Function at 0x477920
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1864
call fcn.004a5e30
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x185c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x1070], ax
lea eax, [esp + 0x1072]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x1068]
push 0x4def98
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1068]
push str._sysreport.txt
push eax
call ebp
push str.w__ccsUTF_8
lea eax, [esp + 0x106c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00494915
add esp, 0xc
test eax, eax
jne 0x47851b
push str._________________________________________________________________________________________
push str._s_n_n
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
lea eax, [esp + 0x58]
push eax
call fcn.00496ea3
add esp, 4
lea eax, [esp + 0x58]
push eax
call fcn.00496eae
add esp, 4
mov ebx, eax
xor eax, eax
mov word [esp + 0x868], ax
push 0x7fe
push eax
lea eax, [esp + 0x872]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x11c]
mov ecx, 0x2d
lea edi, [esp + 0x68]
mov esi, str.___WinTools.net_System_Report
rep movsd dword es:[edi], dword [esi]
push 0x74c
push 0
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [ebx + 0x28]
push eax
push ebx
push str._.19s__s
lea eax, [esp + 0x874]
push 0x104
push eax
call fcn.0040a3c0
add esp, 0x14
lea eax, [esp + 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x57
sub ecx, eax
add ecx, ecx
cmp ecx, 0x800
jae 0x478534
xor eax, eax
mov word [esp + ecx + 0x68], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push str._________________________________________________________________________________________
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push str.___________________________________System_Information:___________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push 0x2722
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1004
push eax
mov dword [esp + 0x24], eax
call esi
xor edi, edi
mov dword [esp + 0x18], eax
lea ebx, [edi + 0x58]
test eax, eax
jle 0x477bbf
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push dword [esp + 0x20]
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str.__s..........................................................................................._n
lea eax, [esp + 0x70]
push 0x104
push eax
call fcn.0040a3c0
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push dword [esp + 0x20]
call esi
lea eax, [esp + 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
sub ecx, eax
add ecx, ecx
cmp ecx, 0x800
jae 0x478534
xor eax, eax
mov word [esp + ecx + 0x68], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x477af1
push str._WinTools.net_Path:............................................................................_n
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4def98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub ebx, eax
add ebx, ebx
cmp ebx, 0x800
jae 0x478534
xor eax, eax
mov word [esp + ebx + 0x68], ax
lea eax, [esp + 0x68]
push 0x4def98
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push str.___________________________________Drives_Information:___________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push 0x2776
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x477e08
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
push 0x4c00ac
lea eax, [esp + 0x86c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push 0x4c00b8
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x88c], ax
lea eax, [esp + 0x868]
push 0x4c014c
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push str....................................................................................
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x8d2], ax
lea eax, [esp + 0x868]
push str.____Size:
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push 0x4c0218
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x8f8], ax
lea eax, [esp + 0x868]
push str._Free:
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 4
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
lea eax, [esp + 0x868]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x477c60
push 0x2808
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x477f2b
push str.____________________________________Start_Up_Entries:____________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00478bd0
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x477f2b
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str._x___s....................................................................................._n
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a3c0
add esp, 0x10
push 0xf000
push edi
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
jne 0x477ec8
mov eax, 0x20
mov word [esp + 0x6a], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
xor eax, eax
mov word [esp + 0xa4], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x477e60
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x2762
push dword [0x4def88]
call ebx
xor edx, edx
mov ecx, eax
call fcn.00473c30
push str.____________________________________Loaded_Processes:____________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push 0x2762
push dword [0x4def88]
call ebx
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
dec eax
mov edi, 1
mov dword [esp + 0x18], eax
cmp eax, edi
jle 0x47811e
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str._s_________________________n
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a3c0
xor eax, eax
mov dword [esp + 0x34], 1
add esp, 0x10
mov word [esp + 0x76], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push str........................................................
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov word [esp + 0xa0], ax
lea eax, [esp + 0x868]
push 0x4ad29c
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
cmp word [esp + 0x868], 0x5b
jne 0x47807b
push str._Locked_
jmp 0x478083
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push str........................................................
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov word [esp + 0xb8], ax
lea eax, [esp + 0x868]
push 0x4ad29c
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
cmp word [esp + 0x868], 0x5b
jne 0x4780ee
push str._Locked_
jmp 0x4780f6
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x477f90
push 0x2819
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4782ac
push str._____________________________________Loaded_Services:____________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00478bd0
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x4782ac
nop dword [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x86a]
push eax
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov eax, 0x5b
mov dword [esp + 0x24], 4
mov word [esp + 0x68], ax
xor eax, eax
mov word [esp + 0x70], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x86a]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov dword [esp + 0x78], 0x20005d
mov word [esp + 0x7c], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x34], 2
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push 0x4c0600
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x868]
mov dword [esp + 0xca], 0x20
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x34], 6
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x478170
push 0x27c4
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4783ab
push str._____________________________________Software_Entries:___________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00478bd0
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x4783ab
nop dword [eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str.__s..........................................................................................._n
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a3c0
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
xor eax, eax
mov word [esp + 0xcc], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x478300
push 0x27c9
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4784ab
push str.____________________________________Installed_Software:__________________________________
push str._n_n_s_n_n
push dword [esp + 0x18]
call fcn.00478bd0
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x4784ab
nop dword [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push str.__s..........................................................................................._n
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a3c0
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
xor eax, eax
mov word [esp + 0x118], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x478400
push str._________________________________________________________________________________________
push str._n_n_s_n
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push str._http:__www.wintools.net_________c_2002___2023_______WinTools_Software_Engineering__Ltd.
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push str._________________________________________________________________________________________
push 0x4bfda0
push dword [esp + 0x18]
call fcn.00478bd0
add esp, 0xc
push dword [esp + 0x10]
call fcn.00494dd4
add esp, 4
lea eax, [esp + 0x1068]
push 5
push 0
push eax
push str.notepad.exe
push str.open
push dword [0x4def88]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x186c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x1864
ret
call fcn.0048da55
int3