Function at 0x4b7530
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x26c
mov eax, dword [0x4eb0b4]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x27c]
push edi
call fcn.0049b3f0
push 0x2018
xor ebx, ebx
push ebx
push 0x586388
call fcn.004c1d50
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x543fb0
call fcn.00481b10
mov dword [0x5883a0], eax
mov eax, dword [0x51ef04]
mov edi, 0x34
push 1
mov ecx, 0x543fb0
mov dword [esp + 0x58], str.WIZARDCMD
mov dword [esp + 0x64], 0x4b6ab0
mov dword [esp + 0x8c], str.WIZARDARC
mov dword [esp + 0x98], 0x4b7030
mov dword [esp + 0xc0], str.WIZARDEXTR
mov dword [esp + 0xcc], 0x4b68a0
mov dword [esp + 0xf4], str.WIZARDADDOPT
mov dword [esp + 0x100], 0x4b6db0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x22a
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
call fcn.00480e90
lea ecx, [esp + 0x48]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ecx
lea ebp, [ebx + 2]
cmp byte [0x532b51], bl
je 0x4b7641
push 0x800
push 0x58638c
mov ecx, 0x541610
call fcn.00415320
mov dword [0x586388], ebx
mov dword [esp + 0x30], ebp
mov eax, dword [0x51ef04]
mov ecx, 0x20
push 4
lea edx, [esp + 0x4c]
mov dword [esp + 0x54], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xf0], eax
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xf0], ecx
push eax
mov ecx, 0x51ef28
mov dword [esp + 0x54], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0xbc], edi
mov dword [esp + 0xf0], edi
call fcn.00475380
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
push 4
lea edx, [esp + 0x4c]
test eax, eax
push edx
mov ecx, 0x51ef28
setg byte [esp + 0x1b]
call fcn.00474400
mov cl, byte [esp + 0x13]
cmp cl, bl
je 0x4b79ca
mov eax, dword [0x586388]
cmp eax, ebx
je 0x4b78b7
jle 0x4b79ca
cmp eax, ebp
jg 0x4b79ca
push 0x58638c
call fcn.00460620
cmp eax, 0x58638c
jne 0x4b7736
push 0x550472
call fcn.00449230
push 0x800
push 0x550472
call fcn.004601c0
push 0x800
push 0x58638c
push 0x550472
call fcn.0047f4c0
jmp 0x4b774a
push 0x800
push 0x58638c
push 0x550472
call fcn.0047f480
mov al, byte [0x58838d]
mov dword [0x54b1b4], 3
mov dword [0x54b1b0], ebp
mov byte [0x54b1ee], al
cmp byte [0x58838f], bl
je 0x4b7772
mov dword [0x54b18c], ebp
mov ecx, dword [0x588390]
mov edx, dword [0x588394]
mov dword [0x54b1b8], ecx
mov dword [0x54b1bc], edx
cmp dword [0x586388], ebp
jne 0x4b77ca
push 0x550472
call fcn.0043ccc0
test al, al
je 0x4b77ca
push ebx
push 1
push 0x550472
mov ecx, 0x541610
call fcn.00418940
cmp eax, 1
jne 0x4b7897
mov eax, dword [0x54181c]
mov dword [0x54d410], eax
jmp 0x4b7897
cmp byte [0x58838e], bl
je 0x4b7837
push 0x4d781c
push 0x550472
call fcn.00460840
test al, al
jne 0x4b7817
mov eax, 0x550472
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, ebp
cmp cx, bx
jne 0x4b77f0
mov ecx, dword [0x4dac70]
mov edx, dword [0x4dac74]
mov dword [eax], ecx
mov cx, word [0x4dac78]
mov dword [eax + 4], edx
mov word [eax + 8], cx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4d7800]
mov word [eax + 0x546068], cx
add eax, ebp
cmp cx, bx
jne 0x4b7820
jmp 0x4b7897
mov esi, 0x4d846c
cmp dword [0x54d410], ebx
je 0x4b7849
mov esi, str..zip
lea edx, [esi + 2]
push edx
push 0x550472
call fcn.00460840
test al, al
jne 0x4b788f
mov eax, esi
mov edx, esi
nop
mov cx, word [eax]
add eax, ebp
cmp cx, bx
jne 0x4b7860
mov edi, 0x550472
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebp
cmp cx, bx
jne 0x4b7874
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov word [0x546068], ax
push 1
push 0x550472
call fcn.00460360
push ebx
mov ecx, 0x541610
call fcn.00419910
mov al, byte [esp + 0x13]
jmp 0x4b79cc
push ebx
push 1
push 0x58638c
mov ecx, 0x541610
call fcn.00418940
cmp eax, 1
jne 0x4b792c
push ebx
call fcn.0049b270
push 0x800
push 0x54706e
push 0x58738c
mov ecx, 0x53f4e8
call fcn.0044bff0
push 0x54706e
call fcn.0043ccc0
test al, al
jne 0x4b7935
push ebx
push 0x54706e
call fcn.0043d3a0
test al, al
jne 0x4b7935
push 0x54706e
push 0x1f7
call fcn.00475570
push eax
call fcn.004ad030
add esp, 8
mov ecx, 0x51ef08
call fcn.00433a70
mov al, byte [esp + 0x13]
jmp 0x4b79cc
lea ecx, [esp + 0x118]
push ecx
mov ecx, 0x541610
call fcn.00415350
push 0x800
push 0x550472
mov ecx, 0x541610
call fcn.00415320
mov edx, dword [esp + 0x198]
mov ecx, 0x551474
mov dword [0x54d410], edx
call fcn.0047fa10
push 0x4d7800
mov ecx, 0x551474
call fcn.0047fa40
push ebx
push ebx
mov ecx, 0x541610
mov byte [0x54b331], bl
call fcn.00419d30
cmp word [0x58738c], bx
je 0x4b79ab
push 0x800
push 0x54706e
call fcn.004601c0
push 1
push 0x4d79fc
push ebx
push 0x54706e
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [esp + 0x13]
jmp 0x4b79cc
mov al, cl
mov ecx, dword [esp + 0x278]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c1302
add esp, 0x26c
ret 4