Function at 0x403f30
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x206
push eax
mov word [ebp - 0x214], ax
xor edi, edi
lea eax, [ebp - 0x212]
push eax
call fcn.004164b0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x624], ax
push 0x206
push eax
lea eax, [ebp - 0x622]
push eax
call fcn.004164b0
add esp, 0xc
lea eax, [ebp - 0x624]
push esi
push ecx
push eax
push ecx
lea eax, [ebp - 0x214]
push eax
call fcn.00403e30
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.004164b0
add esp, 0xc
call fcn.00402880
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [0x42f8bc]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x404033
cmp dword [esi + 0x48], edi
jne 0x403ff8
push 0x425c88
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
jmp 0x404033
push 0
call fcn.0040c4bf
add esp, 4
push eax
call fcn.0040bb10
add esp, 4
call fcn.0040baef
cdq
mov ecx, 0x22
idiv ecx
shl edx, 8
add edx, str.MRAInplaceViewer
push edx
push str._s.exe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [esi + 0xc]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.00402880
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x864]
push eax
push 0x420330
push 1
push 0
push 0x420350
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x404271
mov eax, dword [ebp - 0x864]
lea edx, [ebp - 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x864]
lea edx, [ebp - 0x860]
push edx
push 0x420320
push 0x420340
mov ecx, dword [eax]
lea edx, [ebp - 0x214]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
js 0x404271
mov eax, dword [ebp - 0x860]
lea edx, [ebp - 0x41c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov eax, dword [ebp - 0x860]
lea edx, [ebp - 0x624]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x860]
push str._check_update
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x860]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [ebp - 0x860]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
xor eax, eax
push 0x200
push eax
mov word [ebp - 0x82c], ax
lea eax, [ebp - 0x82a]
push eax
call fcn.004164b0
add esp, 0xc
mov dword [ebp - 0x870], 0x101
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 0x860]
lea edx, [ebp - 0x82c]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x860]
lea edx, [ebp - 0x86c]
push edx
lea edx, [ebp - 0x874]
mov esi, 1
push edx
mov ecx, dword [eax]
push eax
mov word [ebp - 0x87c], si
call dword [ecx + 0xc]
test eax, eax
js 0x404220
push 0x30
lea eax, [ebp - 0x85c]
push 0
push eax
call fcn.004164b0
mov eax, 0x30
mov dword [ebp - 0x856], 0x10001
mov word [ebp - 0x85c], ax
lea edx, [ebp - 0x85c]
xor eax, eax
mov dword [ebp - 0x848], 0x5a0
mov dword [ebp - 0x84c], eax
add esp, 0xc
mov eax, 0x7d0
mov dword [ebp - 0x844], 0x1e
mov word [ebp - 0x858], ax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x83c], esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x860]
lea edx, [ebp - 0x868]
push edx
push 0x420310
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x404257
mov eax, dword [ebp - 0x868]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x868]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x860]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x864]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0040b999
mov esp, ebp
pop ebp
ret 4