Function at 0x498de0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x4dc
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x4d8], eax
push ebx
push esi
mov esi, dword [esp + 0x4e8]
call fcn.0047b000
push 0x818
xor ebx, ebx
push ebx
push 0x4fffa0
call fcn.0049e680
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x4e2970
call fcn.00467270
mov dword [0x5007b8], eax
mov eax, dword [0x4c9360]
push 1
mov ecx, 0x4e2970
mov dword [0x4ffeec], 0x4b5bf8
mov dword [0x4ffef8], 0x498330
mov dword [0x4fff1c], 0x4b5c4c
mov dword [0x4fff28], 0x498840
mov dword [0x4fff4c], 0x4b5bd4
mov dword [0x4fff58], 0x4980f0
mov dword [0x4fff7c], 0x4b5c18
mov dword [0x4fff88], 0x498630
mov dword [esp + 0x10], 0x34
mov dword [esp + 0x14], 0x22a
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
call fcn.00466640
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x4ffee0
lea esi, [ebx + 2]
cmp dword [0x4dbc5c], ebx
je 0x498ee8
push ebx
push 0x4fffa4
mov ecx, 0x4e0c18
call fcn.004134e0
mov dword [0x4fffa0], ebx
mov dword [esp + 0x28], esi
mov eax, dword [0x4c9360]
mov ecx, 0x20
push 4
mov dword [0x4ffee4], ecx
mov dword [0x4fff14], ecx
mov dword [0x4fff44], ecx
mov dword [0x4fff74], ecx
mov edx, 0x30
push 0x4ffee0
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x4c9370
mov dword [0x4ffee0], edx
mov dword [0x4ffee8], eax
mov dword [0x4fff10], edx
mov dword [0x4fff18], eax
mov dword [0x4fff40], edx
mov dword [0x4fff48], eax
mov dword [0x4fff70], edx
mov dword [0x4fff78], eax
call fcn.0045b6e0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
push 4
test eax, eax
push 0x4ffee0
mov ecx, 0x4c9370
setg byte [esp + 0x13]
call fcn.0045a440
mov cl, byte [esp + 0xb]
cmp cl, bl
je 0x4991d5
mov eax, dword [0x4fffa0]
cmp eax, ebx
je 0x4990f2
jle 0x4991d5
cmp eax, esi
jg 0x4991d5
mov eax, 0x4e75ac
mov ecx, 0x4fffa4
call fcn.004982d0
mov al, byte [0x5007a5]
mov dword [0x4e577c], 3
mov dword [0x4e5778], 1
mov byte [0x4e57b3], al
cmp byte [0x5007a7], bl
je 0x498fd6
mov dword [0x4e5758], esi
mov ecx, dword [0x5007a8]
mov edx, dword [0x5007ac]
mov dword [0x4e5780], ecx
mov dword [0x4e5784], edx
cmp dword [0x4fffa0], esi
jne 0x499034
push ebx
push 0x4e75ac
call fcn.0042f890
test al, al
je 0x499034
push ebx
push 1
push 0x4e79ac
push 0x4e75ac
mov ecx, 0x4e0c18
call fcn.00414420
cmp eax, 1
jne 0x4990d2
mov eax, dword [0x4e0e20]
mov dword [0x4e614c], eax
jmp 0x4990d2
cmp byte [0x5007a6], bl
je 0x49907b
push 0x4b1778
push 0x4e75ac
call fcn.0044d920
test al, al
jne 0x49906e
mov eax, 0x4e75ac
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x499055
mov ecx, dword [0x4b1bac]
mov dl, byte [0x4b1bb0]
mov dword [eax], ecx
mov byte [eax + 4], dl
mov eax, 0x2a
mov word [0x4e32c0], ax
jmp 0x4990d2
mov esi, 0x4b2bc0
cmp dword [0x4e614c], ebx
je 0x49908d
mov esi, 0x4b19bc
lea ecx, [esi + 1]
push ecx
push 0x4e75ac
call fcn.0044d920
test al, al
jne 0x4990cc
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4990a3
push edi
mov edi, 0x4e75ac
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4990b3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov byte [0x4e32c0], bl
push 1
push 0x4e75ac
call fcn.0044e0c0
push ebx
mov ecx, 0x4e0c18
call fcn.00415320
mov al, byte [esp + 0xb]
jmp 0x4991d7
push ebx
push 1
push ebx
push 0x4fffa4
mov ecx, 0x4e0c18
call fcn.00414420
cmp eax, 1
jne 0x4990e9
lea edx, [esp + 0xe0]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
push ebx
push 0x5003a4
call fcn.004301a0
push 0x5003a4
call fcn.004ac688
add esp, 4
lea eax, [esp + 0x40]
push eax
mov ecx, 0x4e0c18
call fcn.00413530
call fcn.0047aeb0
call fcn.00476d00
push 0x4e79ac
push 0x4e75ac
mov ecx, 0x4e0c18
call fcn.004134e0
mov ecx, dword [esp + 0x50]
mov dword [0x4e614c], ecx
mov ecx, dword [0x4e81ac]
call fcn.004650d0
mov ecx, dword [0x4e81ac]
push 0x4b175c
call fcn.00465450
push ebx
push ebx
mov ecx, 0x4e0c18
call fcn.00416070
lea edx, [esp + 0xe0]
push edx
call fcn.004ac688
add esp, 4
cmp byte [0x5003a4], bl
je 0x4991b6
push 0x5003a4
call fcn.0044d9b0
push 1
push 0x4b1914
push ebx
push 0x5003a4
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, byte [esp + 0xb]
jmp 0x4991d7
mov al, cl
mov ecx, dword [esp + 0x4e0]
pop esi
pop ebx
xor ecx, esp
call fcn.0049e0c6
add esp, 0x4dc
ret 4