Function at 0x10002756
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd78
mov eax, dword [0x1002c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0xcc]
push 0xc8
push 0
push eax
call fcn.100056a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.SfxCA__d
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.10003bf0
add esp, 0x10
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xd34]
push 1
push eax
call fcn.10002136
lea ecx, [ebp - 0xd34]
call fcn.10002313
test eax, eax
je 0x100027cd
mov esi, str.Failed_to_create_communication_pipe_for_new_CA_process._Error_code:__d
jmp 0x1000293c
lea ecx, [ebp - 0xd34]
call fcn.10002d64
test eax, eax
je 0x100027e6
mov esi, str.Failed_to_open_communication_pipe_for_new_CA_process._Error_code:__d
jmp 0x1000293c
push ebx
push edi
mov edi, 0x208
lea eax, [ebp - 0x4dc]
push edi
push 0
push eax
call fcn.100056a0
add esp, 0xc
lea eax, [ebp - 0x4dc]
mov ebx, 0x104
push ebx
push eax
push dword [0x1002c91c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.100056a0
add esp, 0xc
lea eax, [ebp - 0x2d4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x10016aa4
lea eax, [ebp - 0x2d4]
push ebx
push eax
call fcn.10008fc9
mov edi, str.rundll32.exe
lea eax, [ebp - 0x2d4]
push edi
push ebx
push eax
call fcn.10008fc9
push 0x800
xor ebx, ebx
lea eax, [ebp - 0xcdc]
push ebx
push eax
call fcn.100056a0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xcc]
push eax
push str.zzzzInvokeManagedCustomActionOutOfProc
lea eax, [ebp - 0x4dc]
push eax
push edi
push str._s___s___s__s__d__s
lea eax, [ebp - 0xcdc]
push 0x400
push eax
call fcn.10003bf0
add esp, 0x48
lea eax, [ebp - 0xd78]
push 0x44
pop edx
mov ecx, edx
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100028ad
push 0x10
mov dword [ebp - 0xd78], edx
lea eax, [ebp - 0xcf0]
pop ecx
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100028c4
lea eax, [ebp - 0xcf0]
push eax
lea eax, [ebp - 0xd78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop ebx
test eax, eax
jne 0x10002901
mov esi, str.Failed_to_create_new_CA_process_via_RUNDLL32._Error_code:__d
jmp 0x10002936
push 0xffffffffffffffff
push dword [ebp - 0xcf0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000291a
mov esi, str.Failed_to_wait_for_CA_process._Error_code:__d
jmp 0x10002936
lea eax, [ebp - 0xce0]
push eax
push dword [ebp - 0xcf0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10002940
mov esi, str.Failed_to_get_exit_code_of_CA_process._Error_code:__d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
jmp 0x10002954
cmp dword [ebp - 0xce0], 0
je 0x10002966
push dword [ebp - 0xce0]
push str.RUNDLL32_returned_error_code:__d
push dword [ebp + 8]
call fcn.10003ff9
add esp, 0xc
mov esi, 0x643
jmp 0x1000298d
push dword [ebp - 0xcec]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xcf0]
call esi
lea ecx, [ebp - 0xd34]
call fcn.10002ddb
mov esi, dword [ebp - 0xd30]
lea ecx, [ebp - 0xd34]
call fcn.100021a4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100048e3
leave
ret 8