Function at 0x4b7e40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x26c
mov eax, dword [0x4ec0b4]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x27c]
push edi
call fcn.0049bbc0
push 0x2018
xor ebx, ebx
push ebx
push 0x587390
call fcn.004c2670
add esp, 0xc
push ebx
push 0xf
push str.WizardLogo.bmp
mov ecx, 0x544fb8
call fcn.004821d0
mov dword [0x5893a8], eax
mov eax, dword [0x51ff0c]
mov edi, 0x34
push 1
mov ecx, 0x544fb8
mov dword [esp + 0x58], str.WIZARDCMD
mov dword [esp + 0x64], 0x4b73c0
mov dword [esp + 0x8c], str.WIZARDARC
mov dword [esp + 0x98], 0x4b7940
mov dword [esp + 0xc0], str.WIZARDEXTR
mov dword [esp + 0xcc], 0x4b71b0
mov dword [esp + 0xf4], str.WIZARDADDOPT
mov dword [esp + 0x100], 0x4b76c0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x22a
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
call fcn.00481550
lea ecx, [esp + 0x48]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ecx
lea ebp, [ebx + 2]
cmp byte [0x533b59], bl
je 0x4b7f51
push 0x800
push 0x587394
mov ecx, 0x542618
call fcn.004153c0
mov dword [0x587390], ebx
mov dword [esp + 0x30], ebp
mov eax, dword [0x51ff0c]
mov ecx, 0x20
push 4
lea edx, [esp + 0x4c]
mov dword [esp + 0x54], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xf0], eax
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xf0], ecx
push eax
mov ecx, 0x51ff30
mov dword [esp + 0x54], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0xbc], edi
mov dword [esp + 0xf0], edi
call fcn.00475ac0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
push 4
lea edx, [esp + 0x4c]
test eax, eax
push edx
mov ecx, 0x51ff30
setg byte [esp + 0x1b]
call fcn.00474b40
mov cl, byte [esp + 0x13]
cmp cl, bl
je 0x4b82da
mov eax, dword [0x587390]
cmp eax, ebx
je 0x4b81c7
jle 0x4b82da
cmp eax, ebp
jg 0x4b82da
push 0x587394
call fcn.00460c50
cmp eax, 0x587394
jne 0x4b8046
push 0x55147a
call fcn.004498c0
push 0x800
push 0x55147a
call fcn.004607d0
push 0x800
push 0x587394
push 0x55147a
call fcn.0047fc20
jmp 0x4b805a
push 0x800
push 0x587394
push 0x55147a
call fcn.0047fbe0
mov al, byte [0x589395]
mov dword [0x54c1bc], 3
mov dword [0x54c1b8], ebp
mov byte [0x54c1f6], al
cmp byte [0x589397], bl
je 0x4b8082
mov dword [0x54c194], ebp
mov ecx, dword [0x589398]
mov edx, dword [0x58939c]
mov dword [0x54c1c0], ecx
mov dword [0x54c1c4], edx
cmp dword [0x587390], ebp
jne 0x4b80da
push 0x55147a
call fcn.0043d340
test al, al
je 0x4b80da
push ebx
push 1
push 0x55147a
mov ecx, 0x542618
call fcn.00418a80
cmp eax, 1
jne 0x4b81a7
mov eax, dword [0x542824]
mov dword [0x54e418], eax
jmp 0x4b81a7
cmp byte [0x589396], bl
je 0x4b8147
push 0x4d881c
push 0x55147a
call fcn.00460e70
test al, al
jne 0x4b8127
mov eax, 0x55147a
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, ebp
cmp cx, bx
jne 0x4b8100
mov ecx, dword [0x4dbc70]
mov edx, dword [0x4dbc74]
mov dword [eax], ecx
mov cx, word [0x4dbc78]
mov dword [eax + 4], edx
mov word [eax + 8], cx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4d8800]
mov word [eax + 0x547070], cx
add eax, ebp
cmp cx, bx
jne 0x4b8130
jmp 0x4b81a7
mov esi, 0x4d946c
cmp dword [0x54e418], ebx
je 0x4b8159
mov esi, str..zip
lea edx, [esi + 2]
push edx
push 0x55147a
call fcn.00460e70
test al, al
jne 0x4b819f
mov eax, esi
mov edx, esi
nop
mov cx, word [eax]
add eax, ebp
cmp cx, bx
jne 0x4b8170
mov edi, 0x55147a
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebp
cmp cx, bx
jne 0x4b8184
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov word [0x547070], ax
push 1
push 0x55147a
call fcn.00460970
push ebx
mov ecx, 0x542618
call fcn.00419a60
mov al, byte [esp + 0x13]
jmp 0x4b82dc
push ebx
push 1
push 0x587394
mov ecx, 0x542618
call fcn.00418a80
cmp eax, 1
jne 0x4b823c
push ebx
call fcn.0049ba40
push 0x800
push 0x548076
push 0x588394
mov ecx, 0x5404f0
call fcn.0044c5f0
push 0x548076
call fcn.0043d340
test al, al
jne 0x4b8245
push ebx
push 0x548076
call fcn.0043da20
test al, al
jne 0x4b8245
push 0x548076
push 0x1f7
call fcn.00475cc0
push eax
call fcn.004ad8e0
add esp, 8
mov ecx, 0x51ff10
call fcn.00433f70
mov al, byte [esp + 0x13]
jmp 0x4b82dc
lea ecx, [esp + 0x118]
push ecx
mov ecx, 0x542618
call fcn.004153f0
push 0x800
push 0x55147a
mov ecx, 0x542618
call fcn.004153c0
mov edx, dword [esp + 0x198]
mov ecx, 0x55247c
mov dword [0x54e418], edx
call fcn.00480170
push 0x4d8800
mov ecx, 0x55247c
call fcn.004801a0
push ebx
push ebx
mov ecx, 0x542618
mov byte [0x54c339], bl
call fcn.00419e80
cmp word [0x588394], bx
je 0x4b82bb
push 0x800
push 0x548076
call fcn.004607d0
push 1
push 0x4d89fc
push ebx
push 0x548076
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, byte [esp + 0x13]
jmp 0x4b82dc
mov al, cl
mov ecx, dword [esp + 0x278]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c1c22
add esp, 0x26c
ret 4