Function at 0x4cd240
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2fc
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x2f8], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30c]
push edi
call fcn.004b04c0
push 0x2018
xor ebx, ebx
push ebx
push 0x585af8
call fcn.004e7df0
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x54e740
call fcn.004a5400
mov dword [0x587b10], eax
mov eax, dword [0x531154]
mov edi, 0x34
push 1
mov ecx, 0x54e740
mov dword [esp + 0x58], str.WIZARDCMD
mov dword [esp + 0x64], 0x4cc7b0
mov dword [esp + 0x8c], str.WIZARDARC
mov dword [esp + 0x98], 0x4ccd30
mov dword [esp + 0xc0], str.WIZARDEXTR
mov dword [esp + 0xcc], 0x4cc5a0
mov dword [esp + 0xf4], str.WIZARDADDOPT
mov dword [esp + 0x100], 0x4ccab0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x22a
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
call fcn.004a4730
lea ecx, [esp + 0x48]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ecx
lea ebp, [ebx + 2]
cmp byte [0x53d329], bl
je 0x4cd351
push 0x800
push 0x585afc
mov ecx, 0x54be08
call fcn.0047b190
mov dword [0x585af8], ebx
mov dword [esp + 0x30], ebp
mov eax, dword [0x531154]
mov ecx, 0x20
push 4
lea edx, [esp + 0x4c]
mov dword [esp + 0x54], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xf0], eax
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xf0], ecx
push eax
mov ecx, 0x531178
mov dword [esp + 0x54], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0xbc], edi
mov dword [esp + 0xf0], edi
call fcn.004631e0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
push 4
lea edx, [esp + 0x4c]
test eax, eax
push edx
mov ecx, 0x531178
setg byte [esp + 0x1b]
call fcn.004621d0
mov cl, byte [esp + 0x13]
cmp cl, bl
je 0x4cd6da
mov eax, dword [0x585af8]
cmp eax, ebx
je 0x4cd5c7
jle 0x4cd6da
cmp eax, ebp
jg 0x4cd6da
push 0x585afc
call fcn.004534c0
cmp eax, 0x585afc
jne 0x4cd446
push 0x55abfa
call fcn.0048d550
push 0x800
push 0x55abfa
call fcn.00452c60
push 0x800
push 0x585afc
push 0x55abfa
call fcn.00469530
jmp 0x4cd45a
push 0x800
push 0x585afc
push 0x55abfa
call fcn.004694b0
mov al, byte [0x587afd]
mov dword [0x555948], 3
mov dword [0x555944], ebp
mov byte [0x555986], al
cmp byte [0x587aff], bl
je 0x4cd482
mov dword [0x555920], ebp
mov ecx, dword [0x587b00]
mov edx, dword [0x587b04]
mov dword [0x555950], ecx
mov dword [0x555954], edx
cmp dword [0x585af8], ebp
jne 0x4cd4da
push 0x55abfa
call fcn.00445470
test al, al
je 0x4cd4da
push ebx
push 1
push 0x55abfa
mov ecx, 0x54be08
call fcn.0047c7b0
cmp eax, 1
jne 0x4cd5a7
mov eax, dword [0x54be0c]
mov dword [0x557ba8], eax
jmp 0x4cd5a7
cmp byte [0x587afe], bl
je 0x4cd547
push 0x502a40
push 0x55abfa
call fcn.004536e0
test al, al
jne 0x4cd527
mov eax, 0x55abfa
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, ebp
cmp cx, bx
jne 0x4cd500
mov ecx, dword [0x505974]
mov edx, dword [0x505978]
mov dword [eax], ecx
mov cx, word [0x50597c]
mov dword [eax + 4], edx
mov word [eax + 8], cx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x502a28]
mov word [eax + 0x5507f8], cx
add eax, ebp
cmp cx, bx
jne 0x4cd530
jmp 0x4cd5a7
mov esi, str..rar
cmp dword [0x557ba8], ebx
je 0x4cd559
mov esi, str..zip
lea edx, [esi + 2]
push edx
push 0x55abfa
call fcn.004536e0
test al, al
jne 0x4cd59f
mov eax, esi
mov edx, esi
nop
mov cx, word [eax]
add eax, ebp
cmp cx, bx
jne 0x4cd570
mov edi, 0x55abfa
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebp
cmp cx, bx
jne 0x4cd584
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov word [0x5507f8], ax
push 1
push 0x55abfa
call fcn.00452eb0
push ebx
mov ecx, 0x54be08
call fcn.0047d0d0
mov al, byte [esp + 0x13]
jmp 0x4cd6dc
push ebx
push 1
push 0x585afc
mov ecx, 0x54be08
call fcn.0047c7b0
cmp eax, 1
jne 0x4cd63c
push ebx
call fcn.004b0320
push 0x800
push 0x5517fe
push 0x586afc
mov ecx, 0x549cb8
call fcn.00490060
push 0x5517fe
call fcn.00445470
test al, al
jne 0x4cd645
push ebx
push 0x5517fe
call fcn.00445960
test al, al
jne 0x4cd645
push 0x5517fe
push 0x1f7
call fcn.00463400
push eax
call fcn.004c2ab0
add esp, 8
mov ecx, 0x531158
call fcn.0043f4b0
mov al, byte [esp + 0x13]
jmp 0x4cd6dc
lea ecx, [esp + 0x118]
push ecx
mov ecx, 0x54be08
call fcn.0047b1c0
push 0x800
push 0x55abfa
mov ecx, 0x54be08
call fcn.0047b190
mov edx, dword [esp + 0x258]
mov ecx, 0x55bbfc
mov dword [0x557ba8], edx
call fcn.004698b0
push 0x502a28
mov ecx, 0x55bbfc
call fcn.004698e0
push ebx
push ebx
mov ecx, 0x54be08
mov byte [0x555ac9], bl
call fcn.0047d470
cmp word [0x586afc], bx
je 0x4cd6bb
push 0x800
push 0x5517fe
call fcn.00452c60
push 1
push 0x501a20
push ebx
push 0x5517fe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [esp + 0x13]
jmp 0x4cd6dc
mov al, cl
mov ecx, dword [esp + 0x308]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x2fc
ret 4