Function at 0x51c720
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2fc]
sub esp, 0x2fc
push 0xffffffffffffffff
push 0x554723
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x58bb30]
xor eax, ebp
mov dword [ebp + 0x2f8], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x304]
call fcn.004fb230
push 0x2018
push 0
push 0x60fa70
call fcn.00531c60
add esp, 0xc
push 0
push 0x71
push 0x70
push 0x6f
push str.WizardLogo.png
push 1
call fcn.004d9dc0
mov dword [0x60fa68], eax
mov ecx, 0x5c7968
mov eax, dword [0x5d2758]
push 1
mov dword [ebp + 0x224], str.WIZARDCMD
mov dword [ebp + 0x230], 0x51d470
mov dword [ebp + 0x25c], str.WIZARDARC
mov dword [ebp + 0x268], 0x51cf20
mov dword [ebp + 0x294], str.WIZARDEXTR
mov dword [ebp + 0x2a0], 0x51d740
mov dword [ebp + 0x2cc], str.WIZARDADDOPT
mov dword [ebp + 0x2d8], 0x51ccb0
mov dword [ebp - 0x40], 0x34
mov dword [ebp - 0x3c], 0x22a
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], eax
call fcn.004da130
cmp byte [0x5933f4], 0
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x218]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], eax
je 0x51c854
push 0x800
push 0x60fa74
mov ecx, 0x5c2bd0
call fcn.00409950
mov dword [0x60fa70], 0
mov dword [ebp - 0x24], 2
mov eax, dword [0x5d2758]
mov ecx, 0x5d27b8
mov dword [ebp + 0x220], eax
mov dword [ebp + 0x258], eax
mov dword [ebp + 0x290], eax
mov dword [ebp + 0x2c8], eax
lea eax, [ebp + 0x218]
push 4
push eax
lea eax, [ebp - 0x40]
mov dword [ebp + 0x218], 0x38
push eax
mov dword [ebp + 0x21c], 0x20
mov dword [ebp + 0x250], 0x38
mov dword [ebp + 0x254], 0x20
mov dword [ebp + 0x288], 0x38
mov dword [ebp + 0x28c], 0x20
mov dword [ebp + 0x2c0], 0x38
mov dword [ebp + 0x2c4], 0x20
call fcn.004b5cc0
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov esi, eax
mov ecx, 0x5d27b8
push 4
lea eax, [ebp + 0x218]
test esi, esi
push eax
setg bl
call fcn.004b5c70
test esi, esi
jle 0x51cc79
mov eax, dword [0x60fa70]
sub eax, 0
je 0x51ca9d
sub eax, 1
je 0x51c920
sub eax, 1
jne 0x51cc79
push 0x60fa74
call fcn.004a2d90
push 0x800
cmp eax, 0x60fa74
jne 0x51c965
push 0x5b232a
call fcn.00456dd0
push 0x800
push 0x5b232a
call fcn.004a0eb0
push 0x800
push 0x60fa74
push 0x5b232a
call fcn.004bd030
jmp 0x51c974
push 0x60fa74
push 0x5b232a
call fcn.004bd090
cmp byte [0x611a77], 0
mov al, byte [0x611a75]
mov dword [0x5aaf40], 3
mov dword [0x5aaf3c], 2
mov byte [0x5aaf6e], al
je 0x51c9a5
mov dword [0x5aaf10], 2
cmp dword [0x60fa70], 2
mov eax, dword [0x611a78]
mov ecx, dword [0x611a7c]
mov dword [0x5aaf48], eax
mov dword [0x5aaf4c], ecx
jne 0x51c9fd
push 0x5b232a
call fcn.00490c30
test al, al
je 0x51c9fd
push 0
push 1
push 0x5b232a
mov ecx, 0x5c2bd0
call fcn.0040aa90
cmp eax, 1
jne 0x51ca80
mov eax, dword [0x5c2bd4]
mov dword [0x5ad2c8], eax
jmp 0x51ca80
cmp byte [0x611a76], 0
je 0x51ca43
push 0x557920
push 0x5b232a
call fcn.004a0ef0
test al, al
jne 0x51ca2d
push 0x800
push str..exe
push 0x5b232a
call fcn.004bd030
push 0x800
push 0x5578cc
push 0x5a4ee8
call fcn.004bd090
jmp 0x51ca80
cmp dword [0x5ad2c8], 0
mov esi, 0x557b94
je 0x51ca56
mov esi, str..zip
lea eax, [esi + 2]
push eax
push 0x5b232a
call fcn.004a0ef0
test al, al
jne 0x51ca78
push 0x800
push esi
push 0x5b232a
call fcn.004bd030
xor eax, eax
mov word [0x5a4ee8], ax
push 1
push 0x5b232a
call fcn.004a2ac0
push 0
mov ecx, 0x5c2bd0
call fcn.00408310
jmp 0x51cc79
push 0
push 1
push 0x60fa74
mov ecx, 0x5c2bd0
call fcn.0040aa90
cmp eax, 0xffffffff
jne 0x51cac9
push 0x60fa74
mov ecx, 0x5d281c
call fcn.004878a0
jmp 0x51cc79
cmp eax, 1
jne 0x51cc79
push 0
call fcn.004f7750
push 0x800
push 0x5a5eee
push 0x610a74
mov ecx, 0x5c5810
call fcn.0045d540
push 0x5a5eee
call fcn.00490c30
test al, al
jne 0x51cb39
push 0
push 0
push 0x5a5eee
call fcn.00490510
test al, al
jne 0x51cb39
push 0x5a5eee
push 0x1f7
call fcn.004b68d0
push eax
call fcn.00502bd0
add esp, 8
mov ecx, 0x5d281c
call fcn.00487dd0
jmp 0x51cc79
xor eax, eax
mov dword [ebp + 0x124], 0
mov dword [ebp + 0x134], 0
mov dword [ebp + 0x138], 0
mov dword [ebp + 0x134], 0
mov dword [ebp + 0x138], 7
mov word [ebp + 0x124], ax
mov dword [ebp - 4], eax
mov dword [ebp + 0x140], eax
mov dword [ebp + 0x144], eax
mov dword [ebp - 4], 2
lea eax, [ebp]
push eax
mov ecx, 0x5c2bd0
call fcn.0040a190
push 0x800
push 0x5b232a
mov ecx, 0x5c2bd0
call fcn.00409950
mov eax, dword [ebp + 0x168]
mov ecx, 0x5b332c
mov dword [0x5ad2c8], eax
call fcn.004bd370
push 0x5578cc
mov ecx, 0x5b332c
call fcn.004bd180
push 0
push 0
mov ecx, 0x5c2bd0
mov byte [0x5ab1e1], 0
call fcn.00409410
cmp word [0x610a74], 0
je 0x51cbfe
push 0x800
push 0x5a5eee
call fcn.004a0eb0
push 1
push 0x557718
push 0
push 0x5a5eee
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x138]
cmp ecx, 8
jb 0x51cc5c
mov edx, dword [ebp + 0x124]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x51cc52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x51cc9f
push ecx
push edx
call fcn.0052f4fd
add esp, 8
xor eax, eax
mov dword [ebp + 0x134], 0
mov dword [ebp + 0x138], 7
mov word [ebp + 0x124], ax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x2f8]
xor ecx, ebp
call fcn.0052f708
lea esp, [ebp + 0x2fc]
pop ebp
ret 4
call fcn.00533acf
int3