Function at 0x4103aa
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.No_CAB
lea edi, [ebp - 0x24]
lea eax, [ebp - 0x348]
xor ebx, ebx
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x34c], ebx
movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x344], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x101
mov dword [ebp - 0x348], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x410410
push esi
lea eax, [ebp - 0x128]
push eax
push str.unknown_user
call fcn.00401f74
push 0x10
pop esi
lea eax, [ebp - 0x348]
mov dword [ebp - 0x348], esi
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x410449
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x14]
push esi
push eax
push str.UNKNOWN
call fcn.00401f74
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.crash.log
push 0x4c9f08
push 0x47db20
lea eax, [ebp - 0x330]
push 0x104
push eax
call fcn.004026a1
mov eax, dword [0x4d0208]
add esp, 0x14
cmp dword [eax], ebx
je 0x410487
push 0x15
pop edi
jmp 0x410496
push dword [0x4ca110]
call fcn.00401f4a
mov edi, eax
add edi, edi
lea eax, [ebp - 0x14]
push eax
call fcn.00406215
lea esi, [edi + eax]
lea eax, [ebp - 0x128]
push eax
call fcn.00406215
add eax, 0x1a
add esi, eax
lea eax, [ebp - 0x344]
push esi
push eax
call fcn.00406235
test al, al
je 0x410692
mov edi, dword [ebp - 0x344]
lea eax, [ebp - 0x340]
push esi
push edi
push eax
call fcn.0041df0c
push edi
call fcn.00406215
lea ecx, [ebp - 0x128]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push str._t_s_t_s_t
mov ecx, esi
sub ecx, eax
add eax, edi
push 0xffffffffffffffff
push ecx
push eax
call fcn.00408456
add esp, 0x18
push edi
call fcn.00406215
mov ecx, dword [0x4d0208]
sub esi, eax
add eax, edi
cmp dword [ecx], ebx
je 0x410530
push dword [ecx + 4]
push dword [ecx]
push str._d_t_d_r_n
push 0xffffffffffffffff
push esi
push eax
call fcn.00408456
add esp, 0x18
jmp 0x410547
push dword [0x4ca110]
push str._S_r_n
push 0xffffffffffffffff
push esi
push eax
call fcn.00408456
add esp, 0x14
lea eax, [ebp - 0x330]
push eax
push edi
call fcn.0041978f
push edi
call fcn.0046d68f
mov eax, dword [0x4ca11c]
mov dword [ebp - 0x344], ebx
pop ecx
test eax, eax
je 0x41057d
push eax
call fcn.0041f694
mov edi, eax
cmp word [edi], 0x5c
jne 0x410580
add edi, 2
jmp 0x410580
lea edi, [ebp - 0x24]
push dword [0x4ca114]
call fcn.00401f4a
push str.hits.log
mov esi, eax
call fcn.00401f4a
add eax, 2
add eax, esi
mov dword [ebp - 0x350], eax
cmp eax, 0x104
jle 0x4105c5
call fcn.0041e1d1
test eax, eax
je 0x410692
push str.Tracking_filename_length_greater_than_MAX_PATH__wont_write_to_it._r_n
call fcn.0041fda5
jmp 0x410692
push edi
call fcn.00401f4a
mov esi, eax
lea eax, [ebp - 0x14]
push eax
call fcn.00406215
add esi, 0xd
lea ebx, [eax + esi*2]
lea eax, [ebp - 0x128]
push eax
call fcn.00406215
mov esi, dword [ebp - 0x350]
add ebx, eax
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.00406235
test al, al
je 0x410692
push str.hits.log
push dword [0x4ca114]
push 0x47db20
push esi
push dword [ebp - 0x34c]
call fcn.004026a1
add esp, 0x14
lea eax, [ebp - 0x344]
push ebx
push eax
call fcn.00406235
test al, al
je 0x410686
mov esi, dword [ebp - 0x344]
lea eax, [ebp - 0x340]
push ebx
push esi
push eax
call fcn.0041df0c
push esi
call fcn.00406215
push edi
lea ecx, [ebp - 0x128]
sub ebx, eax
push ecx
lea ecx, [ebp - 0x14]
add eax, esi
push ecx
push str._t_s_t_s_t_S_r_n
push 0xffffffffffffffff
push ebx
push eax
call fcn.00408456
add esp, 0x1c
push dword [ebp - 0x34c]
push esi
call fcn.0041978f
push esi
call fcn.0046d68f
pop ecx
push dword [ebp - 0x34c]
call fcn.0046d68f
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d772
mov esp, ebp
pop ebp
ret