Function at 0x4d9b44
Capabilities:
Get session user name
Query environment variable
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x86c
push ebp
push edi
push esi
push ebx
add esp, 0xfffffff8
push 0x52cd70
push 0x5167d0
call sub.KERNEL32.dll_lstrcpyA
add esp, 0xfffffffc
push 0x5167d0
call sub.KERNEL32.dll_lstrlenA
mov edi, 0x104
mov edx, edi
sub edx, eax
mov dword [esp + 0x28], edx
add esp, 0xfffffff4
lea ebx, [esp + 0x34]
push ebx
add eax, 0x5167d0
push eax
call sub.ADVAPI32.DLL_GetUserNameA
push 0x4d9aa6
push 0x5166b0
call sub.KERNEL32.dll_lstrcpyA
push 0x52cd70
push 0x5168f0
call sub.KERNEL32.dll_lstrcpyA
add esp, 0xfffffffc
push 0x5168f0
call sub.KERNEL32.dll_lstrlenA
mov esi, 0x5168f0
add esp, 0x1c
mov ebp, ebx
cmp byte [esi + eax - 1], 0x5c
jne 0x4d9bda
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_lstrlenA
mov byte [esi + eax - 1], 0
add esp, 0xc
add esp, 0xfffffff8
push 0x4d9abe
add esp, 0xfffffff4
push 0x4d9acf
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x5166a0], eax
add esp, 8
test eax, eax
je 0x4d9c7d
add esp, 0xfffffff4
lea ebx, [esp + 0x2c]
push ebx
push 0
push 0
push 5
push 0
call eax
add esp, 0xc
test eax, eax
jne 0x4d9c7d
push 0
push 0
push edi
push 0x5166b0
push 0xffffffffffffffff
push ebx
push 0
push 0
call sub.KERNEL32.dll_WideCharToMultiByte
mov ebx, 0x5166b0
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
cmp byte [ebx + ecx - 2], 0x5c
je 0x4d9c5e
add esp, 0xfffffff8
push 0x4d9adc
push ebx
call fcn.004f1ea8
add esp, 0x10
add esp, 0xfffffff8
push ebx
lea eax, [esp + 0x23c]
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x4d9ade
push ebx
call fcn.004f1ea8
add esp, 0x10
add esp, 0xfffffff8
push 0x52cb40
push 0x104
push 0x5167d0
push 0x5167d0
push 0x4d9ae8
push 0x4d9af8
call sub.KERNEL32.dll_GetPrivateProfileStringA
add esp, 8
cmp dword [0x4f5e5c], 0
je 0x4d9ccd
add esp, 0xfffffff8
push 0x52cb40
push 0x104
push 0x5166b0
push 0x5166b0
push 0x4d9b01
jmp 0x4d9ce9
add esp, 0xfffffff8
push 0x52cb40
push 0x104
push 0x5166b0
push 0x5166b0
push 0x4d9b12
push 0x4d9af8
call sub.KERNEL32.dll_GetPrivateProfileStringA
add esp, 8
add esp, 0xfffffff8
push 0x52cb40
push 0x104
push 0x5168f0
push 0x5168f0
push 0x4d9b20
push 0x4d9af8
call sub.KERNEL32.dll_GetPrivateProfileStringA
add esp, 0xfffffff4
lea eax, [esp + 0x2c]
push eax
push 0x4d9b32
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
mov dword [esp + 0x30], 0x104
add esp, 0xfffffffc
push ebp
lea esi, [esp + 0x77c]
push esi
lea ebx, [esp + 0x34]
push ebx
push 0
push 0x4d9ae8
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 0x18
test eax, eax
jne 0x4d9d8c
mov eax, dword [esp + 0x1c]
cmp byte [esi + eax - 2], 0x5c
je 0x4d9d7b
mov byte [esi + eax - 1], 0x5c
mov eax, dword [esp + 0x1c]
mov byte [eax + esi], 0
add esp, 0xfffffff8
push esi
push 0x5167d0
call fcn.004f1e08
add esp, 0x10
mov dword [esp + 0x1c], 0x104
add esp, 0xfffffff8
push ebp
push esi
push ebx
push 0
push 0x4d9b12
push dword [esp + 0x34]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x4d9dda
mov eax, dword [esp + 0x1c]
