Function at 0x68f13664
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5fd63
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x490], eax
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x4a8]
mov dword fs:[0], eax
mov ebx, ecx
push str.F275ED8E_232B_4810_BB6F_7E8D75505DBC
mov dword [esp + 0x1c], ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_FindAtomW]
test ax, ax
je 0x68f13714
push 0x17
mov esi, 0x68f79b20
push esi
push 0x68f79b10
lea ecx, [esp + 0x20]
call sym.GrooveUtil.DLL_protected:_void___thiscall_GCIPtrBase::CreateInstanceNoRelease_struct__GUID_const___struct__GUID_const___unsigned_long_int_
mov dword [esp + 0x4b0], 2
push dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push edi
push eax
mov ebx, eax
call dword [ecx + 0x2c]
test eax, eax
jge 0x68f136fa
push esi
push ebx
push eax
call fcn.68ef1079
or dword [esp + 0x4b0], 0xffffffff
lea ecx, [esp + 0x14]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCAnyIPtr::destructor_void_
mov eax, dword [esp + 0x18]
jmp 0x68f139cd
lea eax, [esp + 0x294]
push eax
xor esi, esi
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
jge 0x68f13738
push eax
push 0x2e733079
call fcn.68ef1014
mov dword [esp + 0x1c], esi
mov dword [esp + 0x4b0], 5
lea eax, [esp + 0x294]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__
mov byte [esp + 0x4b0], 6
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push str._sRundll32.exe
push eax
call sym.GrooveUtil.DLL_public:_long_int___cdecl_GCStr::Format_wchar_t_const__
add esp, 0xc
mov byte [esp + 0x4b0], 5
cmp dword [esp + 0x10], esi
je 0x68f13791
lea ecx, [esp + 0x10]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
push 0x104
lea eax, [esp + 0x90]
push eax
push dword [0x68fa7f94]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x68f137b8
push 0x2e733031
call fcn.68ef2114
lea eax, [esp + 0x28]
push eax
call fcn.68f135f9
mov eax, dword [eax]
mov dword [esp + 0x20], eax
mov byte [esp + 0x4b0], 7
push dword [esp + 0x20]
lea eax, [esp + 0x30]
push eax
call fcn.68f131d7
mov byte [esp + 0x4b0], 8
mov dword [esp + 0x24], esi
mov byte [esp + 0x4b0], 9
cmp edi, esi
mov eax, dword [sym.GrooveUtil.DLL_wchar_t_const__const_raw_GCStr::SAFE_EMPTY_STRING_CBSTR]
jne 0x68f137fd
mov edi, eax
cmp dword [esp + 0x20], esi
je 0x68f13807
mov eax, dword [esp + 0x20]
push edi
push eax
lea eax, [esp + 0x94]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x34]
push str.__s____s__GetHelpFilePath__s__s
push eax
call sym.GrooveUtil.DLL_public:_long_int___cdecl_GCStr::Format_wchar_t_const__
add esp, 0x18
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x18]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
mov byte [esp + 0x4b0], 0xa
push 0x44
pop edi
push edi
lea eax, [esp + 0x48]
push esi
push eax
call sub.MSVCR80.dll_memset
mov dword [esp + 0x50], edi
xor eax, eax
lea edi, [esp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x1c]
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x44]
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x68f1389d
push 0x2e733032
call fcn.68ef2114
push esi
push dword [esp + 0x3c]
lea eax, [esp + 0x20]
call fcn.68f03aff
mov byte [esp + 0x4b0], 0xb
push 1
push dword [esp + 0x38]
lea eax, [esp + 0x18]
call fcn.68f03aff
mov byte [esp + 0x4b0], 0xc
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
sete al
push 0x80004005
push 0x2e73307a
push eax
call fcn.68ef3ed8
mov eax, dword [esp + 0x30]
lea ecx, [eax + 4]
neg eax
sbb eax, eax
and eax, ecx
push eax
lea ecx, [esp + 0x2c]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
mov byte [esp + 0x4b0], 0xd
mov ecx, dword [eax]
mov dword [eax], esi
mov dword [ebx], ecx
mov byte [esp + 0x4b0], 0xc
cmp dword [esp + 0x28], esi
je 0x68f13927
lea ecx, [esp + 0x28]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov byte [esp + 0x4b0], 0xb
cmp dword [esp + 0x10], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x68f13945
push dword [esp + 0x10]
call edi
mov dword [esp + 0x10], esi
mov byte [esp + 0x4b0], 0xa
cmp dword [esp + 0x18], esi
je 0x68f1395d
push dword [esp + 0x18]
call edi
mov dword [esp + 0x18], esi
mov byte [esp + 0x4b0], 9
cmp dword [esp + 0x14], esi
je 0x68f13974
lea ecx, [esp + 0x14]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov byte [esp + 0x4b0], 8
cmp dword [esp + 0x24], esi
je 0x68f1398b
lea ecx, [esp + 0x24]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov byte [esp + 0x4b0], 7
lea eax, [esp + 0x2c]
push eax
call fcn.68f1339c
mov byte [esp + 0x4b0], 5
cmp dword [esp + 0x20], esi
je 0x68f139b4
lea ecx, [esp + 0x20]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
or dword [esp + 0x4b0], 0xffffffff
cmp dword [esp + 0x1c], esi
je 0x68f139cb
lea ecx, [esp + 0x1c]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, ebx
mov ecx, dword [esp + 0x4a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x490]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret