Function at 0x4e8340
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2f8
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2f4], eax
push ebx
push esi
mov esi, dword [esp + 0x304]
call fcn.004cad10
push 0x2018
push 0
push 0x5bcc28
call fcn.004fa860
add esp, 0xc
push 0
push 0x71
push 0x70
push 0x6f
push str.WizardLogo.png
push 1
call fcn.004af5d0
mov dword [0x5bcc20], eax
mov ecx, 0x572f10
mov eax, dword [0x57f310]
push 1
mov dword [esp + 0x23c], str.WIZARDCMD
mov dword [esp + 0x248], 0x4e8f20
mov dword [esp + 0x270], str.WIZARDARC
mov dword [esp + 0x27c], 0x4e8a50
mov dword [esp + 0x2a4], str.WIZARDEXTR
mov dword [esp + 0x2b0], 0x4e91e0
mov dword [esp + 0x2d8], str.WIZARDADDOPT
mov dword [esp + 0x2e4], 0x4e87f0
mov dword [esp + 0xc], 0x34
mov dword [esp + 0x10], 0x22a
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
call fcn.004af6d0
cmp byte [0x54ba54], 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x22c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
je 0x4e8466
push 0x800
push 0x5bcc2c
mov ecx, 0x56e128
call fcn.00405080
mov dword [0x5bcc28], 0
mov dword [esp + 0x24], 2
mov eax, dword [0x57f310]
mov ecx, 0x57f3a0
mov dword [esp + 0x234], eax
mov dword [esp + 0x268], eax
mov dword [esp + 0x29c], eax
mov dword [esp + 0x2d0], eax
lea eax, [esp + 0x22c]
push 4
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x234], 0x34
push eax
mov dword [esp + 0x23c], 0x20
mov dword [esp + 0x26c], 0x34
mov dword [esp + 0x270], 0x20
mov dword [esp + 0x2a0], 0x34
mov dword [esp + 0x2a4], 0x20
mov dword [esp + 0x2d4], 0x34
mov dword [esp + 0x2d8], 0x20
call fcn.0048d9b0
lea eax, [esp + 8]
push eax
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
test eax, eax
mov ecx, 0x57f3a0
push 4
lea eax, [esp + 0x230]
setg bl
push eax
call fcn.0048d960
test bl, bl
je 0x4e87c8
mov eax, dword [0x5bcc28]
test eax, eax
je 0x4e86b6
dec eax
cmp eax, 1
ja 0x4e87c8
push 0x5bcc2c
call fcn.0047d830
push 0x800
cmp eax, 0x5bcc2c
jne 0x4e8580
push 0x562a1a
call fcn.0043b770
push 0x800
push 0x562a1a
call fcn.0047bc90
push 0x800
push 0x5bcc2c
push 0x562a1a
call fcn.00494790
jmp 0x4e858f
push 0x5bcc2c
push 0x562a1a
call fcn.004947d0
cmp byte [0x5bec2f], 0
mov al, byte [0x5bec2d]
mov dword [0x55d628], 3
mov dword [0x55d624], 2
mov byte [0x55d66a], al
je 0x4e85c0
mov dword [0x55d600], 2
cmp dword [0x5bcc28], 2
mov eax, dword [0x5bec30]
mov dword [0x55d630], eax
mov eax, dword [0x5bec34]
mov dword [0x55d634], eax
jne 0x4e8616
push 0x562a1a
call fcn.0046cad0
test al, al
je 0x4e8616
push 0
push 1
push 0x562a1a
mov ecx, 0x56e128
call fcn.00405c30
cmp eax, 1
jne 0x4e8699
mov eax, dword [0x56e12c]
mov dword [0x55f9c0], eax
jmp 0x4e8699
cmp byte [0x5bec2e], 0
je 0x4e865c
push 0x517a74
push 0x562a1a
call fcn.0047bcd0
test al, al
jne 0x4e8646
push 0x800
push str..exe
push 0x562a1a
call fcn.00494790
push 0x800
push 0x517a54
push 0x5584d8
call fcn.004947d0
jmp 0x4e8699
cmp dword [0x55f9c0], 0
mov esi, 0x517c84
je 0x4e866f
mov esi, str..zip
lea eax, [esi + 2]
push eax
push 0x562a1a
call fcn.0047bcd0
test al, al
jne 0x4e8691
push 0x800
push esi
push 0x562a1a
call fcn.00494790
xor eax, eax
mov word [0x5584d8], ax
push 1
push 0x562a1a
call fcn.0047d580
push 0
mov ecx, 0x56e128
call fcn.004041f0
jmp 0x4e87c8
push 0
push 1
push 0x5bcc2c
mov ecx, 0x56e128
call fcn.00405c30
cmp eax, 1
jne 0x4e87c8
push 0
call fcn.004c73a0
push 0x800
push 0x5594de
push 0x5bdc2c
mov ecx, 0x570db0
call fcn.004417b0
push 0x5594de
call fcn.0046cad0
test al, al
jne 0x4e8737
push 0
push 0x5594de
call fcn.0046c530
test al, al
jne 0x4e8737
push 0x5594de
push 0x1f7
call fcn.0048e4c0
push eax
call fcn.004d1700
add esp, 8
mov ecx, 0x57f41c
call fcn.00466a60
jmp 0x4e87c8
lea eax, [esp + 0x3c]
mov ecx, 0x56e128
push eax
call fcn.00405440
push 0x800
push 0x562a1a
mov ecx, 0x56e128
call fcn.00405080
mov eax, dword [esp + 0x17c]
mov ecx, 0x563a1c
mov dword [0x55f9c0], eax
call fcn.00494aa0
push 0x517a54
mov ecx, 0x563a1c
call fcn.004948c0
push 0
push 0
mov ecx, 0x56e128
mov byte [0x55d8d9], 0
call fcn.00404c20
cmp word [0x5bdc2c], 0
je 0x4e87ad
push 0x800
push 0x5594de
call fcn.0047bc90
push 1
push 0x51787c
push 0
push 0x5594de
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x2fc]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x2f8
ret 4