Function at 0x1000268e
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2a4
push ebx
push esi
push edi
lea eax, [ebp - 0x55c]
push eax
push dword [ebp + 8]
call fcn.10002a7e
lea eax, [ebp - 0x75c]
push eax
push dword [ebp + 0x10]
call fcn.10002a7e
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0x95c]
push eax
push 0x10
push 0x100050ca
call fcn.10001e72
lea eax, [ebp - 0xa5c]
push eax
push 0x10
push 0x100050da
call fcn.10001e72
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa5c]
push eax
push 1
push 0
lea eax, [ebp - 0x95c]
push eax
call sub.ole32.dll_CoCreateInstance
cmp eax, 0
jl 0x100029b8
lea eax, [ebp - 0xb5c]
push eax
push 0x10
push 0x100050ea
call fcn.10001e72
lea eax, [ebp - 0xc5c]
push eax
push 0x10
push 0x100050fa
call fcn.10001e72
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xb5c]
push eax
lea eax, [ebp - 0xc5c]
push eax
lea eax, [ebp - 0x55c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x20]
call eax
cmp eax, 0
jl 0x100029ad
push 0x2202
mov eax, dword [ebp - 8]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x70]
call eax
push 0x400
lea eax, [ebp - 0x408]
push eax
call fcn.10001e5b
call fcn.100029c4
cmp eax, 0x4000
je 0x10002790
cmp eax, 0x3000
jne 0x10002793
nop
jmp 0x100027b2
mov dword [ebp - 0x408], 0x100
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push 2
call sub.secur32.dll_GetUserNameExW
push 0
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x78]
call eax
lea eax, [ebp - 0x75c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push eax
call edx
cmp dword [ebp + 0x14], 0
je 0x10002805
lea eax, [ebp - 0x85c]
push eax
push dword [ebp + 0x14]
call fcn.10002a7e
lea eax, [ebp - 0x85c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push eax
call edx
push 0xd65cb580
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push eax
call edx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0xc]
call eax
cmp eax, 0
jl 0x100029a2
push 0x30
lea eax, [ebp - 0x440]
push eax
call fcn.10001e5b
lea eax, [ebp - 0x454]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x454]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
mov eax, 0x47868c00
cmp dword [ebp + 0x18], 1
jne 0x10002877
mov eax, 0x29b92700
xor edx, edx
add dword [ebp - 0x45c], eax
adc dword [ebp - 0x458], edx
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x45c]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
cmp dword [ebp + 0x18], 0
jne 0x100028b2
mov dword [ebp - 0x42c], 0x80520
mov dword [ebp - 0x428], 2
mov word [ebp - 0x440], 0x30
mov ax, word [ebp - 0x44a]
mov word [ebp - 0x42e], ax
mov ax, word [ebp - 0x44c]
mov word [ebp - 0x430], ax
mov ax, word [ebp - 0x44e]
mov word [ebp - 0x438], ax
mov ax, word [ebp - 0x452]
mov word [ebp - 0x43a], ax
mov ax, word [ebp - 0x454]
mov word [ebp - 0x43c], ax
add ax, 0x64
mov word [ebp - 0x436], ax
mov word [ebp - 0x434], 1
mov word [ebp - 0x432], 1
lea eax, [ebp - 0x440]
push eax
mov eax, dword [ebp - 0x40c]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push eax
call edx
lea eax, [ebp - 0xd5c]
push eax
push 0x10
push 0x1000510a
call fcn.10001e72
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xd5c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx]
call eax
cmp eax, 0
jl 0x10002994
push 1
push 0
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
cmp dword [ebp + 0x1c], 0
je 0x10002986
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push eax
call edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x40c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call sub.ole32.dll_CoUninitialize
pop edi
pop esi
pop ebx
leave
ret 0x18