Function at 0x4404a0
Capabilities:
Get session user name

Disassembly:
mov eax, dword [0x655eb0]
sub esp, 0x304
test eax, eax
push esi
je case.0x44064b.20006
push 1
push 0x655eb4
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4404e6
push 0
push 0x655eb4
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4404e6
or eax, eax
pop esi
add esp, 0x304
ret
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [esp + 0x48]
push 0x40
push eax
push 0
push 0
push 2
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea ecx, [esp + 8]
push 0x40
push ecx
push 0
push 0
push 2
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea edx, [esp + 4]
lea eax, [esp + 0x88]
push edx
push eax
mov dword [esp + 0xc], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0x30c]
cmp eax, 0x4e21
jg 0x440635
je 0x440621
cmp eax, 0xffffffff
jg 0x4405c7
je 0x4405ab
cmp eax, 0xfffffffd
je 0x440587
cmp eax, 0xfffffffe
jne case.0x44064b.20006
lea ecx, [esp + 0x88]
lea edx, [esp + 8]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
lea ecx, [esp + 0x114]
push str.InPage_log_enabled_on_Date:__s__at_Time:__s__by_User:__s_n
push ecx
jmp 0x4406e0
lea edx, [esp + 0x88]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x4c]
push eax
push ecx
lea edx, [esp + 0x114]
push str.InPage_log_disabled_on_Date:__s__at_Time:__s__by_User:__s_n
push edx
jmp 0x4406e0
lea eax, [esp + 0x88]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x4c]
push ecx
push edx
push str.InPage_logged_in_on_Date:__s__at_Time:__s__by_User:__s_n
jmp 0x4406d8
cmp eax, 0x4a45
je 0x440601
cmp eax, 0x4e20
jne case.0x44064b.20006
mov edx, dword [esp + 0x310]
lea ecx, [esp + 8]
push ecx
push edx
lea eax, [esp + 0x110]
push str.File___s__opened_at_Time:__s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4406e9
lea ecx, [esp + 8]
lea edx, [esp + 0x108]
push ecx
push str.Created_a_new_InPage_File_at_Time:__s_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4406e9
mov ecx, dword [esp + 0x310]
lea eax, [esp + 8]
push eax
push ecx
push str.File___s__saved_at_Time:__s_n
jmp 0x4406a4
add eax, 0xffffb1de
cmp eax, 0x42
ja case.0x44064b.20006
xor ecx, ecx
mov cl, byte [eax + 0x44073c]
jmp dword [ecx*4 + 0x440728]
lea edx, [esp + 0x88]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x4c]
push eax
push ecx
lea edx, [esp + 0x114]
push str.InPage_logged_out_on_Date:__s__at_Time:__s__by_User:__s_n
push edx
jmp 0x4406e0
mov ecx, dword [esp + 0x310]
lea eax, [esp + 8]
push eax
push ecx
push str.File___s__closed_at_Time:__s_n
jmp 0x4406a4
mov eax, dword [esp + 0x314]
mov ecx, dword [esp + 0x310]
test eax, eax
lea eax, [esp + 8]
push eax
push ecx
jne 0x4406b7
push str.File___s__started_print_at_Time:__s_n
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4406e9
push str.File___s__completed_print_at_Time:__s_n
jmp 0x4406a4
mov eax, dword [esp + 0x314]
mov edx, dword [esp + 0x310]
lea ecx, [esp + 8]
push eax
push ecx
push edx
push str.File___s__saved_as___s__at_Time:__s_n
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x110]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
xor eax, eax
pop esi
add esp, 0x304
ret
xor eax, eax
pop esi
add esp, 0x304
ret