Function at 0x4046e0
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f0
push ebx
push esi
push edi
lea edi, [ebp - 0x8f0]
mov ecx, 0x23c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x44], 0
mov ecx, 0xb
xor eax, eax
lea edi, [ebp - 0x42]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], 0
xor eax, eax
mov dword [ebp - 0x5a], eax
mov dword [ebp - 0x56], eax
mov dword [ebp - 0x52], eax
mov word [ebp - 0x4e], ax
mov dword [ebp - 0x448], 0x1f4
mov esi, esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00406d00
mov esi, esp
push 0x64
lea ecx, [ebp - 0x4ac]
push ecx
push str.a3d2peUt
call fcn.00406c80
add esp, 4
push eax
push str.a3d2peUt
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 0x8b0], eax
mov edx, dword [ebp - 0x8b0]
mov word [ebp + edx*2 - 0x4ac], 0
mov esi, esp
push 0x400
lea eax, [ebp - 0x8ac]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406c80
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8b0]
mov word [ebp + eax*2 - 0x8ac], 0
mov esi, esp
lea ecx, [ebp - 8]
push ecx
push 0x427060
push 1
push 0
push 0x427080
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40482c
jmp 0x404aa5
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x427040
push 0x427070
lea eax, [ebp - 0x4ac]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
call dword [edx + 0x20]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404864
jmp 0x404aa0
mov esi, esp
lea ecx, [ebp - 0x8ac]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [eax + 0x80]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404891
jmp 0x404a9b
mov esi, esp
push 0x2000
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [eax + 0x70]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4048b9
jmp 0x404a96
mov esi, esp
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp esi, esp
call fcn.00406d00
mov esi, esp
push 0
lea ecx, [ebp - 0x444]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [eax + 0x78]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404902
jmp 0x404a91
mov esi, esp
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
call dword [edx + 0xc]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40492d
jmp 0x404a8c
mov esi, esp
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp esi, esp
call fcn.00406d00
mov word [ebp - 0x44], 0x30
mov dx, word [ebp - 0x56]
mov word [ebp - 0x3c], dx
mov ax, word [ebp - 0x5a]
mov word [ebp - 0x3e], ax
mov cx, word [ebp - 0x5c]
mov word [ebp - 0x40], cx
mov word [ebp - 0x34], 0xf
mov dword [ebp - 0x24], 7
mov word [ebp - 0x20], 1
mov esi, esp
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0xc]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404998
jmp 0x404a87
mov esi, esp
lea eax, [ebp - 0x10]
push eax
push 0x4277f0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
call dword [edx]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4049c3
jmp 0x404a82
mov esi, esp
push 1
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
push eax
call dword [edx + 0x18]
cmp esi, esp
call fcn.00406d00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4049ea
jmp 0x404a7d
mov dword [ebp - 0x4c], 1
cmp dword [ebp - 0xc], 0
je 0x404a0c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [edx + 8]
cmp esi, esp
call fcn.00406d00
cmp dword [ebp - 0x10], 0
je 0x404a27
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 0x10]
push eax
call dword [edx + 8]
cmp esi, esp
call fcn.00406d00
cmp dword [ebp - 0x14], 0
je 0x404a42
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [edx + 8]
cmp esi, esp
call fcn.00406d00
cmp dword [ebp - 8], 0
je 0x404a5d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [edx + 8]
cmp esi, esp
call fcn.00406d00
mov esi, esp
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp esi, esp
call fcn.00406d00
cmp dword [ebp - 0x4c], 0
jne 0x404a76
xor eax, eax
jmp 0x404aaa
mov eax, 1
jmp 0x404aaa
jmp 0x4049f1
jmp 0x4049f1
jmp 0x4049f1
jmp 0x4049f1
jmp 0x4049f1
jmp 0x4049f1
jmp 0x4049f1
jmp 0x4049f1
jmp 0x4049f1
pop edi
pop esi
pop ebx
add esp, 0x8f0
cmp ebp, esp
call fcn.00406d00
mov esp, ebp
pop ebp
ret