Function at 0x68f20781
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x4a4
mov eax, 0x68f59224
call fcn.68f54d01
mov esi, ecx
mov dword [ebp - 0x44c], esi
xor ebx, ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 4], ebx
push ebx
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCCriticalErrorInfo::StartErrorBlock_bool_
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
lea eax, [ebp - 0x428]
push eax
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x68f207d2
push eax
push 0x2e737a38
call fcn.68ef1014
mov dword [ebp - 0x438], ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x444], ebx
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x444]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__
mov byte [ebp - 4], 4
push dword [ebp - 0x444]
push str._sRundll32.exe
lea eax, [ebp - 0x438]
push eax
call sym.GrooveUtil.DLL_public:_long_int___cdecl_GCStr::Format_wchar_t_const__
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x444]
call fcn.68ef1154
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [0x68fa7f94]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x68f20847
push 0x2e736c38
call fcn.68ef2114
lea eax, [ebp - 0x434]
push eax
call fcn.68f20b24
mov eax, dword [eax]
mov dword [ebp - 0x43c], eax
mov byte [ebp - 4], 5
push dword [ebp - 0x43c]
lea eax, [ebp - 0x454]
push eax
call fcn.68f131d7
mov byte [ebp - 4], 6
mov dword [ebp - 0x440], ebx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x43c]
cmp eax, ebx
jne 0x68f2088e
mov eax, dword [sym.GrooveUtil.DLL_wchar_t_const__const_raw_GCStr::SAFE_EMPTY_STRING_CBSTR]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x438]
push str.__s____s__GetResourceModulePath__s
lea eax, [ebp - 0x440]
push eax
call sym.GrooveUtil.DLL_public:_long_int___cdecl_GCStr::Format_wchar_t_const__
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x448]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
mov byte [ebp - 4], 8
push 0x44
pop edi
push edi
push ebx
lea eax, [ebp - 0x4b0]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x4b0], edi
xor eax, eax
lea edi, [ebp - 0x464]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x4b0]
push eax
push dword [ebp - 0x448]
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x440]
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x68f20932
push 0x2e736c39
call fcn.68ef2114
push ebx
push dword [ebp - 0x460]
lea eax, [ebp - 0x434]
call fcn.68f03aff
mov byte [ebp - 4], 9
xor edi, edi
inc edi
push edi
push dword [ebp - 0x464]
lea eax, [ebp - 0x430]
call fcn.68f03aff
mov byte [ebp - 4], 0xa
push 0xffffffffffffffff
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x80004005
push 0x2e736c36
cmp eax, ebx
sete al
push eax
call fcn.68ef3ed8
mov eax, dword [ebp - 0x450]
lea ecx, [eax + 4]
neg eax
sbb eax, eax
and eax, ecx
push eax
lea ecx, [ebp - 0x42c]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__
mov byte [ebp - 4], 9
cmp dword [ebp - 0x430], ebx
je 0x68f209bd
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x430], ebx
mov byte [ebp - 4], 8
cmp dword [ebp - 0x434], ebx
je 0x68f209db
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x434], ebx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x448]
call fcn.68ef1154
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x440]
call fcn.68ef1154
mov byte [ebp - 4], 5
lea eax, [ebp - 0x454]
push eax
call fcn.68f1339c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x43c]
call fcn.68ef1154
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x438]
call fcn.68ef1154
mov dword [ebp - 4], edi
jmp 0x68f20a3f
mov byte [ebp - 4], bl
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCCriticalErrorInfo::EndErrorBlock_void_
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x42c], ebx
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.68ef1154
mov eax, esi
call fcn.68f54d5d
ret