Function at 0x498bf0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x4dc
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x4d8], eax
push ebx
push esi
mov esi, dword [esp + 0x4e8]
call fcn.0047b4b0
push 0x818
xor ebx, ebx
push ebx
push 0x4fff70
call fcn.0049e460
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x4e2960
call fcn.00467730
mov dword [0x500788], eax
mov eax, dword [0x4c9360]
push 1
mov ecx, 0x4e2960
mov dword [0x4ffebc], 0x4b5bfc
mov dword [0x4ffec8], 0x498140
mov dword [0x4ffeec], 0x4b5c50
mov dword [0x4ffef8], 0x498650
mov dword [0x4fff1c], 0x4b5bd8
mov dword [0x4fff28], 0x497f00
mov dword [0x4fff4c], 0x4b5c1c
mov dword [0x4fff58], 0x498440
mov dword [esp + 0x10], 0x34
mov dword [esp + 0x14], 0x22a
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
call fcn.00466b00
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x4ffeb0
lea esi, [ebx + 2]
cmp dword [0x4dbc5c], ebx
je 0x498cf8
push ebx
push 0x4fff74
mov ecx, 0x4e0c08
call fcn.00413690
mov dword [0x4fff70], ebx
mov dword [esp + 0x28], esi
mov eax, dword [0x4c9360]
mov ecx, 0x20
push 4
mov dword [0x4ffeb4], ecx
mov dword [0x4ffee4], ecx
mov dword [0x4fff14], ecx
mov dword [0x4fff44], ecx
mov edx, 0x30
push 0x4ffeb0
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x4c9370
mov dword [0x4ffeb0], edx
mov dword [0x4ffeb8], eax
mov dword [0x4ffee0], edx
mov dword [0x4ffee8], eax
mov dword [0x4fff10], edx
mov dword [0x4fff18], eax
mov dword [0x4fff40], edx
mov dword [0x4fff48], eax
call fcn.0045bbd0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
push 4
test eax, eax
push 0x4ffeb0
mov ecx, 0x4c9370
setg byte [esp + 0x13]
call fcn.0045a930
mov cl, byte [esp + 0xb]
cmp cl, bl
je 0x498fe5
mov eax, dword [0x4fff70]
cmp eax, ebx
je 0x498f02
jle 0x498fe5
cmp eax, esi
jg 0x498fe5
mov eax, 0x4e758c
mov ecx, 0x4fff74
call fcn.004980e0
mov al, byte [0x500775]
mov dword [0x4e576c], 3
mov dword [0x4e5768], 1
mov byte [0x4e57a3], al
cmp byte [0x500777], bl
je 0x498de6
mov dword [0x4e5748], esi
mov ecx, dword [0x500778]
mov edx, dword [0x50077c]
mov dword [0x4e5770], ecx
mov dword [0x4e5774], edx
cmp dword [0x4fff70], esi
jne 0x498e44
push ebx
push 0x4e758c
call fcn.0042f950
test al, al
je 0x498e44
push ebx
push 1
push 0x4e798c
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.004145d0
cmp eax, 1
jne 0x498ee2
mov eax, dword [0x4e0e10]
mov dword [0x4e613c], eax
jmp 0x498ee2
cmp byte [0x500776], bl
je 0x498e8b
push 0x4b1778
push 0x4e758c
call fcn.0044df20
test al, al
jne 0x498e7e
mov eax, 0x4e758c
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x498e65
mov ecx, dword [0x4b1bac]
mov dl, byte [0x4b1bb0]
mov dword [eax], ecx
mov byte [eax + 4], dl
mov eax, 0x2a
mov word [0x4e32b0], ax
jmp 0x498ee2
mov esi, 0x4b2bc0
cmp dword [0x4e613c], ebx
je 0x498e9d
mov esi, 0x4b19bc
lea ecx, [esi + 1]
push ecx
push 0x4e758c
call fcn.0044df20
test al, al
jne 0x498edc
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x498eb3
push edi
mov edi, 0x4e758c
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x498ec3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov byte [0x4e32b0], bl
push 1
push 0x4e758c
call fcn.0044e6c0
push ebx
mov ecx, 0x4e0c08
call fcn.004154f0
mov al, byte [esp + 0xb]
jmp 0x498fe7
push ebx
push 1
push ebx
push 0x4fff74
mov ecx, 0x4e0c08
call fcn.004145d0
cmp eax, 1
jne 0x498ef9
lea edx, [esp + 0xe0]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
push ebx
push 0x500374
call fcn.00430250
push 0x500374
call fcn.004ac458
add esp, 4
lea eax, [esp + 0x40]
push eax
mov ecx, 0x4e0c08
call fcn.004136e0
call fcn.0047b360
push 0x4e798c
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.00413690
mov ecx, dword [esp + 0x50]
mov dword [0x4e613c], ecx
mov ecx, dword [0x4e818c]
call fcn.00465590
mov ecx, dword [0x4e818c]
push 0x4b175c
call fcn.00465910
call fcn.004771b0
push ebx
push ebx
mov ecx, 0x4e0c08
call fcn.00416240
lea edx, [esp + 0xe0]
push edx
call fcn.004ac458
add esp, 4
cmp byte [0x500374], bl
je 0x498fc6
push 0x500374
call fcn.0044dfb0
push 1
push 0x4b1914
push ebx
push 0x500374
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, byte [esp + 0xb]
jmp 0x498fe7
mov al, cl
mov ecx, dword [esp + 0x4e0]
pop esi
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x4dc
ret 4