Function at 0x4b79b0
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4babd2
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x4dd704]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x248], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jl 0x4b7a4d
lea eax, [ebp - 0x248]
push eax
push 0x4cb0d8
push 1
push 0
push 0x4cb0f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7a4b
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
jmp 0x4b8267
jmp 0x4b7a58
mov eax, dword [ebp - 0x230]
jmp 0x4b8267
lea ecx, [ebp - 0x224]
call fcn.004058d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x224]
call fcn.0040a8a0
lea ecx, [ebp - 0x224]
call fcn.00404330
push eax
mov edx, dword [ebp - 0x248]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x248]
push ecx
mov edx, dword [eax + 0x1c]
call edx
lea eax, [ebp - 0x240]
push eax
push 0x4cb0c8
push 0x4cb0e8
lea ecx, [ebp - 0x224]
call fcn.00404330
push eax
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x248]
push eax
mov ecx, dword [edx + 0x20]
call ecx
mov dword [ebp - 0x280], eax
mov edx, dword [ebp - 0x248]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x248]
push ecx
mov edx, dword [eax + 8]
call edx
cmp dword [ebp - 0x280], 0
jge 0x4b7b1c
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x288], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x288]
jmp 0x4b8267
lea ecx, [ebp - 0x244]
call fcn.004058d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x244]
call fcn.0040a8a0
lea ecx, [ebp - 0x244]
call fcn.00404330
push eax
mov edx, dword [ebp - 0x240]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x240]
push ecx
mov edx, dword [eax + 0x80]
call edx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7baa
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x28c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x28c]
jmp 0x4b8267
lea ecx, [ebp - 0x22c]
call fcn.004058d0
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.0040a8a0
lea ecx, [ebp - 0x22c]
call fcn.00404330
push eax
mov edx, dword [ebp - 0x240]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x240]
push ecx
mov edx, dword [eax + 0x88]
call edx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7c47
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x290]
jmp 0x4b8267
lea ecx, [ebp - 0x228]
call fcn.004058d0
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 0x14]
push ecx
lea ecx, [ebp - 0x228]
call fcn.0040a8a0
lea ecx, [ebp - 0x228]
call fcn.00404330
push eax
mov edx, dword [ebp - 0x240]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x240]
push ecx
mov edx, dword [eax + 0x90]
call edx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7cf3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x294], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x294]
jmp 0x4b8267
lea ecx, [ebp - 0x23c]
push ecx
push 0x4bda40
mov edx, dword [ebp - 0x240]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x240]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7d7d
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x298]
jmp 0x4b8267
mov dword [ebp - 0x220], 0x104
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x240]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x240]
push eax
mov ecx, dword [edx + 0x78]
call ecx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7e23
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x29c], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x29c]
jmp 0x4b8267
push 0x2001
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x240]
push edx
mov eax, dword [ecx + 0x70]
call eax
push 1
push 0
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7edc
cmp dword [ebp - 0x280], 0x80041315
jne 0x4b7e80
push 0
push 0
push 0x4c8a68
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x2a0], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x2a0]
jmp 0x4b8267
mov word [ebp - 0x27c], 0
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x27c]
push ecx
mov edx, dword [ebp - 0x240]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x240]
push ecx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7f72
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x2a4]
jmp 0x4b8267
push 1
push 0
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b7ff5
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x2a8], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x2a8]
jmp 0x4b8267
mov word [ebp - 0x238], 1
push 0x30
push 0
lea eax, [ebp - 0x278]
push eax
call fcn.004858f0
add esp, 0xc
mov word [ebp - 0x268], 0xe
mov word [ebp - 0x266], 0x28
mov word [ebp - 0x270], 0xc
mov word [ebp - 0x272], 0xb
mov word [ebp - 0x274], 0x7d4
mov word [ebp - 0x278], 0x30
mov dword [ebp - 0x258], 6
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x250], edx
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x284]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x284]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov dword [ebp - 0x280], eax
mov edx, dword [ebp - 0x284]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x284]
push ecx
mov edx, dword [eax + 8]
call edx
cmp dword [ebp - 0x280], 0
jge 0x4b8103
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x2ac]
jmp 0x4b8267
push 1
push 0
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x280], eax
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x23c]
push ecx
mov edx, dword [eax + 8]
call edx
cmp dword [ebp - 0x280], 0
jge 0x4b819a
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x2b0]
jmp 0x4b8267
mov ecx, dword [ebp - 0x240]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x240]
push eax
mov ecx, dword [edx + 8]
call ecx
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jge 0x4b8216
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x2b4], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x2b4]
jmp 0x4b8267
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040a880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.0040a880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.0040a880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040a880
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00485605
mov esp, ebp
pop ebp
ret