Function at 0x180001042
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0xd78
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.1800033db
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp - 0x7a8]
call fcn.1800035f6
add rsp, 0x20
lea rdi, [rbp - 0x5a8]
mov r12, 0x13
sub rsp, 0x20
mov rcx, 0x18
call fcn.180003529
add rsp, 0x20
add rax, 0x61
stosw word [rdi], ax
dec r12
jne 0x1800010ab
xor rax, rax
stosw word [rdi], ax
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.ole32.dll_CoInitialize]
add rsp, 0x20
sub rsp, 0x30
lea rcx, [0x1800050b2]
mov rdx, 0
mov r8, 1
lea r9, [0x1800050c2]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
cmp eax, 0
jl 0x18000148b
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x5a8]
lea r8, [0x1800050e2]
lea r9, [0x1800050d2]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov rax, qword [rcx]
call qword [rax + 0x40]
add rsp, 0x30
cmp eax, 0
jl 0x180001479
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rdx, 0x2202
mov rax, qword [rcx]
call qword [rax + 0xe0]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x448]
mov rdx, 0x400
call fcn.1800033db
add rsp, 0x20
sub rsp, 0x20
call fcn.180002b96
add rsp, 0x20
cmp eax, 0x4000
je 0x1800011ab
cmp eax, 0x3000
jne 0x1800011ae
nop
jmp 0x1800011dc
mov qword [rbp - 0x448], 0x100
sub rsp, 0x20
mov rcx, 2
lea rdx, [rbp - 0x440]
lea r8, [rbp - 0x448]
call qword [sym.imp.secur32.dll_GetUserNameExW]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x440]
mov r8, 0
mov rax, qword [rcx]
call qword [rax + 0xf0]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x7a8]
mov rax, qword [rcx]
call qword [rax + 0x100]
add rsp, 0x20
cmp qword [rbp + 0x28], 0
je 0x180001256
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp - 0x8a8]
call fcn.1800035f6
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x8a8]
mov rax, qword [rcx]
call qword [rax + 0x110]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
movabs rdx, 0xd65cb580
mov rax, qword [rcx]
call qword [rax + 0x150]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x458]
lea r8, [rbp - 0x450]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x20
cmp eax, 0
jl 0x180001467
sub rsp, 0x20
lea rcx, [rbp - 0x488]
mov rdx, 0x30
call fcn.1800033db
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x4a0]
call qword [sym.imp.kernel32.dll_GetLocalTime]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x4a0]
lea rdx, [rbp - 0x4a8]
call qword [sym.imp.kernel32.dll_SystemTimeToFileTime]
add rsp, 0x20
mov eax, 0x47868c00
cmp qword [rbp + 0x30], 1
jne 0x1800012fb
mov eax, 0x29b92700
xor edx, edx
add dword [rbp - 0x4a8], eax
adc dword [rbp - 0x4a4], edx
sub rsp, 0x20
lea rcx, [rbp - 0x4a8]
lea rdx, [rbp - 0x4a0]
call qword [sym.imp.kernel32.dll_FileTimeToSystemTime]
add rsp, 0x20
cmp qword [rbp + 0x30], 0
jne 0x180001355
mov dword [rbp - 0x468], 1
mov qword [rbp - 0x464], 1
mov dword [rbp - 0x474], 0x5a0
mov dword [rbp - 0x470], 2
mov word [rbp - 0x488], 0x30
mov ax, word [rbp - 0x496]
mov word [rbp - 0x476], ax
mov ax, word [rbp - 0x498]
mov word [rbp - 0x478], ax
mov ax, word [rbp - 0x49a]
mov word [rbp - 0x480], ax
mov ax, word [rbp - 0x49e]
mov word [rbp - 0x482], ax
mov ax, word [rbp - 0x4a0]
mov word [rbp - 0x484], ax
add ax, 0x64
mov word [rbp - 0x47e], ax
mov word [rbp - 0x47c], 1
mov word [rbp - 0x47a], 1
sub rsp, 0x20
mov rcx, qword [rbp - 0x450]
lea rdx, [rbp - 0x488]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [0x1800050f2]
lea r8, [rbp - 0x490]
mov rax, qword [rcx]
call qword [rax]
add rsp, 0x20
cmp eax, 0
jl 0x180001452
sub rsp, 0x20
mov rcx, qword [rbp - 0x490]
mov rdx, 0
mov r8, 1
mov rax, qword [rcx]
call qword [rax + 0x30]
add rsp, 0x20
cmp qword [rbp + 0x38], 0
je 0x18000143d
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x60]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x490]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x450]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
call qword [sym.imp.ole32.dll_CoUninitialize]
add rsp, 0x20
add rsp, 0xd78
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret