Function at 0x40e0c7
Capabilities:
Create directory
Get session user name
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x194
push 0xffffffffffffffff
push 0x466b30
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x49353c]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ax, word [0x479a58]
push 0x18e
mov word [ebp], ax
lea eax, [ebp + 2]
push ecx
push eax
call fcn.00440370
add esp, 0xc
mov dword [ebp - 0x20], 0xc8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.0040da00
push eax
lea eax, [ebp]
push eax
push str.USER:_s___AdminProcess:_d
call fcn.00406531
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0040431c
lea ecx, [ebp - 0x1c]
call fcn.0040431c
lea ecx, [ebp - 0x18]
call fcn.0040431c
lea eax, [ebp]
mov byte [ebp - 4], 3
push eax
call fcn.00443870
pop ecx
push eax
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404b48
lea ecx, [ebp + 0x19c]
call fcn.004046e7
push eax
push 0x480ca0
lea ecx, [ebp - 0x14]
call fcn.0040edae
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x19c]
push eax
call fcn.0040ed85
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
mov bl, al
add ecx, 0xfffffff0
call fcn.00401696
test bl, bl
je 0x40e1cf
lea eax, [ebp + 0x19c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00404926
xor ebx, ebx
jmp 0x40e224
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push str.SYSTEM
call fcn.004040f0
test eax, eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
js 0x40e1fe
push 0x23
pop edx
call fcn.0040dee0
pop ecx
pop ecx
mov byte [ebp - 4], 4
jmp 0x40e20c
push 0x1c
pop edx
call fcn.0040dee0
pop ecx
pop ecx
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.00404926
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401696
mov edi, 0x4811f8
lea ecx, [ebp - 0x10]
push edi
call fcn.0040ed3f
mov esi, str.zoho
push esi
call fcn.00443870
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00404875
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404926
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
lea ecx, [ebp - 0x10]
call fcn.0040ed3f
mov esi, str.ZohoMeeting
push esi
call fcn.00443870
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00404875
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404926
mov esi, dword [ebp - 0x18]
push esi
call fcn.004492b9
pop ecx
test eax, eax
je 0x40e2ae
call fcn.00448fa4
cmp dword [eax], 0x11
je 0x40e2ae
push esi
push str.Unable_to_create_directory:___s
call fcn.004064a1
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x40e2c6
push str.Unable_to_set_working_directory
call fcn.004064a1
pop ecx
jmp 0x40e2c8
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.00401696
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401696
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401696
mov ecx, dword [ebp + 0x19c]
add ecx, 0xfffffff0
call fcn.00401696
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.0043caa2
add ebp, 0x194
leave
ret