Function at 0x4099d0
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x206
push eax
mov word [ebp - 0x41c], ax
xor edi, edi
lea eax, [ebp - 0x41a]
push eax
call fcn.004173f0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x82c], ax
push 0x206
push eax
lea eax, [ebp - 0x82a]
push eax
call fcn.004173f0
add esp, 0xc
lea eax, [ebp - 0x82c]
push esi
push ecx
push eax
push ecx
lea eax, [ebp - 0x41c]
push eax
call fcn.00409800
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.004173f0
add esp, 0xc
call fcn.00405620
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [0x42b470]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x409abc
push dword [esi + 0xc]
push str.REName
sub esp, 8
call fcn.00407330
test al, al
jne 0x409abc
push str.MPlayer.exe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push dword [esi + 0xc]
push str.REName
push str.SOFTWARE114zhibo
push 0x80000002
call fcn.004072a0
mov eax, dword [esi + 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.00405620
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x86c]
push eax
push 0x4213a0
push 1
push 0
push 0x4213c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x409cfa
mov eax, dword [ebp - 0x86c]
lea edx, [ebp - 0x41c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x86c]
lea edx, [ebp - 0x868]
push edx
push 0x421390
push 0x4213b0
mov ecx, dword [eax]
lea edx, [ebp - 0x41c]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
js 0x409cfa
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x82c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x868]
push str._check_update
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x868]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [ebp - 0x868]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
xor eax, eax
push 0x200
push eax
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push eax
call fcn.004173f0
add esp, 0xc
mov dword [ebp - 0x830], 0x101
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x624]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x870]
push edx
lea edx, [ebp - 0x834]
mov esi, 1
push edx
mov ecx, dword [eax]
push eax
mov word [ebp - 0x87c], si
call dword [ecx + 0xc]
test eax, eax
js 0x409ca9
push 0x30
lea eax, [ebp - 0x864]
push 0
push eax
call fcn.004173f0
mov eax, 0x30
mov dword [ebp - 0x85e], 0x10001
mov word [ebp - 0x864], ax
lea edx, [ebp - 0x864]
xor eax, eax
mov dword [ebp - 0x850], 0x5a0
mov dword [ebp - 0x854], eax
add esp, 0xc
mov eax, 0x7d0
mov dword [ebp - 0x84c], 0x1e
mov word [ebp - 0x860], ax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x844], esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x870]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x874]
push edx
push 0x421380
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x409ce0
mov eax, dword [ebp - 0x874]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x868]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00410c0e
mov esp, ebp
pop ebp
ret 4