Function at 0x10001fc6
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2a4
push ebx
push esi
push edi
lea eax, [ebp - 0x55c]
push eax
push dword [ebp + 8]
call fcn.10002c82
lea eax, [ebp - 0x75c]
push eax
push dword [ebp + 0x10]
call fcn.10002c82
push dword [ebp + 8]
call fcn.10002315
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0x95c]
push eax
push 0x10
push 0x100050bb
call fcn.10002b8a
lea eax, [ebp - 0xa5c]
push eax
push 0x10
push 0x100050cb
call fcn.10002b8a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa5c]
push eax
push 1
push 0
lea eax, [ebp - 0x95c]
push eax
call sub.ole32.dll_CoCreateInstance
cmp eax, 0
jl 0x10002309
lea eax, [ebp - 0xb5c]
push eax
push 0x10
push 0x100050db
call fcn.10002b8a
lea eax, [ebp - 0xc5c]
push eax
push 0x10
push 0x100050eb
call fcn.10002b8a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xb5c]
push eax
lea eax, [ebp - 0xc5c]
push eax
lea eax, [ebp - 0x55c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x20]
call eax
cmp eax, 0
jl 0x100022fe
push 0x2202
mov eax, dword [ebp - 8]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x70]
call eax
push 0x400
lea eax, [ebp - 0x408]
push eax
call fcn.10002b73
call fcn.1000284e
cmp eax, 0x4000
je 0x100020d0
cmp eax, 0x3000
jne 0x100020d3
nop
jmp 0x100020f2
mov dword [ebp - 0x408], 0x100
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push 2
call sub.secur32.dll_GetUserNameExW
push 0
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x78]
call eax
lea eax, [ebp - 0x75c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push eax
call edx
cmp dword [ebp + 0x14], 0
je 0x10002145
lea eax, [ebp - 0x85c]
push eax
push dword [ebp + 0x14]
call fcn.10002c82
lea eax, [ebp - 0x85c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push eax
call edx
push 0xd65cb580
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push eax
call edx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0xc]
call eax
cmp eax, 0
jl 0x100022f3
push 0x30
lea eax, [ebp - 0x440]
push eax
call fcn.10002b73
lea eax, [ebp - 0x454]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x454]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
mov eax, 0x47868c00
cmp dword [ebp + 0x18], 1
jne 0x100021b7
mov eax, 0x29b92700
xor edx, edx
add dword [ebp - 0x45c], eax
adc dword [ebp - 0x458], edx
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x45c]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
cmp dword [ebp + 0x18], 0
jne 0x10002203
mov dword [ebp - 0x420], 1
mov byte [ebp - 0x41c], 1
mov dword [ebp - 0x42c], 0x5a0
mov dword [ebp - 0x428], 2
mov word [ebp - 0x440], 0x30
mov ax, word [ebp - 0x44a]
mov word [ebp - 0x42e], ax
mov ax, word [ebp - 0x44c]
mov word [ebp - 0x430], ax
mov ax, word [ebp - 0x44e]
mov word [ebp - 0x438], ax
mov ax, word [ebp - 0x452]
mov word [ebp - 0x43a], ax
mov ax, word [ebp - 0x454]
mov word [ebp - 0x43c], ax
add ax, 0x64
mov word [ebp - 0x436], ax
mov word [ebp - 0x434], 1
mov word [ebp - 0x432], 1
lea eax, [ebp - 0x440]
push eax
mov eax, dword [ebp - 0x40c]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push eax
call edx
lea eax, [ebp - 0xd5c]
push eax
push 0x10
push 0x100050fb
call fcn.10002b8a
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xd5c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx]
call eax
cmp eax, 0
jl 0x100022e5
push 1
push 0
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
cmp dword [ebp + 0x1c], 0
je 0x100022d7
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push eax
call edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x40c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call sub.ole32.dll_CoUninitialize
pop edi
pop esi
pop ebx
leave
ret 0x18