Function at 0x401350
Capabilities:
Create directory
Get common file path
Get session user name
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x4016e4
test eax, eax
je 0x4016e4
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x61c], 0x101
push eax
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4013ca
push str.Could_not_get_username_so_lets_continue_in_temp_folder_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401890
add esp, 8
jmp 0x40140c
push str.vmware_
lea eax, [ebp - 0x20c]
push 0xff
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x20c]
push 0xff
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401415
sub ecx, edx
sar ecx, 1
je 0x4016f1
push str.vmware_autostart_helper.log
lea eax, [ebp - 0x20c]
push eax
push str._ls_s
lea eax, [ebp - 0x310]
push 0x104
push eax
call fcn.004018f0
push 0x20
lea eax, [ebp - 0x310]
push 0x40340c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fsopen]
add esp, 0x20
mov dword [0x4053ac], eax
test eax, eax
jne 0x401494
lea eax, [ebp - 0x310]
push eax
push str.Cannot_open_file__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401890
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push str.autostart_helper_called_n
push 0x403354
push eax
call fcn.00401bb0
push dword [esi + 4]
push str.Program_invoked_with_arg__s_n
push dword [0x4053ac]
call fcn.00401bb0
add esp, 0x18
call sub.vmwarebase.DLL_VmdbPoll_InitAndAlloc
cmp dword [ebp + 8], 2
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], 0x402890
jne 0x401713
mov eax, dword [esi]
mov esi, dword [esi + 4]
push 0x5c
push esi
mov dword [0x405028], eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
jne 0x4014f6
mov eax, esi
jmp 0x4014f7
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push str._ls_vmware__s.log
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004018f0
push 0x20
lea eax, [ebp - 0x414]
push 0x40340c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fsopen]
add esp, 0x20
mov dword [0x4053a8], eax
test eax, eax
jne 0x401540
lea eax, [ebp - 0x414]
jmp 0x401472
push esi
push str.vmxPath_s_n
push eax
call fcn.00401bb0
push str.Calling_VigorOffline_Alloc___n
push 0x403354
push dword [0x4053a8]
call fcn.00401bb0
call sub.vmwarebase.DLL_VigorOffline_Alloc
push eax
push str.offline_p_n
push dword [0x4053a8]
mov dword [0x405030], eax
call fcn.00401bb0
push esi
push dword [0x405028]
push str.Starting__s_with_VM__s_n
push dword [0x4053a8]
call fcn.00401bb0
push 0
push 0
push 0
push 0
push esi
push str.init_connection_data
push 0x401220
push dword [0x405030]
call sub.vmwarebase.DLL_VigorOffline_Init
add esp, 0x54
lea eax, [ebp - 0x624]
push dword [0x405030]
push eax
call sub.vmwarebase.DLL_VigorOnline_Init
push eax
push str.online_p_n
push dword [0x4053a8]
mov dword [0x405034], eax
call fcn.00401bb0
push 0x4031b8
push 0
push 0
push 0
push str.online_start_data
push 0x401720
push dword [0x405034]
mov byte [0x40502c], 1
call sub.vmwarebase.DLL_VigorOnline_StartAndConnect
push 0
call fcn.00401920
add esp, 0x34
mov esi, eax
cmp byte [0x40502c], 0
mov edi, edx
je 0x401684
nop word [eax + eax]
push 0
call fcn.00401920
add esp, 4
sub eax, esi
sbb edx, edi
test edx, edx
jg 0x401668
jl 0x401639
cmp eax, 0x1e
jae 0x401668
push dword [0x405028]
push str._s:_waiting..._n
push dword [0x4053a8]
call fcn.00401bb0
push 0
push 0
push 0
call sub.vmwarebase.DLL_Poll_Loop
add esp, 0x18
cmp byte [0x40502c], 0
jne 0x401620
jmp 0x401684
cmp byte [0x40502c], 0
je 0x401684
push str.Timed_out._Check_if_VM_is_not_already_started_or_vmx_file_is_unlocked._n
push dword [0x4053a8]
call fcn.00401bd0
add esp, 8
push dword [0x405028]
push str._s:_Done_nExiting_the_program__n
push dword [0x4053a8]
call fcn.00401bb0
push dword [0x405034]
call sub.vmwarebase.DLL_VigorOnline_Release
push dword [0x405030]
call sub.vmwarebase.DLL_VigorOffline_Release
mov eax, dword [ebp - 0x624]
add esp, 0x14
mov esi, dword [eax + 4]
mov ecx, esi
push eax
call dword [0x403148]
call esi
mov eax, dword [0x4053ac]
add esp, 4
test eax, eax
je 0x4016dd
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push 0
jmp 0x40148e
push str.GetTempPath_failed_n
call fcn.004018c0
add esp, 4
push str.GetLogLocation_failed
call fcn.004018c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
pop edi
call fcn.00401bf0
mov esp, ebp
pop ebp
ret
call fcn.00401930
int3