Function at 0x4139a4
Capabilities:
Get hostname
Get session user name
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
mov eax, dword [0x43a67c]
push ebx
mov ebx, ecx
mov dword [esp + 0xc], 0x41
push ebp
push esi
push edi
lea ecx, [ebx + 0xcd0]
mov dword [ecx], eax
mov eax, dword [0x43a680]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x18]
lea eax, [ebx + 0xc4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x26]
lea ecx, [ebx + 0xd02]
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push eax
push str._04i_02i_02i
push ecx
call fcn.00405699
movzx eax, word [esp + 0x3e]
lea ecx, [ebx + 0xd14]
add esp, 0x14
push eax
movzx eax, word [esp + 0x2c]
push eax
push str._02i_02i
push ecx
call fcn.00405699
xor edi, edi
add esp, 0x10
cmp dword [ebx + 0xc48], edi
je 0x413a4c
push str.120___R
mov ecx, ebx
call fcn.00412ee3
push 0x1e
lea ebp, [ebx + 0xd1e]
mov esi, str._USERNAME_
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebp
push esi
call fcn.0041c2a7
pop ecx
pop ecx
test eax, eax
jne 0x413a82
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x1e
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebx + 0xc48], edi
je 0x413a96
push str.121___R
mov ecx, ebx
call fcn.00412ee3
push edi
push 0x15
lea esi, [ebx + 0xd5c]
push esi
call fcn.004149a5
test eax, eax
jne 0x413b07
lea ecx, [ebx + 0xc]
lea edx, [esp + 0x30]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x413ab2
lea edi, [esp + 0x30]
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x413aca
push 6
pop ecx
mov esi, str.WDUPDATE.NET
lea eax, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x14
lea eax, [ebx + 0x834]
movsw word es:[edi], word [esi]
lea esi, [ebx + 0xd5c]
push esi
push 0x4368b0
push str.VERSION
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edi, [ebx + 0xd86]
lea ecx, [ebx + 0x834]
mov edx, edi
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x413b17
mov ecx, dword [ebx + 0x11ac]
lea edx, [esp + 0x14]
push 0
mov word [esp + 0x18], 0xfeff
push 2
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
mov eax, dword [ebx + 0x11ac]
push str._LOCK__r_n
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebx + 0x11ac]
lea edx, [ebx + 0xc4c]
push edx
push str.MACHINE_s_r_n
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebx + 0x11ac]
lea edx, [ebx + 0xcd0]
add esp, 0x14
mov ecx, dword [eax]
push edx
push str.IP_s_r_n
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebx + 0x11ac]
lea edx, [ebx + 0xd02]
add esp, 0xc
mov ecx, dword [eax]
push edx
push str.DATECONNECT_s_r_n
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebx + 0x11ac]
lea edx, [ebx + 0xd14]
add esp, 0xc
mov ecx, dword [eax]
push edx
push str.HEURECONNECT_s_r_n
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebx + 0x11ac]
add esp, 0xc
mov ecx, dword [eax]
push ebp
push str.LOGIN_s_r_n
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebx + 0x11ac]
add esp, 0xc
mov ecx, dword [eax]
push esi
push str.VERSION_s_r_n
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebx + 0x11ac]
add esp, 0xc
mov ecx, dword [eax]
push edi
push str.APPLICATION_s_r_n
push eax
call dword [ecx + 0x3c]
add esp, 0xc
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret