Function at 0x4b6eb0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x26c
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x27c]
push edi
call fcn.0049abf0
push 0x2018
xor ebx, ebx
push ebx
push 0x586c68
call fcn.004c16b0
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x544890
call fcn.004814e0
mov dword [0x588c80], eax
mov eax, dword [0x51f7e4]
mov edi, 0x34
push 1
mov ecx, 0x544890
mov dword [esp + 0x58], str.WIZARDCMD
mov dword [esp + 0x64], 0x4b6430
mov dword [esp + 0x8c], str.WIZARDARC
mov dword [esp + 0x98], 0x4b69b0
mov dword [esp + 0xc0], str.WIZARDEXTR
mov dword [esp + 0xcc], 0x4b6220
mov dword [esp + 0xf4], str.WIZARDADDOPT
mov dword [esp + 0x100], 0x4b6730
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x22a
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
call fcn.00480860
lea ecx, [esp + 0x48]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ecx
lea ebp, [ebx + 2]
cmp byte [0x533431], bl
je 0x4b6fc1
push 0x800
push 0x586c6c
mov ecx, 0x541ef0
call fcn.00415140
mov dword [0x586c68], ebx
mov dword [esp + 0x30], ebp
mov eax, dword [0x51f7e4]
mov ecx, 0x20
push 4
lea edx, [esp + 0x4c]
mov dword [esp + 0x54], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xf0], eax
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xf0], ecx
push eax
mov ecx, 0x51f804
mov dword [esp + 0x54], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0xbc], edi
mov dword [esp + 0xf0], edi
call fcn.00474ec0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
push 4
lea edx, [esp + 0x4c]
test eax, eax
push edx
mov ecx, 0x51f804
setg byte [esp + 0x1b]
call fcn.00473f40
mov cl, byte [esp + 0x13]
cmp cl, bl
je 0x4b734a
mov eax, dword [0x586c68]
cmp eax, ebx
je 0x4b7237
jle 0x4b734a
cmp eax, ebp
jg 0x4b734a
push 0x586c6c
call fcn.00460330
cmp eax, 0x586c6c
jne 0x4b70b6
push 0x550d52
call fcn.00448f00
push 0x800
push 0x550d52
call fcn.0045fed0
push 0x800
push 0x586c6c
push 0x550d52
call fcn.0047efb0
jmp 0x4b70ca
push 0x800
push 0x586c6c
push 0x550d52
call fcn.0047ef70
mov al, byte [0x588c6d]
mov dword [0x54ba94], 3
mov dword [0x54ba90], ebp
mov byte [0x54bace], al
cmp byte [0x588c6f], bl
je 0x4b70f2
mov dword [0x54ba6c], ebp
mov ecx, dword [0x588c70]
mov edx, dword [0x588c74]
mov dword [0x54ba98], ecx
mov dword [0x54ba9c], edx
cmp dword [0x586c68], ebp
jne 0x4b714a
push 0x550d52
call fcn.0043ca60
test al, al
je 0x4b714a
push ebx
push 1
push 0x550d52
mov ecx, 0x541ef0
call fcn.00418720
cmp eax, 1
jne 0x4b7217
mov eax, dword [0x5420fc]
mov dword [0x54dcf0], eax
jmp 0x4b7217
cmp byte [0x588c6e], bl
je 0x4b71b7
push 0x4d781c
push 0x550d52
call fcn.00460550
test al, al
jne 0x4b7197
mov eax, 0x550d52
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, ebp
cmp cx, bx
jne 0x4b7170
mov ecx, dword [0x4dacd0]
mov edx, dword [0x4dacd4]
mov dword [eax], ecx
mov cx, word [0x4dacd8]
mov dword [eax + 4], edx
mov word [eax + 8], cx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4d7800]
mov word [eax + 0x546948], cx
add eax, ebp
cmp cx, bx
jne 0x4b71a0
jmp 0x4b7217
mov esi, 0x4d846c
cmp dword [0x54dcf0], ebx
je 0x4b71c9
mov esi, str..zip
lea edx, [esi + 2]
push edx
push 0x550d52
call fcn.00460550
test al, al
jne 0x4b720f
mov eax, esi
mov edx, esi
nop
mov cx, word [eax]
add eax, ebp
cmp cx, bx
jne 0x4b71e0
mov edi, 0x550d52
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebp
cmp cx, bx
jne 0x4b71f4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov word [0x546948], ax
push 1
push 0x550d52
call fcn.00460070
push ebx
mov ecx, 0x541ef0
call fcn.004196c0
mov al, byte [esp + 0x13]
jmp 0x4b734c
push ebx
push 1
push 0x586c6c
mov ecx, 0x541ef0
call fcn.00418720
cmp eax, 1
jne 0x4b72ac
push ebx
call fcn.0049aa70
push 0x800
push 0x54794e
push 0x587c6c
mov ecx, 0x53fdc8
call fcn.0044bbf0
push 0x54794e
call fcn.0043ca60
test al, al
jne 0x4b72b5
push ebx
push 0x54794e
call fcn.0043d140
test al, al
jne 0x4b72b5
push 0x54794e
push 0x1f7
call fcn.004750b0
push eax
call fcn.004ac840
add esp, 8
mov ecx, 0x51f7e8
call fcn.00433750
mov al, byte [esp + 0x13]
jmp 0x4b734c
lea ecx, [esp + 0x118]
push ecx
mov ecx, 0x541ef0
call fcn.00415170
push 0x800
push 0x550d52
mov ecx, 0x541ef0
call fcn.00415140
mov edx, dword [esp + 0x198]
mov ecx, 0x551d54
mov dword [0x54dcf0], edx
call fcn.0047f300
push 0x4d7800
mov ecx, 0x551d54
call fcn.0047f330
push ebx
push ebx
mov ecx, 0x541ef0
mov byte [0x54bc11], bl
call fcn.00419ae0
cmp word [0x587c6c], bx
je 0x4b732b
push 0x800
push 0x54794e
call fcn.0045fed0
push 1
push 0x4d79fc
push ebx
push 0x54794e
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [esp + 0x13]
jmp 0x4b734c
mov al, cl
mov ecx, dword [esp + 0x278]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c0c62
add esp, 0x26c
ret 4