Function at 0x401560
Capabilities:
Capture screenshot
Get hostname
Resolve dns

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x425a91
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x170
cmp eax, 0x18
push ebx
push ebp
push esi
push edi
jg 0x40186f
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x34], esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0041f914
push eax
lea ecx, [esp + 0x24]
call fcn.004239e7
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x20]
neg eax
sbb eax, eax
push 8
and eax, edi
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
mov dword [esp + 0x190], esi
call edi
mov ebp, dword [esp + 0x24]
mov esi, eax
lea eax, [esp + 0x20]
push 0xa
neg eax
sbb eax, eax
and eax, ebp
push eax
call edi
mov ebp, dword [esp + 0x24]
mov edi, eax
lea eax, [esp + 0x20]
neg eax
sbb eax, eax
and eax, ebp
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x24]
mov ebp, eax
lea eax, [esp + 0x20]
push edi
neg eax
sbb eax, eax
push esi
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push 0xcc0020
neg eax
sbb eax, eax
push 0
and eax, edx
push 0
push eax
push edi
push esi
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x80]
mov dword [esp + 0x3c], 0x100
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x80]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [0x42f3b0]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 0xc]
mov byte [esp + 0x188], 1
mov eax, dword [edx]
lea edx, [esp + 0x38]
mov ecx, dword [eax]
push ecx
push edx
call fcn.00402b00
mov eax, dword [eax]
lea ecx, [esp + 0x88]
push eax
push ecx
lea edx, [esp + 0x24]
push str._s_ip:_s
push edx
mov byte [esp + 0x1a0], 2
call fcn.0041e3cc
add esp, 0x18
lea ecx, [esp + 0x38]
mov byte [esp + 0x188], 1
call fcn.0041ef82
mov eax, dword [esp + 0x14]
xor edi, edi
mov ecx, dword [eax - 8]
push ecx
push eax
push edi
push 0xc8
push ebp
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [esp + 0x10]
push eax
push ebp
call ebx
mov ecx, dword [esp + 0x190]
mov dword [esp + 0x18], eax
cmp ecx, 1
jg 0x4017cf
mov ebx, 1
mov edx, 1
mov cl, bl
shl edx, cl
shl edx, 2
mov dword [esp + 0x1c], edx
lea ecx, [esp + 0x68]
push ecx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x6c]
mov eax, ebx
and eax, 0xffff
mov esi, dword [esp + 0x70]
imul eax, ecx
add eax, 0x1f
mov word [esp + 0x4e], bx
and al, 0xe0
mov dword [esp + 0x40], 0x28
cdq
and edx, 7
mov dword [esp + 0x44], ecx
add eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 3
imul eax, esi
add edx, 0x28
mov dword [esp + 0x48], esi
mov word [esp + 0x4c], 1
mov dword [esp + 0x50], edi
lea ebx, [edx + eax]
mov eax, dword [0x432b1c]
cmp ebx, eax
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [0x432b20], edx
mov dword [0x432afc], ecx
mov dword [0x432af8], esi
je 0x40188e
mov eax, dword [0x432b18]
cmp eax, edi
jne 0x401806
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
jne 0x401876
mov eax, dword [esp + 0x18]
push eax
jmp 0x401831
cmp ecx, 4
jg 0x4017de
mov ebx, 4
jmp 0x401710
cmp ecx, 8
jg 0x4017ed
mov ebx, 8
jmp 0x401710
cmp ecx, 0x10
jg 0x4017fc
mov ebx, 0x10
jmp 0x401710
mov ebx, 0x18
jmp 0x401720
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [0x432b18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
push 0x42
mov dword [0x432b18], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
jne 0x401876
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x14]
mov dword [0x432b1c], edi
mov dword [0x432b20], edi
mov byte [esp + 0x188], 0
call fcn.0041ef82
lea ecx, [esp + 0x20]
mov dword [esp + 0x188], 0xffffffff
call fcn.00423a59
xor al, al
jmp 0x40197e
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esp + 0x10], eax
mov ecx, 0xa
lea esi, [esp + 0x40]
mov edi, eax
jmp 0x4018a1
mov edi, dword [0x432b18]
mov ecx, 0xa
mov dword [esp + 0x10], edi
lea esi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
push 0xf
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edi, eax
test edi, edi
je 0x4018d0
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectPalette]
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x4018d8
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push 0
push eax
lea edx, [eax + ecx + 0x28]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0
push ecx
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
test edi, edi
je 0x401935
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x20]
neg eax
sbb eax, eax
push 1
and eax, ecx
push edi
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x20]
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
mov dword [0x432b18], edx
mov dword [0x432b1c], ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x14]
mov byte [esp + 0x188], 0
call fcn.0041ef82
lea ecx, [esp + 0x20]
mov dword [esp + 0x188], 0xffffffff
call fcn.00423a59
mov al, 1
mov ecx, dword [esp + 0x180]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x17c
ret