Function at 0x47a098
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb30
push ebx
push esi
mov ebx, eax
mov esi, 0x4d50b4
call fcn.0044a240
push 0x814
push 0
push 0x4d48a0
call fcn.00498cfc
add esp, 0xc
mov edx, str.WizardLogo.bmp
mov eax, 0x4c772c
mov ecx, 0xf
push 0
call fcn.0047b2c8
mov dword [0x4d489c], eax
mov dword [esi + 0xc], str.WIZARDCMD
mov dword [esi + 0x18], 0x4793c0
mov dword [esi + 0x3c], str.WIZARDARC
mov dword [esi + 0x48], 0x47966a
mov dword [esi + 0x6c], str.WIZARDEXTR
mov dword [esi + 0x78], 0x479ca1
mov dword [esi + 0x9c], str.WIZARDADDOPT
mov dword [esi + 0xa8], 0x479e50
mov dword [ebp - 0x34], 0x34
mov dword [ebp - 0x30], 0x22a
mov dword [ebp - 0x2c], ebx
mov eax, dword [0x4b41d0]
mov dword [ebp - 0x28], eax
mov eax, 0x4c772c
mov dl, 1
call fcn.0047b86c
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov dword [ebp - 0x20], ecx
xor eax, eax
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
cmp dword [0x4c988c], 0
je 0x47a181
mov edx, 0x4d48a4
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d7c
xor edx, edx
mov dword [ebp - 0x18], 2
mov dword [0x4d48a0], edx
xor eax, eax
mov edx, eax
mov ecx, eax
add edx, edx
add ecx, ecx
lea edx, [edx + edx*2]
lea ecx, [ecx + ecx*2]
mov dword [esi + edx*8], 0x30
mov edx, eax
add edx, edx
mov dword [esi + ecx*8 + 4], 0x20
lea edx, [edx + edx*2]
mov ecx, dword [0x4b41d0]
mov dword [esi + edx*8 + 8], ecx
inc eax
cmp eax, 4
jl 0x47a183
push 4
mov ecx, esi
lea edx, [ebp - 0x34]
mov eax, 0x4b41b0
call fcn.0042932c
lea eax, [ebp - 0x34]
push eax
call sub.COMCTL32.DLL_PropertySheetA
test eax, eax
mov eax, 0x4b41b0
setg bl
and ebx, 1
mov edx, esi
mov ecx, 4
call fcn.004293b0
test bl, bl
je 0x47a412
mov eax, dword [0x4d48a0]
sub eax, 1
jb 0x47a20a
sub eax, 2
jb 0x47a2dd
jmp 0x47a412
push 1
push 0
mov edx, 0x4d48a4
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.004567bc
dec eax
jne 0x47a412
lea edx, [ebp - 0x434]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4d4ca4
xor ecx, ecx
xor edx, edx
call fcn.0040a3dc
push 0x4d4ca4
call fcn.0049a80c
pop ecx
lea edx, [ebp - 0x4d0]
mov eax, 0x4c7c4c
call fcn.00457db0
call fcn.00449c20
mov ecx, 0x4bfd40
mov edx, 0x4bf940
mov eax, 0x4c7c4c
call fcn.00457d7c
mov ecx, dword [ebp - 0x4c0]
mov dword [0x4be4f0], ecx
mov eax, dword [0x4c0540]
call fcn.0040ff20
mov edx, 0x4addeb
mov eax, dword [0x4c0540]
call fcn.0040ff50
call fcn.0044a7b4
mov eax, 0x4c7c4c
xor ecx, ecx
xor edx, edx
call fcn.00452bdc
lea eax, [ebp - 0x434]
push eax
call fcn.0049a80c
pop ecx
push 1
push 0x4addbe
push 0
push 0x4d4ca4
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x47a412
mov edx, 0x4bf940
mov eax, 0x4d48a4
call fcn.0047a05c
mov dword [0x4bdb0c], 2
mov dword [0x4bdb08], 1
mov dl, byte [0x4d50a5]
mov byte [0x4bdb44], dl
cmp byte [0x4d50a7], 0
je 0x47a31f
mov dword [0x4bdae8], 2
mov ecx, dword [0x4d50a8]
mov dword [0x4bdb10], ecx
mov ecx, dword [0x4d50ac]
mov dword [0x4bdb14], ecx
cmp dword [0x4d48a0], 2
jne 0x47a37d
mov eax, 0x4bf940
xor edx, edx
call fcn.0040a838
test al, al
je 0x47a37d
push 1
push 0
mov ecx, 0x4bfd40
mov edx, 0x4bf940
mov eax, 0x4c7c4c
call fcn.004567bc
dec eax
jne 0x47a3fa
mov ecx, dword [0x4c7e54]
mov dword [0x4be4f0], ecx
jmp 0x47a3fa
cmp byte [0x4d50a6], 0
je 0x47a3bf
mov edx, 0x4addf2
mov eax, 0x4bf940
call fcn.0040c2a4
test al, al
jne 0x47a3ab
push 0x4addf6
push 0x4bf940
call fcn.00498da0
add esp, 8
push 0x4addeb
push 0x4bbe50
call fcn.00498e7c
add esp, 8
jmp 0x47a3fa
cmp dword [0x4be4f0], 0
jne 0x47a3cf
mov esi, str..rar
jmp 0x47a3d4
mov esi, 0x4ade00
lea edx, [esi + 1]
mov eax, 0x4bf940
call fcn.0040c2a4
test al, al
jne 0x47a3f3
push esi
push 0x4bf940
call fcn.00498da0
add esp, 8
mov byte [0x4bbe50], 0
mov eax, 0x4bf940
mov dl, 1
call fcn.0040c818
mov eax, 0x4c7c4c
xor edx, edx
call fcn.004533d8
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret