Function at 0x47ce1c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb30
push ebx
push esi
mov ebx, eax
mov esi, 0x4de8c8
call fcn.0044b66c
push 0x814
push 0
push 0x4de0b4
call fcn.0049fc54
add esp, 0xc
mov edx, str.WizardLogo.bmp
mov eax, 0x4d0674
mov ecx, 0xf
push 0
call fcn.0047e064
mov dword [0x4de0b0], eax
mov dword [esi + 0xc], str.WIZARDCMD
mov dword [esi + 0x18], 0x47c134
mov dword [esi + 0x3c], str.WIZARDARC
mov dword [esi + 0x48], 0x47c3de
mov dword [esi + 0x6c], str.WIZARDEXTR
mov dword [esi + 0x78], 0x47ca18
mov dword [esi + 0x9c], str.WIZARDADDOPT
mov dword [esi + 0xa8], 0x47cbc7
mov dword [ebp - 0x34], 0x34
mov dword [ebp - 0x30], 0x22a
mov dword [ebp - 0x2c], ebx
mov eax, dword [0x4bb918]
mov dword [ebp - 0x28], eax
mov eax, 0x4d0674
mov dl, 1
call fcn.0047e608
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov dword [ebp - 0x20], ecx
xor eax, eax
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
cmp dword [0x4d27d4], 0
je 0x47cf05
mov edx, 0x4de0b8
mov eax, 0x4d0b94
xor ecx, ecx
call fcn.00458d64
xor edx, edx
mov dword [ebp - 0x18], 2
mov dword [0x4de0b4], edx
xor eax, eax
mov edx, eax
mov ecx, eax
add edx, edx
add ecx, ecx
lea edx, [edx + edx*2]
lea ecx, [ecx + ecx*2]
mov dword [esi + edx*8], 0x30
mov edx, eax
add edx, edx
mov dword [esi + ecx*8 + 4], 0x20
lea edx, [edx + edx*2]
mov ecx, dword [0x4bb918]
mov dword [esi + edx*8 + 8], ecx
inc eax
cmp eax, 4
jl 0x47cf07
push 4
mov ecx, esi
lea edx, [ebp - 0x34]
mov eax, 0x4bb8f8
call fcn.0042a1a8
lea eax, [ebp - 0x34]
push eax
call sub.COMCTL32.DLL_PropertySheetA
test eax, eax
mov eax, 0x4bb8f8
setg bl
and ebx, 1
mov edx, esi
mov ecx, 4
call fcn.0042a22c
test bl, bl
je 0x47d196
mov eax, dword [0x4de0b4]
sub eax, 1
jb 0x47cf8e
sub eax, 2
jb 0x47d061
jmp 0x47d196
push 1
push 0
mov edx, 0x4de0b8
mov eax, 0x4d0b94
xor ecx, ecx
call fcn.00457674
dec eax
jne 0x47d196
lea edx, [ebp - 0x434]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4de4b8
xor ecx, ecx
xor edx, edx
call fcn.0040a4a0
push 0x4de4b8
call fcn.004a186c
pop ecx
lea edx, [ebp - 0x4d0]
mov eax, 0x4d0b94
call fcn.00458d98
call fcn.0044b01c
mov ecx, 0x4c7c88
mov edx, 0x4c7888
mov eax, 0x4d0b94
call fcn.00458d64
mov ecx, dword [ebp - 0x4c0]
mov dword [0x4c6438], ecx
mov eax, dword [0x4c8488]
call fcn.00410788
mov edx, 0x4b5473
mov eax, dword [0x4c8488]
call fcn.004107b8
call fcn.0044bbdc
mov eax, 0x4d0b94
xor ecx, ecx
xor edx, edx
call fcn.00454664
lea eax, [ebp - 0x434]
push eax
call fcn.004a186c
pop ecx
push 1
push 0x4b5446
push 0
push 0x4de4b8
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x47d196
mov edx, 0x4c7888
mov eax, 0x4de0b8
call fcn.0047cde1
mov dword [0x4c5a54], 2
mov dword [0x4c5a50], 1
mov dl, byte [0x4de8b9]
mov byte [0x4c5a8c], dl
cmp byte [0x4de8bb], 0
je 0x47d0a3
mov dword [0x4c5a30], 2
mov ecx, dword [0x4de8bc]
mov dword [0x4c5a58], ecx
mov ecx, dword [0x4de8c0]
mov dword [0x4c5a5c], ecx
cmp dword [0x4de0b4], 2
jne 0x47d101
mov eax, 0x4c7888
xor edx, edx
call fcn.0040a918
test al, al
je 0x47d101
push 1
push 0
mov ecx, 0x4c7c88
mov edx, 0x4c7888
mov eax, 0x4d0b94
call fcn.00457674
dec eax
jne 0x47d17e
mov ecx, dword [0x4d0d9c]
mov dword [0x4c6438], ecx
jmp 0x47d17e
cmp byte [0x4de8ba], 0
je 0x47d143
mov edx, 0x4b547a
mov eax, 0x4c7888
call fcn.0040c948
test al, al
jne 0x47d12f
push 0x4b547e
push 0x4c7888
call fcn.0049fcf8
add esp, 8
push 0x4b5473
push 0x4c3598
call fcn.0049fdd4
add esp, 8
jmp 0x47d17e
cmp dword [0x4c6438], 0
jne 0x47d153
mov esi, str..rar
jmp 0x47d158
mov esi, 0x4b5488
lea edx, [esi + 1]
mov eax, 0x4c7888
call fcn.0040c948
test al, al
jne 0x47d177
push esi
push 0x4c7888
call fcn.0049fcf8
add esp, 8
mov byte [0x4c3598], 0
mov eax, 0x4c7888
mov dl, 1
call fcn.0040cfb4
mov eax, 0x4d0b94
xor edx, edx
call fcn.00454e90
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret