Function at 0x45b65d
Capabilities:
Get session user name
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3b09
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x28c
mov eax, dword [0x521e28]
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x27c], ecx
mov eax, dword [ebp - 0x27c]
movzx ecx, byte [eax + 4]
test ecx, ecx
je 0x45b5dc
cmp dword [ebp + 8], 0
jne 0x45b5e3
xor al, al
jmp 0x45bc4a
mov edx, dword [ebp - 0x27c]
cmp dword [edx + 0x228], 0
jne 0x45b5f9
mov al, 1
jmp 0x45bc4a
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x280], ecx
mov edx, dword [ebp - 0x280]
sub edx, 1
mov dword [ebp - 0x280], edx
cmp dword [ebp - 0x280], 4
ja case.default.0x45b626
mov eax, dword [ebp - 0x280]
jmp dword [eax*4 + 0x45bc68]
mov ecx, dword [ebp - 0x27c]
cmp dword [ecx + 0x22c], 0
jne 0x45b643
mov al, 1
jmp 0x45bc4a
jmp case.default.0x45b626
mov edx, dword [ebp - 0x27c]
cmp dword [edx + 0x230], 0
jne 0x45b65b
mov al, 1
jmp 0x45bc4a
jmp case.default.0x45b626
mov eax, dword [ebp - 0x27c]
cmp dword [eax + 0x234], 0
jne 0x45b673
mov al, 1
jmp 0x45bc4a
jmp case.default.0x45b626
mov ecx, dword [ebp - 0x27c]
cmp dword [ecx + 0x238], 0
jne 0x45b68b
mov al, 1
jmp 0x45bc4a
jmp case.default.0x45b626
mov edx, dword [ebp - 0x27c]
cmp dword [edx + 0x23c], 0
jne case.default.0x45b626
mov al, 1
jmp 0x45bc4a
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 0x27c]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xaca
call fcn.0048c52d
add esp, 4
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x274]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x24], 0
push 0xaca
push 0
mov edx, dword [ebp - 0x14]
push edx
call fcn.004ad2c0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push SysReAllocString
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call fcn.00405280
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
jl 0x45b744
cmp dword [ebp - 0x24], 0
je 0x45b744
mov edx, dword [ebp + 8]
add edx, 4
push edx
push 0x565
mov eax, dword [ebp - 0x14]
push eax
call fcn.00402280
mov ecx, dword [ebp - 0x27c]
add ecx, 0x244
push ecx
push 0x565
mov edx, dword [ebp - 0x14]
push edx
call fcn.00402280
mov ax, word [0x502dec]
mov word [ebp - 0x3c], ax
xor ecx, ecx
mov dword [ebp - 0x3a], ecx
mov dword [ebp - 0x36], ecx
mov dword [ebp - 0x32], ecx
mov dword [ebp - 0x2e], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0x502e60
push 0x104
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00401cd0
add esp, 0x10
lea edx, [ebp - 0x24]
push edx
push SysReAllocString
lea eax, [ebp - 0x3c]
push eax
call fcn.00405280
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
jl 0x45b7cc
cmp dword [ebp - 0x24], 0
je 0x45b7cc
lea ecx, [ebp - 0x3c]
push ecx
push 0x565
mov edx, dword [ebp - 0x14]
push edx
call fcn.00402280
mov eax, dword [ebp - 0x27c]
add eax, 0x244
push eax
push 0x565
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402280
lea edx, [ebp - 0x24]
push edx
push SysReAllocString
mov eax, dword [ebp + 8]
add eax, 0x40
push eax
call fcn.00405280
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jl 0x45b825
cmp dword [ebp - 0x24], 0
je 0x45b825
mov ecx, dword [ebp + 8]
add ecx, 0x40
push ecx
push 0x565
mov edx, dword [ebp - 0x14]
push edx
call fcn.00402280
mov eax, dword [ebp - 0x27c]
add eax, 0x244
push eax
push 0x565
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402280
lea edx, [ebp - 0x24]
push edx
push SysReAllocString
mov eax, dword [ebp + 8]
add eax, 0xa0
push eax
call fcn.00405280
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
jl 0x45b883
cmp dword [ebp - 0x24], 0
je 0x45b883
mov ecx, dword [ebp + 8]
add ecx, 0xa0
push ecx
push 0x565
mov edx, dword [ebp - 0x14]
push edx
call fcn.00402280
mov eax, dword [ebp - 0x27c]
add eax, 0x244
push eax
push 0x565
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402280
lea edx, [ebp - 0x24]
push edx
push SysReAllocString
mov eax, dword [ebp + 8]
add eax, 0x4a0
push eax
call fcn.00405280
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
jl 0x45b8e1
cmp dword [ebp - 0x24], 0
je 0x45b8e1
mov ecx, dword [ebp + 8]
add ecx, 0x4a0
push ecx
push 0x565
mov edx, dword [ebp - 0x14]
push edx
call fcn.00402280
mov eax, dword [ebp - 0x27c]
add eax, 0x244
push eax
push 0x565
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402280
push 0x208
push 0
mov edx, dword [ebp - 0x27c]
add edx, 0x398
push edx
call fcn.004ad2c0
add esp, 0xc
push 0xa
push 0x208
mov eax, dword [ebp - 0x27c]
add eax, 0x398
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x8a0]
push edx
call fcn.004b4662
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push SysReAllocString
mov ecx, dword [ebp - 0x27c]
add ecx, 0x398
push ecx
call fcn.00405280
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jl 0x45b989
cmp dword [ebp - 0x24], 0
je 0x45b989
mov edx, dword [ebp - 0x27c]
add edx, 0x398
push edx
push 0x565
mov eax, dword [ebp - 0x14]
push eax
call fcn.00402280
jmp 0x45b99c
push 0x502e68
push 0x565
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402280
mov edx, dword [ebp - 0x27c]
add edx, 0x244
push edx
push 0x565
mov eax, dword [ebp - 0x14]
push eax
call fcn.00402280
mov cx, word [0x502e6c]
mov word [ebp - 0x248], cx
push 0x206
push 0
lea edx, [ebp - 0x246]
push edx
call fcn.004ad2c0
add esp, 0xc
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x24]
push eax
push SysReAllocString
mov ecx, dword [ebp + 8]
add ecx, 0x8a4
push ecx
call fcn.00405280
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
jl 0x45ba2c
cmp dword [ebp - 0x24], 0
je 0x45ba2c
mov edx, dword [ebp + 8]
add edx, 0x8a4
push edx
push 0x104
lea eax, [ebp - 0x248]
push eax
call fcn.00405230
jmp 0x45ba57
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x45ba57
push 0x502e70
push 0x104
lea eax, [ebp - 0x248]
push eax
call fcn.00405230
lea ecx, [ebp - 0x248]
push ecx
push 0x565
mov edx, dword [ebp - 0x14]
push edx
call fcn.00402280
mov eax, dword [ebp - 0x27c]
add eax, 0x248
push eax
push 0x565
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402280
push 2
mov edx, dword [ebp - 0x27c]
add edx, 0x5a0
push edx
mov ecx, dword [ebp - 0x27c]
call fcn.0045bc80
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0x27c]
add eax, 0x5a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x45bbb1
mov dword [ebp - 0x258], 0
xor ecx, ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x268], 0
xor edx, edx
mov dword [ebp - 0x264], edx
push 2
lea eax, [ebp - 0x268]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
mov edx, dword [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [ebp - 0x26c], 0
lea ecx, [ebp - 0x26c]
push ecx
push SysReAllocString
mov edx, dword [ebp - 0x14]
push edx
call fcn.00405280
push 0
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x26c]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0xffffffff
push str.Global8642096D_5B83_4777_9300_9D1224C9B10F
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
je 0x45bbab
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x25c], 0
mov byte [ebp - 0x15], 1
jmp 0x45bbcf
mov ecx, dword [ebp - 0x27c]
add ecx, 0x5a0
push ecx
push str.IFileReport___Cant_open__s_n
call fcn.00405640
add esp, 8
mov byte [ebp - 0x15], 0
jmp 0x45bbf4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x45bc11
cmp dword [ebp - 0x1c], 0xffffffff
je 0x45bc11
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x278]
push edx
call fcn.0048c532
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x27c]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004ad2aa
mov esp, ebp
pop ebp
ret 4