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea ecx, [esp + 0x10]
lea eax, [esp + 0x104c]
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1000f7fd
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], 1
test eax, eax
je 0x1000f7f4
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x48]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
jmp 0x1000f690
mov eax, 1
jmp 0x1000f690