Function at 0x180001042
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0xd78
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.180003a96
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
lea rdx, [rbp - 0x5a8]
call fcn.180003db0
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp - 0x7a8]
call fcn.180003db0
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.ole32.dll_CoInitialize]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [0x1800060c3]
mov rdx, 0x10
lea r8, [rbp - 0x9a8]
call fcn.180002e90
add rsp, 0x20
sub rsp, 0x20
lea rcx, [0x1800060d3]
mov rdx, 0x10
lea r8, [rbp - 0xaa8]
call fcn.180002e90
add rsp, 0x20
sub rsp, 0x30
lea rcx, [rbp - 0x9a8]
mov rdx, 0
mov r8, 1
lea r9, [rbp - 0xaa8]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
cmp eax, 0
jl 0x18000151b
sub rsp, 0x20
lea rcx, [0x1800060e3]
mov rdx, 0x10
lea r8, [rbp - 0xba8]
call fcn.180002e90
add rsp, 0x20
sub rsp, 0x20
lea rcx, [0x1800060f3]
mov rdx, 0x10
lea r8, [rbp - 0xca8]
call fcn.180002e90
add rsp, 0x20
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x5a8]
lea r8, [rbp - 0xca8]
lea r9, [rbp - 0xba8]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov rax, qword [rcx]
call qword [rax + 0x40]
add rsp, 0x30
cmp eax, 0
jl 0x180001509
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rdx, 0x2202
mov rax, qword [rcx]
call qword [rax + 0xe0]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x448]
mov rdx, 0x400
call fcn.180003a96
add rsp, 0x20
sub rsp, 0x20
call fcn.180003144
add rsp, 0x20
cmp eax, 0x4000
je 0x180001219
cmp eax, 0x3000
jne 0x18000121c
nop
jmp 0x18000124a
mov qword [rbp - 0x448], 0x100
sub rsp, 0x20
mov rcx, 2
lea rdx, [rbp - 0x440]
lea r8, [rbp - 0x448]
call qword [sym.imp.secur32.dll_GetUserNameExW]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x440]
mov r8, 0
mov rax, qword [rcx]
call qword [rax + 0xf0]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x7a8]
mov rax, qword [rcx]
call qword [rax + 0x100]
add rsp, 0x20
cmp qword [rbp + 0x28], 0
je 0x1800012c4
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp - 0x8a8]
call fcn.180003db0
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x8a8]
mov rax, qword [rcx]
call qword [rax + 0x110]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
movabs rdx, 0xd65cb580
mov rax, qword [rcx]
call qword [rax + 0x150]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x458]
lea r8, [rbp - 0x450]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x20
cmp eax, 0
jl 0x1800014f7
sub rsp, 0x20
lea rcx, [rbp - 0x488]
mov rdx, 0x30
call fcn.180003a96
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x4a0]
call qword [sym.imp.kernel32.dll_GetLocalTime]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x4a0]
lea rdx, [rbp - 0x4a8]
call qword [sym.imp.kernel32.dll_SystemTimeToFileTime]
add rsp, 0x20
mov eax, 0x47868c00
cmp qword [rbp + 0x30], 1
jne 0x180001369
mov eax, 0x29b92700
xor edx, edx
add dword [rbp - 0x4a8], eax
adc dword [rbp - 0x4a4], edx
sub rsp, 0x20
lea rcx, [rbp - 0x4a8]
lea rdx, [rbp - 0x4a0]
call qword [sym.imp.kernel32.dll_FileTimeToSystemTime]
add rsp, 0x20
cmp qword [rbp + 0x30], 0
jne 0x1800013c3
mov dword [rbp - 0x468], 1
mov qword [rbp - 0x464], 1
mov dword [rbp - 0x474], 0x5a0
mov dword [rbp - 0x470], 2
mov word [rbp - 0x488], 0x30
mov ax, word [rbp - 0x496]
mov word [rbp - 0x476], ax
mov ax, word [rbp - 0x498]
mov word [rbp - 0x478], ax
mov ax, word [rbp - 0x49a]
mov word [rbp - 0x480], ax
mov ax, word [rbp - 0x49e]
mov word [rbp - 0x482], ax
mov ax, word [rbp - 0x4a0]
mov word [rbp - 0x484], ax
add ax, 0x64
mov word [rbp - 0x47e], ax
mov word [rbp - 0x47c], 1
mov word [rbp - 0x47a], 1
sub rsp, 0x20
mov rcx, qword [rbp - 0x450]
lea rdx, [rbp - 0x488]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [0x180006103]
mov rdx, 0x10
lea r8, [rbp - 0xda8]
call fcn.180002e90
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0xda8]
lea r8, [rbp - 0x490]
mov rax, qword [rcx]
call qword [rax]
add rsp, 0x20
cmp eax, 0
jl 0x1800014e2
sub rsp, 0x20
mov rcx, qword [rbp - 0x490]
mov rdx, 0
mov r8, 1
mov rax, qword [rcx]
call qword [rax + 0x30]
add rsp, 0x20
cmp qword [rbp + 0x38], 0
je 0x1800014cd
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x60]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x490]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x450]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
call qword [sym.imp.ole32.dll_CoUninitialize]
add rsp, 0x20
add rsp, 0xd78
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret