Function at 0x4a4a40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa4c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0xa48], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa5c]
call fcn.004869a0
push 0x1018
xor ebx, ebx
push ebx
push 0x570b78
call fcn.004af620
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x52f5f8
call fcn.00471a20
mov dword [0x571b90], eax
mov eax, dword [0x513900]
push 1
mov ecx, 0x52f5f8
mov dword [esp + 0x54], str.WIZARDCMD
mov dword [esp + 0x60], 0x4a3f70
mov dword [esp + 0x84], str.WIZARDARC
mov dword [esp + 0x90], 0x4a4540
mov dword [esp + 0xb4], str.WIZARDEXTR
mov dword [esp + 0xc0], 0x4a3d30
mov dword [esp + 0xe4], str.WIZARDADDOPT
mov dword [esp + 0xf0], 0x4a42d0
mov dword [esp + 0x14], 0x34
mov dword [esp + 0x18], 0x22a
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
call fcn.00470d40
lea ecx, [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ecx
lea ebp, [ebx + 2]
cmp byte [0x526d89], bl
je 0x4a4b4f
push 0x400
push 0x570b7c
mov ecx, 0x52dfe8
call fcn.00412e90
mov dword [0x570b78], ebx
mov dword [esp + 0x2c], ebp
mov eax, dword [0x513900]
mov edx, 0x30
mov ecx, 0x20
mov dword [esp + 0x44], edx
mov dword [esp + 0x74], edx
mov dword [esp + 0xa4], edx
mov dword [esp + 0xd4], edx
push 4
lea edx, [esp + 0x48]
mov dword [esp + 0x50], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xe0], eax
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xe0], ecx
push eax
mov ecx, 0x51391c
call fcn.00465bd0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
push 4
lea edx, [esp + 0x48]
test eax, eax
push edx
mov ecx, 0x51391c
setg byte [esp + 0x17]
call fcn.00464c50
mov cl, byte [esp + 0xf]
cmp cl, bl
je 0x4a4e6a
mov eax, dword [0x570b78]
cmp eax, ebx
je 0x4a4d89
jle 0x4a4e6a
cmp eax, ebp
jg 0x4a4e6a
mov eax, 0x5362aa
mov ecx, 0x570b7c
call fcn.004a3f00
mov al, byte [0x571b7d]
mov dword [0x533838], 3
mov dword [0x533834], ebp
mov byte [0x533872], al
cmp byte [0x571b7f], bl
je 0x4a4c3d
mov dword [0x533814], ebp
mov ecx, dword [0x571b80]
mov edx, dword [0x571b84]
mov dword [0x533840], ecx
mov dword [0x533844], edx
cmp dword [0x570b78], ebp
jne 0x4a4c95
push 0x5362aa
call fcn.00432420
test al, al
je 0x4a4c95
push ebx
push 1
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.004166e0
cmp eax, 1
jne 0x4a4d69
mov eax, dword [0x52e1f4]
mov dword [0x53423c], eax
jmp 0x4a4d69
cmp byte [0x571b7e], bl
je 0x4a4d07
push 0x4c5e00
push 0x5362aa
call fcn.00455f40
test al, al
jne 0x4a4ce7
mov eax, 0x5362aa
add eax, 0xfffffffe
jmp 0x4a4cc0
mov cx, word [eax + 2]
add eax, ebp
cmp cx, bx
jne 0x4a4cc0
mov ecx, dword [0x4c8f4c]
mov edx, dword [0x4c8f50]
mov dword [eax], ecx
mov cx, word [0x4c8f54]
mov dword [eax + 4], edx
mov word [eax + 8], cx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4c5f34]
mov word [eax + 0x5306f8], cx
add eax, ebp
cmp cx, bx
jne 0x4a4cf0
jmp 0x4a4d69
mov esi, 0x4c7cd4
cmp dword [0x53423c], ebx
je 0x4a4d19
mov esi, str..zip
lea edx, [esi + 2]
push edx
push 0x5362aa
call fcn.00455f40
test al, al
jne 0x4a4d61
mov eax, esi
mov edx, esi
nop
mov cx, word [eax]
add eax, ebp
cmp cx, bx
jne 0x4a4d30
push edi
mov edi, 0x5362aa
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebp
cmp cx, bx
jne 0x4a4d45
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
xor eax, eax
mov word [0x5306f8], ax
push 1
push 0x5362aa
call fcn.00455590
push ebx
mov ecx, 0x52dfe8
call fcn.00417650
mov al, byte [esp + 0xf]
jmp 0x4a4e6c
push ebx
push 1
push 0x570b7c
mov ecx, 0x52dfe8
call fcn.004166e0
cmp eax, 1
jne 0x4a4d80
push 0x400
lea ecx, [esp + 0x258]
push ecx
call fcn.0048af80
push ebx
push 0x57137c
call fcn.00432de0
push 0x57137c
call fcn.0048af60
lea edx, [esp + 0x104]
push edx
mov ecx, 0x52dfe8
call fcn.00412ec0
call fcn.00486850
push 0x400
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.00412e90
mov eax, dword [esp + 0x184]
mov ecx, dword [0x536aac]
mov dword [0x53423c], eax
call fcn.0046f5f0
mov ecx, dword [0x536aac]
push 0x4c579c
call fcn.0046f9d0
push ebx
push ebx
mov ecx, 0x52dfe8
mov byte [0x53395a], bl
call fcn.00417ad0
lea ecx, [esp + 0x254]
push ecx
call fcn.0048af60
cmp word [0x57137c], bx
je 0x4a4e4b
push 0x57137c
call fcn.004554c0
push 1
push 0x4c5d70
push ebx
push 0x57137c
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [esp + 0xf]
jmp 0x4a4e6c
mov al, cl
mov ecx, dword [esp + 0xa54]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0xa4c
ret 4