Function at 0x10002767
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd78
mov eax, dword [0x1002f004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0xcc]
push 0xc8
push 0
push eax
call fcn.100056d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.SfxCA__d
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.10003c01
add esp, 0x10
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xd34]
push 1
push eax
call fcn.10002147
lea ecx, [ebp - 0xd34]
call fcn.10002324
test eax, eax
je 0x100027de
mov esi, str.Failed_to_create_communication_pipe_for_new_CA_process._Error_code:__d
jmp 0x1000294d
lea ecx, [ebp - 0xd34]
call fcn.10002d75
test eax, eax
je 0x100027f7
mov esi, str.Failed_to_open_communication_pipe_for_new_CA_process._Error_code:__d
jmp 0x1000294d
push ebx
push edi
mov edi, 0x208
lea eax, [ebp - 0x4dc]
push edi
push 0
push eax
call fcn.100056d0
add esp, 0xc
lea eax, [ebp - 0x4dc]
mov ebx, 0x104
push ebx
push eax
push dword [0x1002f94c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.100056d0
add esp, 0xc
lea eax, [ebp - 0x2d4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x10019aa4
lea eax, [ebp - 0x2d4]
push ebx
push eax
call fcn.1000a8a0
mov edi, str.rundll32.exe
lea eax, [ebp - 0x2d4]
push edi
push ebx
push eax
call fcn.1000a8a0
push 0x800
xor ebx, ebx
lea eax, [ebp - 0xcdc]
push ebx
push eax
call fcn.100056d0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xcc]
push eax
push str.zzzzInvokeManagedCustomActionOutOfProc
lea eax, [ebp - 0x4dc]
push eax
push edi
push str._s___s___s__s__d__s
lea eax, [ebp - 0xcdc]
push 0x400
push eax
call fcn.10003c01
add esp, 0x48
lea eax, [ebp - 0xd78]
push 0x44
pop edx
mov ecx, edx
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100028be
push 0x10
mov dword [ebp - 0xd78], edx
lea eax, [ebp - 0xcf0]
pop ecx
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100028d5
lea eax, [ebp - 0xcf0]
push eax
lea eax, [ebp - 0xd78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop ebx
test eax, eax
jne 0x10002912
mov esi, str.Failed_to_create_new_CA_process_via_RUNDLL32._Error_code:__d
jmp 0x10002947
push 0xffffffffffffffff
push dword [ebp - 0xcf0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000292b
mov esi, str.Failed_to_wait_for_CA_process._Error_code:__d
jmp 0x10002947
lea eax, [ebp - 0xce0]
push eax
push dword [ebp - 0xcf0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10002951
mov esi, str.Failed_to_get_exit_code_of_CA_process._Error_code:__d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
jmp 0x10002965
cmp dword [ebp - 0xce0], 0
je 0x10002977
push dword [ebp - 0xce0]
push str.RUNDLL32_returned_error_code:__d
push dword [ebp + 8]
call fcn.1000400a
add esp, 0xc
mov esi, 0x643
jmp 0x1000299e
push dword [ebp - 0xcec]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xcf0]
call esi
lea ecx, [ebp - 0xd34]
call fcn.10002dec
mov esi, dword [ebp - 0xd30]
lea ecx, [ebp - 0xd34]
call fcn.100021b5
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10004903
leave
ret 8