Function at 0x499340
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x4dc
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x4d8], eax
push ebx
push esi
mov esi, dword [esp + 0x4e8]
call fcn.0047b520
push 0x818
xor ebx, ebx
push ebx
push 0x4fffe8
call fcn.0049ebe0
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x4e29b8
call fcn.00467780
mov dword [0x500800], eax
mov eax, dword [0x4c93a8]
push 1
mov ecx, 0x4e29b8
mov dword [0x4fff34], 0x4b5c90
mov dword [0x4fff40], 0x498890
mov dword [0x4fff64], 0x4b5ce4
mov dword [0x4fff70], 0x498da0
mov dword [0x4fff94], 0x4b5c6c
mov dword [0x4fffa0], 0x498650
mov dword [0x4fffc4], 0x4b5cb0
mov dword [0x4fffd0], 0x498b90
mov dword [esp + 0x10], 0x34
mov dword [esp + 0x14], 0x22a
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
call fcn.00466b50
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x4fff28
lea esi, [ebx + 2]
cmp dword [0x4dbca4], ebx
je 0x499448
push ebx
push 0x4fffec
mov ecx, 0x4e0c60
call fcn.00413520
mov dword [0x4fffe8], ebx
mov dword [esp + 0x28], esi
mov eax, dword [0x4c93a8]
mov ecx, 0x20
push 4
mov dword [0x4fff2c], ecx
mov dword [0x4fff5c], ecx
mov dword [0x4fff8c], ecx
mov dword [0x4fffbc], ecx
mov edx, 0x30
push 0x4fff28
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x4c93b8
mov dword [0x4fff28], edx
mov dword [0x4fff30], eax
mov dword [0x4fff58], edx
mov dword [0x4fff60], eax
mov dword [0x4fff88], edx
mov dword [0x4fff90], eax
mov dword [0x4fffb8], edx
mov dword [0x4fffc0], eax
call fcn.0045bc10
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
push 4
test eax, eax
push 0x4fff28
mov ecx, 0x4c93b8
setg byte [esp + 0x13]
call fcn.0045a970
mov cl, byte [esp + 0xb]
cmp cl, bl
je 0x499735
mov eax, dword [0x4fffe8]
cmp eax, ebx
je 0x499652
jle 0x499735
cmp eax, esi
jg 0x499735
mov eax, 0x4e75f4
mov ecx, 0x4fffec
call fcn.00498830
mov al, byte [0x5007ed]
mov dword [0x4e57c4], 3
mov dword [0x4e57c0], 1
mov byte [0x4e57fb], al
cmp byte [0x5007ef], bl
je 0x499536
mov dword [0x4e57a0], esi
mov ecx, dword [0x5007f0]
mov edx, dword [0x5007f4]
mov dword [0x4e57c8], ecx
mov dword [0x4e57cc], edx
cmp dword [0x4fffe8], esi
jne 0x499594
push ebx
push 0x4e75f4
call fcn.0042fc80
test al, al
je 0x499594
push ebx
push 1
push 0x4e79f4
push 0x4e75f4
mov ecx, 0x4e0c60
call fcn.00414490
cmp eax, 1
jne 0x499632
mov eax, dword [0x4e0e68]
mov dword [0x4e6194], eax
jmp 0x499632
cmp byte [0x5007ee], bl
je 0x4995db
push 0x4b1778
push 0x4e75f4
call fcn.0044dee0
test al, al
jne 0x4995ce
mov eax, 0x4e75f4
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4995b5
mov ecx, dword [0x4b1bac]
mov dl, byte [0x4b1bb0]
mov dword [eax], ecx
mov byte [eax + 4], dl
mov eax, 0x2a
mov word [0x4e3308], ax
jmp 0x499632
mov esi, 0x4b2c58
cmp dword [0x4e6194], ebx
je 0x4995ed
mov esi, 0x4b19bc
lea ecx, [esi + 1]
push ecx
push 0x4e75f4
call fcn.0044dee0
test al, al
jne 0x49962c
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x499603
push edi
mov edi, 0x4e75f4
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x499613
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov byte [0x4e3308], bl
push 1
push 0x4e75f4
call fcn.0044e680
push ebx
mov ecx, 0x4e0c60
call fcn.00415390
mov al, byte [esp + 0xb]
jmp 0x499737
push ebx
push 1
push ebx
push 0x4fffec
mov ecx, 0x4e0c60
call fcn.00414490
cmp eax, 1
jne 0x499649
lea edx, [esp + 0xe0]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
push ebx
push 0x5003ec
call fcn.00430590
push 0x5003ec
call fcn.004acbe8
add esp, 4
lea eax, [esp + 0x40]
push eax
mov ecx, 0x4e0c60
call fcn.00413570
call fcn.0047b3d0
call fcn.00477200
push 0x4e79f4
push 0x4e75f4
mov ecx, 0x4e0c60
call fcn.00413520
mov ecx, dword [esp + 0x50]
mov dword [0x4e6194], ecx
mov ecx, dword [0x4e81f4]
call fcn.004655e0
mov ecx, dword [0x4e81f4]
push 0x4b175c
call fcn.00465960
push ebx
push ebx
mov ecx, 0x4e0c60
call fcn.004160e0
lea edx, [esp + 0xe0]
push edx
call fcn.004acbe8
add esp, 4
cmp byte [0x5003ec], bl
je 0x499716
push 0x5003ec
call fcn.0044df70
push 1
push 0x4b1914
push ebx
push 0x5003ec
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, byte [esp + 0xb]
jmp 0x499737
mov al, cl
mov ecx, dword [esp + 0x4e0]
pop esi
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0x4dc
ret 4