Function at 0x1000275c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd78
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0xcc]
push 0xc8
push 0
push eax
call fcn.100056c0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.SfxCA__d
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.10003c13
add esp, 0x10
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xd34]
push 1
push eax
call fcn.10002139
lea ecx, [ebp - 0xd34]
call fcn.10002315
test eax, eax
je 0x100027d7
push eax
push str.Failed_to_create_communication_pipe_for_new_CA_process._Error_code:__d
push dword [ebp + 8]
jmp 0x1000296b
lea ecx, [ebp - 0xd34]
call fcn.10002d84
test eax, eax
je 0x100027ee
push eax
push str.Failed_to_open_communication_pipe_for_new_CA_process._Error_code:__d
jmp 0x100027cf
push ebx
push edi
mov edi, 0x208
lea eax, [ebp - 0x4dc]
push edi
push 0
push eax
call fcn.100056c0
add esp, 0xc
lea eax, [ebp - 0x4dc]
mov ebx, 0x104
push ebx
push eax
push dword [0x1002c91c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.100056c0
add esp, 0xc
lea eax, [ebp - 0x2d4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x10016aa4
lea eax, [ebp - 0x2d4]
push ebx
push eax
call fcn.10008433
mov edi, str.rundll32.exe
lea eax, [ebp - 0x2d4]
push edi
push ebx
push eax
call fcn.10008433
push 0x800
xor ebx, ebx
lea eax, [ebp - 0xcdc]
push ebx
push eax
call fcn.100056c0
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xcc]
push esi
push eax
push str.zzzzInvokeManagedCustomActionOutOfProc
lea eax, [ebp - 0x4dc]
push eax
push edi
push str._s___s___s__s__d__s
lea eax, [ebp - 0xcdc]
push 0x400
push eax
call fcn.10003c13
add esp, 0x48
lea eax, [ebp - 0xd78]
push 0x44
pop edx
mov ecx, edx
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100028b6
push 0x10
mov dword [ebp - 0xd78], edx
lea eax, [ebp - 0xcf0]
pop ecx
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100028cd
lea eax, [ebp - 0xcf0]
push eax
lea eax, [ebp - 0xd78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop ebx
test eax, eax
jne 0x10002911
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_new_CA_process_via_RUNDLL32._Error_code:__d
jmp 0x1000296a
push 0xffffffffffffffff
push dword [ebp - 0xcf0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10002931
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_wait_for_CA_process._Error_code:__d
jmp 0x1000296a
lea eax, [ebp - 0xce0]
push eax
push dword [ebp - 0xcf0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10002956
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_exit_code_of_CA_process._Error_code:__d
jmp 0x1000296a
cmp dword [ebp - 0xce0], 0
je 0x1000297a
push dword [ebp - 0xce0]
push str.RUNDLL32_returned_error_code:__d
push esi
call fcn.10004023
add esp, 0xc
mov esi, 0x643
jmp 0x100029a1
push dword [ebp - 0xcec]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xcf0]
call esi
lea ecx, [ebp - 0xd34]
call fcn.10002dfb
mov esi, dword [ebp - 0xd30]
lea ecx, [ebp - 0xd34]
call fcn.100021a7
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10004917
mov esp, ebp
pop ebp
ret 8