Function at 0x4a4cf0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa4c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0xa48], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa5c]
call fcn.00486c10
push 0x1018
xor ebx, ebx
push ebx
push 0x570b78
call fcn.004af870
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x52f5f8
call fcn.00471cc0
mov dword [0x571b90], eax
mov eax, dword [0x513900]
push 1
mov ecx, 0x52f5f8
mov dword [esp + 0x54], str.WIZARDCMD
mov dword [esp + 0x60], 0x4a4220
mov dword [esp + 0x84], str.WIZARDARC
mov dword [esp + 0x90], 0x4a47f0
mov dword [esp + 0xb4], str.WIZARDEXTR
mov dword [esp + 0xc0], 0x4a3fe0
mov dword [esp + 0xe4], str.WIZARDADDOPT
mov dword [esp + 0xf0], 0x4a4580
mov dword [esp + 0x14], 0x34
mov dword [esp + 0x18], 0x22a
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
call fcn.00470fe0
lea ecx, [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ecx
lea ebp, [ebx + 2]
cmp byte [0x526d89], bl
je 0x4a4dff
push 0x400
push 0x570b7c
mov ecx, 0x52dfe8
call fcn.00412e90
mov dword [0x570b78], ebx
mov dword [esp + 0x2c], ebp
mov eax, dword [0x513900]
mov edx, 0x30
mov ecx, 0x20
mov dword [esp + 0x44], edx
mov dword [esp + 0x74], edx
mov dword [esp + 0xa4], edx
mov dword [esp + 0xd4], edx
push 4
lea edx, [esp + 0x48]
mov dword [esp + 0x50], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xe0], eax
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xe0], ecx
push eax
mov ecx, 0x51391c
call fcn.00465e70
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
push 4
lea edx, [esp + 0x48]
test eax, eax
push edx
mov ecx, 0x51391c
setg byte [esp + 0x17]
call fcn.00464ef0
mov cl, byte [esp + 0xf]
cmp cl, bl
je 0x4a511a
mov eax, dword [0x570b78]
cmp eax, ebx
je 0x4a5039
jle 0x4a511a
cmp eax, ebp
jg 0x4a511a
mov eax, 0x5362aa
mov ecx, 0x570b7c
call fcn.004a41b0
mov al, byte [0x571b7d]
mov dword [0x533838], 3
mov dword [0x533834], ebp
mov byte [0x533872], al
cmp byte [0x571b7f], bl
je 0x4a4eed
mov dword [0x533814], ebp
mov ecx, dword [0x571b80]
mov edx, dword [0x571b84]
mov dword [0x533840], ecx
mov dword [0x533844], edx
cmp dword [0x570b78], ebp
jne 0x4a4f45
push 0x5362aa
call fcn.00432480
test al, al
je 0x4a4f45
push ebx
push 1
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.004166e0
cmp eax, 1
jne 0x4a5019
mov eax, dword [0x52e1f4]
mov dword [0x53423c], eax
jmp 0x4a5019
cmp byte [0x571b7e], bl
je 0x4a4fb7
push 0x4c5e00
push 0x5362aa
call fcn.00456210
test al, al
jne 0x4a4f97
mov eax, 0x5362aa
add eax, 0xfffffffe
jmp 0x4a4f70
mov cx, word [eax + 2]
add eax, ebp
cmp cx, bx
jne 0x4a4f70
mov ecx, dword [0x4c8f7c]
mov edx, dword [0x4c8f80]
mov dword [eax], ecx
mov cx, word [0x4c8f84]
mov dword [eax + 4], edx
mov word [eax + 8], cx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4c5f34]
mov word [eax + 0x5306f8], cx
add eax, ebp
cmp cx, bx
jne 0x4a4fa0
jmp 0x4a5019
mov esi, 0x4c7d04
cmp dword [0x53423c], ebx
je 0x4a4fc9
mov esi, str..zip
lea edx, [esi + 2]
push edx
push 0x5362aa
call fcn.00456210
test al, al
jne 0x4a5011
mov eax, esi
mov edx, esi
nop
mov cx, word [eax]
add eax, ebp
cmp cx, bx
jne 0x4a4fe0
push edi
mov edi, 0x5362aa
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebp
cmp cx, bx
jne 0x4a4ff5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
xor eax, eax
mov word [0x5306f8], ax
push 1
push 0x5362aa
call fcn.00455860
push ebx
mov ecx, 0x52dfe8
call fcn.00417650
mov al, byte [esp + 0xf]
jmp 0x4a511c
push ebx
push 1
push 0x570b7c
mov ecx, 0x52dfe8
call fcn.004166e0
cmp eax, 1
jne 0x4a5030
push 0x400
lea ecx, [esp + 0x258]
push ecx
call fcn.0048b200
push ebx
push 0x57137c
call fcn.00432e40
push 0x57137c
call fcn.0048b1e0
lea edx, [esp + 0x104]
push edx
mov ecx, 0x52dfe8
call fcn.00412ec0
call fcn.00486ac0
push 0x400
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.00412e90
mov eax, dword [esp + 0x184]
mov ecx, dword [0x536aac]
mov dword [0x53423c], eax
call fcn.0046f890
mov ecx, dword [0x536aac]
push 0x4c579c
call fcn.0046fc70
push ebx
push ebx
mov ecx, 0x52dfe8
mov byte [0x53395a], bl
call fcn.00417ad0
lea ecx, [esp + 0x254]
push ecx
call fcn.0048b1e0
cmp word [0x57137c], bx
je 0x4a50fb
push 0x57137c
call fcn.00455790
push 1
push 0x4c5d70
push ebx
push 0x57137c
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [esp + 0xf]
jmp 0x4a511c
mov al, cl
mov ecx, dword [esp + 0xa54]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004af00b
add esp, 0xa4c
ret 4