Function at 0x4f2670
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2f8
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x2f4], eax
push ebx
push esi
mov esi, dword [esp + 0x304]
call fcn.004d42b0
push 0x2018
push 0
push 0x5c9b20
call fcn.00505530
add esp, 0xc
push 0
push 0x71
push 0x70
push 0x6f
push str.WizardLogo.png
push 1
call fcn.004b7eb0
mov dword [0x5c9b18], eax
mov ecx, 0x57fff8
mov eax, dword [0x58c1f8]
push 1
mov dword [esp + 0x23c], str.WIZARDCMD
mov dword [esp + 0x248], 0x4f3260
mov dword [esp + 0x270], str.WIZARDARC
mov dword [esp + 0x27c], 0x4f2d80
mov dword [esp + 0x2a4], str.WIZARDEXTR
mov dword [esp + 0x2b0], 0x4f3520
mov dword [esp + 0x2d8], str.WIZARDADDOPT
mov dword [esp + 0x2e4], 0x4f2b20
mov dword [esp + 0xc], 0x34
mov dword [esp + 0x10], 0x22a
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
call fcn.004b7fc0
cmp byte [0x558b34], 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x22c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
je 0x4f2796
push 0x800
push 0x5c9b24
mov ecx, 0x57b208
call fcn.00406070
mov dword [0x5c9b20], 0
mov dword [esp + 0x24], 2
mov eax, dword [0x58c1f8]
mov ecx, 0x58c288
mov dword [esp + 0x234], eax
mov dword [esp + 0x268], eax
mov dword [esp + 0x29c], eax
mov dword [esp + 0x2d0], eax
lea eax, [esp + 0x22c]
push 4
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x234], 0x34
push eax
mov dword [esp + 0x23c], 0x20
mov dword [esp + 0x26c], 0x34
mov dword [esp + 0x270], 0x20
mov dword [esp + 0x2a0], 0x34
mov dword [esp + 0x2a4], 0x20
mov dword [esp + 0x2d4], 0x34
mov dword [esp + 0x2d8], 0x20
call fcn.00496000
lea eax, [esp + 8]
push eax
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
test eax, eax
mov ecx, 0x58c288
push 4
lea eax, [esp + 0x230]
setg bl
push eax
call fcn.00495fb0
test bl, bl
je 0x4f2af8
mov eax, dword [0x5c9b20]
test eax, eax
je 0x4f29e6
dec eax
cmp eax, 1
ja 0x4f2af8
push 0x5c9b24
call fcn.00485280
push 0x800
cmp eax, 0x5c9b24
jne 0x4f28b0
push 0x56fafa
call fcn.00441040
push 0x800
push 0x56fafa
call fcn.004836c0
push 0x800
push 0x5c9b24
push 0x56fafa
call fcn.0049ce50
jmp 0x4f28bf
push 0x5c9b24
push 0x56fafa
call fcn.0049ce90
cmp byte [0x5cbb27], 0
mov al, byte [0x5cbb25]
mov dword [0x56a708], 3
mov dword [0x56a704], 2
mov byte [0x56a74a], al
je 0x4f28f0
mov dword [0x56a6e0], 2
cmp dword [0x5c9b20], 2
mov eax, dword [0x5cbb28]
mov dword [0x56a710], eax
mov eax, dword [0x5cbb2c]
mov dword [0x56a714], eax
jne 0x4f2946
push 0x56fafa
call fcn.00474160
test al, al
je 0x4f2946
push 0
push 1
push 0x56fafa
mov ecx, 0x57b208
call fcn.00406f60
cmp eax, 1
jne 0x4f29c9
mov eax, dword [0x57b20c]
mov dword [0x56caa0], eax
jmp 0x4f29c9
cmp byte [0x5cbb26], 0
je 0x4f298c
push 0x524724
push 0x56fafa
call fcn.00483700
test al, al
jne 0x4f2976
push 0x800
push str..exe
push 0x56fafa
call fcn.0049ce50
push 0x800
push 0x524704
push 0x5655b8
call fcn.0049ce90
jmp 0x4f29c9
cmp dword [0x56caa0], 0
mov esi, 0x52496c
je 0x4f299f
mov esi, str..zip
lea eax, [esi + 2]
push eax
push 0x56fafa
call fcn.00483700
test al, al
jne 0x4f29c1
push 0x800
push esi
push 0x56fafa
call fcn.0049ce50
xor eax, eax
mov word [0x5655b8], ax
push 1
push 0x56fafa
call fcn.00484fd0
push 0
mov ecx, 0x57b208
call fcn.00404e30
jmp 0x4f2af8
push 0
push 1
push 0x5c9b24
mov ecx, 0x57b208
call fcn.00406f60
cmp eax, 1
jne 0x4f2af8
push 0
call fcn.004d08b0
push 0x800
push 0x5665be
push 0x5cab24
mov ecx, 0x57de98
call fcn.00447a80
push 0x5665be
call fcn.00474160
test al, al
jne 0x4f2a67
push 0
push 0x5665be
call fcn.00473bc0
test al, al
jne 0x4f2a67
push 0x5665be
push 0x1f7
call fcn.00496b20
push eax
call fcn.004db310
add esp, 8
mov ecx, 0x58c304
call fcn.0046df00
jmp 0x4f2af8
lea eax, [esp + 0x3c]
mov ecx, 0x57b208
push eax
call fcn.004066f0
push 0x800
push 0x56fafa
mov ecx, 0x57b208
call fcn.00406070
mov eax, dword [esp + 0x17c]
mov ecx, 0x570afc
mov dword [0x56caa0], eax
call fcn.0049d160
push 0x524704
mov ecx, 0x570afc
call fcn.0049cf80
push 0
push 0
mov ecx, 0x57b208
mov byte [0x56a9b9], 0
call fcn.00405be0
cmp word [0x5cab24], 0
je 0x4f2add
push 0x800
push 0x5665be
call fcn.004836c0
push 1
push 0x52452c
push 0
push 0x5665be
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x2fc]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x2f8
ret 4