Function at 0x46acdb
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x4ac]
push edi
push edi
push dword [ebp + 8]
push edi
call fcn.00469e42
push edi
call sub.msvcrt.dll__time64
add eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x20c]
adc edx, dword [ebp - 0x4a8]
mov dword [esp], 0x208
push edi
push eax
mov dword [ebp - 0x498], edx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x46b0f3
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x48c], edi
push eax
push 0x529640
push 1
push edi
push 0x529660
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov eax, dword [ebp - 0x48c]
js 0x46b0e9
push ebx
lea edx, [ebp - 0x488]
mov dword [ebp - 0x488], edi
mov ecx, dword [eax]
mov ebx, 0x529630
push edx
push ebx
mov esi, str.360_360_
push esi
push eax
call dword [ecx + 0x18]
test eax, eax
js 0x46adb9
mov eax, dword [ebp - 0x48c]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push edi
lea ecx, [ebp - 0x488]
call fcn.00413267
mov eax, dword [ebp - 0x48c]
lea edx, [ebp - 0x488]
push edx
push ebx
push 0x529650
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x20]
test eax, eax
mov eax, dword [ebp - 0x488]
pop ebx
js 0x46b0d9
mov ecx, dword [eax]
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0x80]
mov esi, eax
test esi, esi
jns 0x46ae2b
mov ecx, dword [ebp - 0x488]
test ecx, ecx
je 0x46ae14
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, dword [ebp - 0x48c]
test eax, eax
je 0x46ae24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x46b0f5
push dword [0x5771dc]
call fcn.00416dce
test eax, eax
mov eax, dword [ebp - 0x488]
pop ecx
mov ecx, dword [eax]
je 0x46ae4a
push str.pagetype:25_fromplantask__from360js
jmp 0x46ae4f
push str.pagetype:25_fromplantask
push eax
call dword [ecx + 0x88]
test eax, eax
mov eax, dword [ebp - 0x488]
js 0x46b0d9
mov ecx, dword [eax]
push 0x527fb4
push eax
call dword [ecx + 0x90]
test eax, eax
js 0x46b0d3
xor eax, eax
mov dword [ebp - 0x4a0], 0x104
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x430]
call fcn.004108e3
cmp dword [ebp - 0x41c], 8
lea edx, [ebp - 0x430]
jb 0x46aec8
mov edx, dword [ebp - 0x430]
mov eax, dword [ebp - 0x488]
push edi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
test eax, eax
js 0x46b0c8
mov eax, dword [ebp - 0x488]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
test eax, eax
js 0x46b0c8
mov eax, dword [ebp - 0x488]
lea edx, [ebp - 0x490]
push edx
mov dword [ebp - 0x490], edi
lea edx, [ebp - 0x4a4]
mov dword [ebp - 0x4a4], edi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x46b0b8
push 0x30
pop esi
push esi
lea eax, [ebp - 0x460]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [ebp - 0x460], si
lea eax, [ebp - 0x484]
lea ecx, [ebp - 0x49c]
push eax
call fcn.0046b97d
test eax, eax
je 0x46af5c
mov ax, word [eax + 0xc]
jmp 0x46af5e
xor eax, eax
mov word [ebp - 0x458], ax
lea ecx, [ebp - 0x49c]
lea eax, [ebp - 0x484]
push eax
call fcn.0046b97d
test eax, eax
je 0x46af83
mov ax, word [eax + 0x10]
inc ax
jmp 0x46af85
xor eax, eax
lea ecx, [ebp - 0x49c]
mov word [ebp - 0x45a], ax
call fcn.0046ba57
mov word [ebp - 0x45c], ax
lea ecx, [ebp - 0x49c]
lea eax, [ebp - 0x484]
push eax
call fcn.0046b97d
mov esi, 0xffff
test eax, eax
je 0x46afc6
mov ax, word [eax + 8]
mov word [ebp - 0x450], ax
jmp 0x46afcd
mov word [ebp - 0x450], si
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x49c]
call fcn.0046b97d
test eax, eax
je 0x46aff0
mov ax, word [eax + 4]
mov word [ebp - 0x44e], ax
jmp 0x46aff7
mov word [ebp - 0x44e], si
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x49c]
call fcn.0046b97d
test eax, eax
je 0x46b013
mov ax, word [eax + 0xc]
jmp 0x46b015
xor eax, eax
mov word [ebp - 0x452], ax
lea ecx, [ebp - 0x49c]
lea eax, [ebp - 0x484]
push eax
call fcn.0046b97d
test eax, eax
je 0x46b03a
mov ax, word [eax + 0x10]
inc ax
jmp 0x46b03c
xor eax, eax
lea ecx, [ebp - 0x49c]
mov word [ebp - 0x454], ax
call fcn.0046ba57
push 5
pop ecx
add eax, ecx
mov dword [ebp - 0x440], edi
mov word [ebp - 0x456], ax
lea edx, [ebp - 0x460]
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x44c], 0x5f5e100
mov dword [ebp - 0x448], ecx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x46b0b8
mov eax, dword [ebp - 0x488]
lea edx, [ebp - 0x494]
push edx
mov dword [ebp - 0x494], edi
push 0x54b3f8
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 0x494]
jns 0x46b105
test eax, eax
je 0x46b0b8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x490]
test eax, eax
je 0x46b0c8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x430]
call fcn.00410d88
mov eax, dword [ebp - 0x488]
test eax, eax
je 0x46b0e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48c]
test eax, eax
je 0x46b0f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret 4
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x18]
test eax, eax
mov eax, dword [ebp - 0x494]
js 0x46b0ae
test eax, eax
je 0x46b122
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x490]
test eax, eax
je 0x46b132
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x430]
call fcn.00410d88
mov eax, dword [ebp - 0x488]
test eax, eax
je 0x46b14d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x48c]
test ecx, ecx
je 0x46b15d
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
xor eax, eax
inc eax
jmp 0x46b0f5