cmp byte [esi + eax - 2], 0x5c
je 0x4d9dc9
mov byte [esi + eax - 1], 0x5c
mov eax, dword [esp + 0x1c]
mov byte [eax + esi], 0
add esp, 0xfffffff8
push esi
push 0x5166b0
call fcn.004f1e08
add esp, 0x10
mov dword [esp + 0x1c], 0x104
add esp, 0xfffffff8
push ebp
push esi
push ebx
push 0
push 0x4d9b20
push dword [esp + 0x34]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x4d9e28
mov eax, dword [esp + 0x1c]
cmp byte [esi + eax - 2], 0x5c
je 0x4d9e17
mov byte [esi + eax - 1], 0x5c
mov eax, dword [esp + 0x1c]
mov byte [eax + esi], 0
add esp, 0xfffffff8
push esi
push 0x5168f0
call fcn.004f1e08
add esp, 0x10
add esp, 0xfffffff4
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
cmp dword [0x5166a0], 0
je 0x4d9ed8
add esp, 0xfffffffc
push esi
lea ebx, [esp + 0x238]
push ebx
push 0x5166b0
call fcn.004d9a04
mov dword [esp + 0x2c], eax
dec eax
add esp, 0x10
cmp eax, 0x102
ja 0x4d9e7a
add esp, 0xfffffff8
push esi
push 0x5166b0
call fcn.004f1e08
add esp, 0x10
add esp, 0xfffffffc
push esi
push ebx
push 0x5167d0
call fcn.004d9a04
mov dword [esp + 0x2c], eax
dec eax
add esp, 0x10
cmp eax, 0x102
ja 0x4d9ea9
add esp, 0xfffffff8
push esi
push 0x5167d0
call fcn.004f1e08
add esp, 0x10
add esp, 0xfffffffc
push esi
push ebx
push 0x5168f0
call fcn.004d9a04
mov dword [esp + 0x2c], eax
dec eax
add esp, 0x10
cmp eax, 0x102
ja 0x4d9ed8
add esp, 0xfffffff8
push esi
push 0x5168f0
call fcn.004f1e08
add esp, 0x10
add esp, 0xfffffff8
push 0x104
lea ebx, [esp + 0x34c]
push ebx
push 0xffffffffffffffff
push 0x5166b0
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
add esp, 0xfffffff4
push 0x103
lea esi, [esp + 0x568]
push esi
push ebx
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
add esp, 0xfffffff4
push 0
push ebx
push 0x104
push esi
call sub.KERNEL32.dll_GetFullPathNameW
add esp, 0x20
push 0
push 0
push 0x104
push 0x5166b0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
add esp, 0xfffffff8
push 0x104
push ebx
push 0xffffffffffffffff
push 0x5167d0
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
add esp, 0xfffffff4
push 0x103
push esi
push ebx
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
add esp, 0xfffffff4
push 0
push ebx
push 0x104
push esi
call sub.KERNEL32.dll_GetFullPathNameW
add esp, 0x20
push 0
push 0
push 0x104
push 0x5167d0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
add esp, 0xfffffff8
push 0x104
push ebx
push 0xffffffffffffffff
push 0x5168f0
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
add esp, 0xfffffff4
push 0x103
push esi
push ebx
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
add esp, 0xfffffff4
push 0
push ebx
push 0x104
push esi
call sub.KERNEL32.dll_GetFullPathNameW
add esp, 0x20
push 0
push 0
push 0x104
push 0x5168f0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
add esp, 0xfffffff4
push 0x5167d0
call sub.KERNEL32.dll_lstrlenA
mov dword [0x5168e0], eax
push 0x5166b0
call sub.KERNEL32.dll_lstrlenA
mov dword [0x5167c0], eax
push 0x5168f0
call sub.KERNEL32.dll_lstrlenA
mov dword [0x516a00], eax
mov eax, 1
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x86c
ret