Function at 0x40f0e7
Capabilities:
Contain obfuscated stackstrings
Get hostname
Get session user name
Reference http user-agent string
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
push ebx
push esi
push edi
push 0
call fcn.0044c6c1
pop ecx
push eax
call fcn.004462ba
mov dword [esp], 0x504
push 0
push 0x4cfcb0
call fcn.0043dd90
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
mov dword [0x4cfcb0], eax
call esi
call fcn.00446299
push eax
call fcn.00446299
push eax
push str._04X_04X
push 0x4cfcb4
call fcn.0040bcca
add esp, 0x10
call edi
push eax
call fcn.00446299
push eax
call fcn.00446299
push eax
mov ebx, str._04X_04X_08X
push ebx
push 0x4d0142
call fcn.0040bcca
add esp, 0x14
push 0xa
call esi
call edi
push eax
call fcn.00446299
push eax
call fcn.00446299
push eax
push ebx
push 0x4d016a
call fcn.0040bcca
add esp, 0x14
lea ecx, [esp + 0x7c]
push 0x20
pop edx
call fcn.004130cc
push eax
mov ecx, 0x4d02c0
call fcn.00411ce6
lea ecx, [esp + 0x7c]
call fcn.0040c696
push 0x20
pop edx
lea ecx, [esp + 0x7c]
call fcn.004130cc
push eax
mov ecx, 0x4d0358
call fcn.00411ce6
lea ecx, [esp + 0x7c]
call fcn.0040c696
mov eax, dword [0x4d0234]
xor ebx, ebx
mov byte [esp + 0x78], bl
mov ecx, 0x4d0234
push dword [esp + 0x78]
mov dword [0x4d0238], eax
push 0x4b8708
push 0x4b86f8
push eax
call fcn.00411d9a
mov esi, dword [0x4d0358]
push 8
pop ecx
mov edi, 0x4d0121
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x4d02c0]
mov edi, 0x4d0192
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
movzx eax, word [ecx + 0x4cfcb4]
lea ecx, [ecx + 2]
mov word [ecx + 0x4d01e2], ax
test ax, ax
jne 0x40f21d
mov esi, 0x11c
lea eax, [esp + 0xf0]
push esi
push ebx
push eax
call fcn.0043dd90
add esp, 0xc
push str.RtlGetVersion
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f276
lea ecx, [esp + 0xf0]
mov dword [esp + 0xf0], esi
push ecx
call eax
push dword [esp + 0xfc]
mov byte [0x4cfce8], 0x30
push dword [esp + 0xfc]
mov byte [0x4d006a], 0x30
push dword [esp + 0xfc]
push str._d._d._d
push 0x4cfcc8
call fcn.0040bdd3
add esp, 0x14
mov byte [0x4d0120], 0x30
call fcn.0040e980
movzx ecx, byte [0x4cfce8]
test eax, eax
push 0x31
pop edx
push 0x40
pop esi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], esi
push eax
cmovne ecx, edx
push 0x4cfcea
mov byte [0x4cfce8], cl
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], esi
push eax
push 0x4cfd6a
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xff
push 0x4cfdea
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x4cffea
call fcn.0040ead6
xor eax, eax
mov dword [esp + 0x10], 0x8c70884
lea edx, [esp + 0x210]
mov dword [esp + 0x14], 0x8e008be
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0x8f608d4
mov dword [esp + 0x1c], 0x8eb08f3
mov dword [esp + 0x20], 0x8e508f6
mov dword [esp + 0x24], 0x8a408f1
mov dword [esp + 0x28], 0x8ed08ca
mov dword [esp + 0x2c], 0x8e908f0
mov dword [esp + 0x30], 0x8e008f7
mov dword [esp + 0x34], 0x8d108da
mov dword [esp + 0x38], 0x8e508fb
mov dword [esp + 0x3c], 0x8e908f6
mov dword [esp + 0x40], 0x8da08e0
mov dword [esp + 0x44], 0x8fb08d1
mov dword [esp + 0x48], 0x8f608e5
mov dword [esp + 0x4c], 0x8a408e9
mov dword [esp + 0x50], 0x8f308d8
mov dword [esp + 0x54], 0x8f008f3
mov dword [esp + 0x58], 0x8e008f7
mov dword [esp + 0x5c], 0x8f108fa
mov dword [esp + 0x60], 0x8f308f8
mov dword [esp + 0x64], 0x8f008f3
mov dword [esp + 0x68], 0x8e808f7
mov dword [esp + 0x6c], 0x8e908b2
mov dword [esp + 0x70], 0x8e908fc
mov word [esp + 0x74], ax
call fcn.0040e6d3
mov edx, 0x4d006c
lea ecx, [esp + 0x210]
call fcn.0040ee94
mov dword [esp + 0x10], 0x89a0852
mov dword [esp + 0x14], 0x8a40893
mov dword [esp + 0x18], 0x8a90896
mov dword [esp + 0x1c], 0x8a40893
mov dword [esp + 0x20], 0x8ae0897
mov dword [esp + 0x24], 0x8970896
mov dword [esp + 0x28], 0x89508a5
mov dword [esp + 0x2c], 0x89b08a4
mov dword [esp + 0x30], 0x8a608a2
mov dword [esp + 0x34], 0x8a1089b
mov dword [esp + 0x38], 0x8ae08a0
mov dword [esp + 0x3c], 0x8cb08a5
mov dword [esp + 0x40], 0x8c608c5
xor eax, eax
mov dword [esp + 0x44], 0x8bf08b7
lea edx, [esp + 0xbc]
mov word [esp + 0x48], ax
lea ecx, [esp + 0x10]
call fcn.0040e6d3
xor eax, eax
mov dword [esp + 0x10], 0x91108be
lea edx, [esp + 0x88]
mov dword [esp + 0x14], 0x9310937
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0x9230932
mov dword [esp + 0x1c], 0x900092b
mov dword [esp + 0x20], 0x92d0927
mov dword [esp + 0x24], 0x9140931
mov dword [esp + 0x28], 0x9300923
mov dword [esp + 0x2c], 0x9270931
mov dword [esp + 0x30], 0x92c092d
mov word [esp + 0x34], ax
call fcn.0040e6d3
push ecx
lea eax, [esp + 0x8c]
push 0x4d0094
push eax
lea edx, [esp + 0xc8]
call fcn.0040ef37
add esp, 0xc
call fcn.0040ea2c
test eax, eax
mov byte [0x4d01b2], bl
pop edi
setne al
add al, 0x30
pop esi
mov byte [0x4d006b], al
pop ebx
mov esp, ebp
pop ebp
ret