Function at 0x408de2
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push 0xac0
mov eax, 0x481a40
call fcn.00455d57
mov ebx, dword [ebp + 8]
mov edi, ecx
push dword [edi + 0xbc]
mov esi, edx
push edi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa78], ebx
call fcn.0040a5df
test al, al
jne 0x408e1c
xor eax, eax
inc eax
jmp 0x409282
cmp dword [edi + 8], 4
jl 0x408e3f
fld qword [ebp + 0x14]
sub esp, 0x10
fstp qword [esp + 8]
mov ecx, esi
fld qword [ebp + 0xc]
fstp qword [esp]
push ebx
call fcn.00409603
jmp 0x409282
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xa3c], 7
mov dword [ebp - 0xa40], ebx
mov word [ebp - 0xa50], ax
mov edi, 0x104
push edi
lea eax, [ebp - 0x830]
push eax
push edi
lea eax, [ebp - 0xa38]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push edi
lea eax, [ebp - 0x628]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.0044e09b
add esp, 0x24
lea eax, [ebp - 0x628]
push eax
lea esi, [ebp - 0xac4]
call fcn.00402d59
lea ecx, [ebp - 0x420]
push ecx
push eax
lea eax, [ebp - 0xa94]
push eax
mov byte [ebp - 4], 1
call fcn.0040accc
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 2
call fcn.004017fd
push ebx
push 1
lea esi, [ebp - 0xa94]
call fcn.00401999
push ebx
push 1
lea esi, [ebp - 0xac4]
mov byte [ebp - 4], bl
call fcn.00401999
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
mov dword [ebp - 0xa5c], eax
jl 0x40926e
lea eax, [ebp - 0xa60]
push eax
push 0x485170
push 1
push ebx
push 0x485190
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 0xa5c], eax
jl 0x409268
push str.Task_scheduler_connect_to_ITaskscheduler
call fcn.004083b8
mov eax, dword [ebp - 0xa60]
pop ecx
mov ecx, dword [eax]
lea edx, [ebp - 0xa58]
push edx
push 0x485150
push 0x485180
mov esi, str.Norton_PC_Checkup_Setup
push esi
push eax
call dword [ecx + 0x20]
mov dword [ebp - 0xa5c], eax
cmp eax, 0x80070050
jne 0x408fa8
push str.Task_already_exists
call fcn.004083b8
mov eax, dword [ebp - 0xa60]
pop ecx
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x1c]
push str.Delete_task
call fcn.004083b8
mov eax, dword [ebp - 0xa60]
pop ecx
mov ecx, dword [eax]
lea edx, [ebp - 0xa58]
push edx
push 0x485150
push 0x485180
push esi
push eax
call dword [ecx + 0x20]
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], ebx
jl 0x40925c
push str.Construct_new_task
call fcn.004083b8
cmp dword [ebp - 0xa3c], 8
pop ecx
mov ecx, dword [ebp - 0xa50]
jae 0x408fd4
lea ecx, [ebp - 0xa50]
mov eax, dword [ebp - 0xa58]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x90]
mov eax, dword [ebp - 0xa58]
push dword [ebp - 0xa78]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x88]
mov eax, dword [ebp - 0xa58]
push dword [ebp - 0xa64]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x80]
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x218]
push eax
push 2
mov dword [ebp - 0xa74], edi
call sub.Secur32.dll_GetUserNameExW
mov eax, dword [ebp - 0xa58]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x218]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0xa58]
mov ecx, dword [eax]
push 0x2002
push eax
call dword [ecx + 0x70]
mov eax, dword [ebp - 0xa58]
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x28]
fldz
fcomp qword [ebp + 0xc]
push 0x30
pop esi
fnstsw ax
test ah, 0x41
jp 0x40912b
mov eax, dword [ebp - 0xa58]
mov ecx, dword [eax]
lea edx, [ebp - 0xa64]
push edx
lea edx, [ebp - 0xa5c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x40912b
push str.Created_delayed_trigger_connection
call fcn.004083b8
pop ecx
push esi
lea eax, [ebp - 0xaa8]
push ebx
push eax
call fcn.0044d3d0
fld qword [ebp + 0xc]
mov eax, esi
add esp, 4
mov word [ebp - 0xaa8], ax
fstp qword [esp]
lea eax, [ebp - 0xacc]
push eax
call fcn.0040a3fb
mov ax, word [ebp - 0xac0]
mov word [ebp - 0xaa0], ax
mov eax, dword [ebp - 0xabc]
inc eax
mov word [ebp - 0xaa2], ax
mov eax, dword [ebp - 0xab8]
add eax, 0x76c
mov word [ebp - 0xaa4], ax
mov ax, word [ebp - 0xac4]
mov word [ebp - 0xa98], ax
mov ax, word [ebp - 0xac8]
mov word [ebp - 0xa96], ax
mov eax, dword [ebp - 0xa64]
lea edx, [ebp - 0xaa8]
push edx
mov dword [ebp - 0xa88], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xa58]
mov ecx, dword [eax]
lea edx, [ebp - 0xa6c]
push edx
lea edx, [ebp - 0xa70]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
mov dword [ebp - 0xa5c], eax
jl 0x40925c
push str.Created_trigger_connection
call fcn.004083b8
pop ecx
push esi
lea eax, [ebp - 0xaa8]
push ebx
push eax
call fcn.0044d3d0
fldz
add esp, 4
fstp qword [esp]
lea eax, [ebp - 0xacc]
push eax
mov word [ebp - 0xaa8], si
call fcn.0040a3fb
mov ax, word [ebp - 0xac0]
mov word [ebp - 0xaa0], ax
mov eax, dword [ebp - 0xabc]
inc eax
mov word [ebp - 0xaa2], ax
mov eax, dword [ebp - 0xab8]
add eax, 0x76c
mov word [ebp - 0xaa4], ax
mov ax, word [ebp - 0xac4]
mov word [ebp - 0xa98], ax
mov ax, word [ebp - 0xac8]
mov word [ebp - 0xa96], ax
mov eax, dword [ebp - 0xa6c]
lea edx, [ebp - 0xaa8]
push edx
mov dword [ebp - 0xa88], 7
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, ebx
mov dword [ebp - 0xa5c], eax
jl 0x40925c
push str.Set_triggers
call fcn.004083b8
mov eax, dword [ebp - 0xa58]
pop ecx
mov ecx, dword [eax]
lea edx, [ebp - 0xa68]
push edx
push 0x487e8c
push eax
call dword [ecx]
cmp eax, ebx
mov dword [ebp - 0xa5c], eax
jl 0x409250
push str.Save_task
call fcn.004083b8
mov eax, dword [ebp - 0xa68]
pop ecx
mov ecx, dword [eax]
push 1
push ebx
push eax
call dword [ecx + 0x18]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0xa68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xa58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xa60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
push 1
lea esi, [ebp - 0xa54]
call fcn.00401999
mov eax, dword [ebp - 0xa5c]
call fcn.00455dda
ret 0x14