Function at 0x403c90
Capabilities:
Create directory
Create thread
Delete file
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [sym.imp.MSVCR100.dll__pgmptr]
mov eax, dword [eax]
sub esp, 0x1c
push ebx
push esi
mov ecx, eax
push edi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x403ca8
sub ecx, esi
mov edi, ecx
mov esi, 0x64ed9c
call fcn.004051c0
push 0x586400
push esi
mov ebx, 1
call fcn.00404970
push 0
push 0x5861b8
inc eax
push 0
mov ecx, esi
call fcn.004046f0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x403af0
push 0
push 0
call ebx
call fcn.00403a10
call fcn.00403bf0
test eax, eax
jne 0x403e20
push 0x64ed60
push 0x65cdd0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, 0x65cdd0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403d20
sub eax, edx
mov edi, eax
mov eax, 0x65cdd0
mov esi, 0x64ed64
call fcn.004051c0
call fcn.00403700
test eax, eax
je 0x403d6b
push 1
call fcn.0049d980
add esp, 4
test eax, eax
jne 0x403d5f
push 2
call fcn.0049d980
add esp, 4
test eax, eax
je 0x403d6b
mov dword [0x65cdcc], 5
jmp 0x403d75
mov dword [0x65cdcc], 7
xor edi, edi
push edi
push edi
push edi
push 0x403770
push edi
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x65c878], eax
cmp dword [0x65f9ec], edi
je 0x403dbd
call esi
cmp eax, 0xb7
jne 0x403dbd
mov ecx, dword [0x65f9ec]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x65f9ec], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call esi
cmp eax, 0xb7
je 0x403e20
mov eax, dword [ebp + 0x10]
mov dword [0x65c884], edi
mov dword [0x65c880], edi
mov dword [0x65c87c], edi
call fcn.00404590
test eax, eax
je 0x403e20
call fcn.004045e0
test eax, eax
je 0x403e3f
mov edx, dword [0x65c9c4]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 4
push str.Error_
push str.You_should_not_execute_directly_this_file__
push edx
call esi
push edi
push str.Error_
push str.You_should_not_execute_directly_this_file__
cmp eax, 7
jne 0x403e2b
mov eax, dword [0x65c9c4]
push eax
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x65c9c4]
push ecx
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
push 0x586448
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
call fcn.00527920
add esp, 4
push str._____________________Client_Start______________________
call fcn.00527920
add esp, 4
push str._______________________________________________________
call fcn.00527920
add esp, 4
call fcn.00404440
push 0x683418
call fcn.00536860
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push str.Oct_18_2023
push 0x65c8a0
push 0x698232
push str._s__F5_AUTO___PatchVer_:__s_t___Build_:__s
push 0x65cbc8
call esi
add esp, 0x14
push str.Oct_18_2023
push 0x65c8a0
push 0x698232
push str._s__F5_AUTO___PatchVer_:__s_t___Build_:__s
push 0x65c9c8
call esi
mov esi, dword [ebp + 8]
add esp, 0x14
mov eax, esi
call fcn.00403f80
mov ecx, 0x683418
call fcn.005317e0
call fcn.004e94c0
call fcn.004e92c0
push 0x681934
call fcn.004ebc40
call fcn.004e9770
call fcn.0042aa20
mov edx, dword [ebp + 0x14]
push edx
push esi
call fcn.00403fe0
add esp, 8
test eax, eax
jne 0x403f21
call fcn.00404570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
je 0x403f56
lea ecx, [esp + 0xc]
push ecx
call ebx
lea edx, [esp + 0xc]
push edx
call edi
jmp 0x403f33
call fcn.00407080
cmp eax, 0xffffffff
jne 0x403f33
call fcn.00404570
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10