Function at 0x478ae0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1864
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x185c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x1070], ax
lea eax, [esp + 0x1072]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x1068]
push 0x4e6040
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1068]
push str._sysreport.txt
push eax
call ebp
push str.w__ccsUTF_8
lea eax, [esp + 0x106c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0049b554
add esp, 0xc
test eax, eax
jne 0x4796db
push str._________________________________________________________________________________________
push str._s_n_n
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
lea eax, [esp + 0x58]
push eax
call fcn.0049da61
add esp, 4
lea eax, [esp + 0x58]
push eax
call fcn.0049da6c
add esp, 4
mov ebx, eax
xor eax, eax
mov word [esp + 0x868], ax
push 0x7fe
push eax
lea eax, [esp + 0x872]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x11c]
mov ecx, 0x2d
lea edi, [esp + 0x68]
mov esi, str.___WinTools.net_System_Report
rep movsd dword es:[edi], dword [esi]
push 0x74c
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [ebx + 0x28]
push eax
push ebx
push str._.19s__s
lea eax, [esp + 0x874]
push 0x104
push eax
call fcn.0040a420
add esp, 0x14
lea eax, [esp + 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x57
sub ecx, eax
add ecx, ecx
cmp ecx, 0x800
jae 0x4796f4
xor eax, eax
mov word [esp + ecx + 0x68], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push str._________________________________________________________________________________________
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push str.___________________________________System_Information:___________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push 0x2722
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1004
push eax
mov dword [esp + 0x24], eax
call esi
xor edi, edi
mov dword [esp + 0x18], eax
lea ebx, [edi + 0x58]
test eax, eax
jle 0x478d7f
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push dword [esp + 0x20]
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str.__s..........................................................................................._n
lea eax, [esp + 0x70]
push 0x104
push eax
call fcn.0040a420
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push dword [esp + 0x20]
call esi
lea eax, [esp + 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
sub ecx, eax
add ecx, ecx
cmp ecx, 0x800
jae 0x4796f4
xor eax, eax
mov word [esp + ecx + 0x68], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x478cb1
push str._WinTools.net_Path:............................................................................_n
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e6040
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub ebx, eax
add ebx, ebx
cmp ebx, 0x800
jae 0x4796f4
xor eax, eax
mov word [esp + ebx + 0x68], ax
lea eax, [esp + 0x68]
push 0x4e6040
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push str.___________________________________Drives_Information:___________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push 0x2776
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x478fc8
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
push 0x4c63dc
lea eax, [esp + 0x86c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push 0x4c63e8
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x88c], ax
lea eax, [esp + 0x868]
push 0x4c647c
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push str....................................................................................
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x8d2], ax
lea eax, [esp + 0x868]
push str.____Size:
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push 0x4c6548
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x8f8], ax
lea eax, [esp + 0x868]
push str._Free:
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 4
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
lea eax, [esp + 0x868]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x478e20
push 0x2808
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4790eb
push str.____________________________________Start_Up_Entries:____________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00479d20
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x4790eb
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str._x___s....................................................................................._n
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a420
add esp, 0x10
push 0xf000
push edi
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
jne 0x479088
mov eax, 0x20
mov word [esp + 0x6a], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
xor eax, eax
mov word [esp + 0xa4], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x479020
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x2762
push dword [0x4e6030]
call ebx
xor edx, edx
mov ecx, eax
call fcn.00474e60
push str.____________________________________Loaded_Processes:____________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push 0x2762
push dword [0x4e6030]
call ebx
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
dec eax
mov edi, 1
mov dword [esp + 0x18], eax
cmp eax, edi
jle 0x4792de
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str._s_________________________n
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a420
xor eax, eax
mov dword [esp + 0x34], 1
add esp, 0x10
mov word [esp + 0x76], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push str........................................................
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov word [esp + 0xa0], ax
lea eax, [esp + 0x868]
push 0x4b34dc
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
cmp word [esp + 0x868], 0x5b
jne 0x47923b
push str._Locked_
jmp 0x479243
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push str........................................................
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov word [esp + 0xb8], ax
lea eax, [esp + 0x868]
push 0x4b34dc
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
cmp word [esp + 0x868], 0x5b
jne 0x4792ae
push str._Locked_
jmp 0x4792b6
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x479150
push 0x2819
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x47946c
push str._____________________________________Loaded_Services:____________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00479d20
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x47946c
nop dword [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x86a]
push eax
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov eax, 0x5b
mov dword [esp + 0x24], 4
mov word [esp + 0x68], ax
xor eax, eax
mov word [esp + 0x70], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x86a]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov dword [esp + 0x78], 0x20005d
mov word [esp + 0x7c], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x34], 2
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push 0x4c6930
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x868]
mov dword [esp + 0xca], 0x20
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x34], 6
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x479330
push 0x27c4
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x47956b
push str._____________________________________Software_Entries:___________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00479d20
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x47956b
nop dword [eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str.__s..........................................................................................._n
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a420
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
xor eax, eax
mov word [esp + 0xcc], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x4794c0
push 0x27c9
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x47966b
push str.____________________________________Installed_Software:__________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00479d20
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x47966b
nop dword [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str.__s..........................................................................................._n
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a420
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
xor eax, eax
mov word [esp + 0x118], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x4795c0
push str._________________________________________________________________________________________
push str._n_n_s_n
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push str._http:__www.wintools.net_________c_2002___2024_______WinTools_Software_Engineering__Ltd.
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push str._________________________________________________________________________________________
push 0x4c60d0
push dword [esp + 0x18]
call fcn.00479d20
add esp, 0xc
push dword [esp + 0x10]
call fcn.0049ba13
add esp, 4
lea eax, [esp + 0x1068]
push 5
push 0
push eax
push str.notepad.exe
push str.open
push dword [0x4e6030]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x186c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1864
ret
call fcn.0048eba6
int3