Function at 0x45ed60
Capabilities:
Get session user name
Resolve function by parsing pe exports
Schedule task via itaskscheduler

Disassembly:
sub esp, 0x25c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
mov ebx, dword [esp + 0x264]
push ebp
xor ebp, ebp
push esi
mov esi, ecx
cmp ebx, ebp
jne 0x45ed90
mov eax, 1
jmp 0x45ef6d
lea eax, [esp + 0x14]
push eax
push 0x50935c
push 1
push ebp
push 0x50937c
mov dword [esp + 0x28], ebp
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x45ed86
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x50934c
push 0x50936c
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov ecx, dword [eax]
push esi
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
cmp esi, ebp
jl 0x45ef2b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push ebx
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push 0x5093a4
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
push 0x2000
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push str._job
push eax
call edx
push 0x206
lea ecx, [esp + 0x5e]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x64], ax
call fcn.004d1df0
add esp, 0xc
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ebp
lea edx, [esp + 0x5c]
push edx
push eax
mov eax, dword [ecx + 0x78]
call eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x28]
mov dword [esp + 0x28], ebp
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
cmp esi, ebp
jl 0x45ef2b
push 0x30
lea ecx, [esp + 0x2c]
push ebp
push ecx
call fcn.004d1df0
movzx eax, word [edi]
movzx ecx, word [edi + 2]
mov edx, 0x30
mov word [esp + 0x34], dx
mov dx, word [edi + 6]
mov word [esp + 0x38], ax
movzx eax, word [edi + 8]
mov word [esp + 0x3c], dx
mov word [esp + 0x3a], cx
movzx ecx, word [edi + 0xa]
mov edx, 1
mov word [esp + 0x44], ax
mov eax, dword [esp + 0x24]
mov word [esp + 0x58], dx
add esp, 0xc
lea edx, [esp + 0x28]
mov word [esp + 0x3a], cx
mov dword [esp + 0x48], 6
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
cmp esi, ebp
jl 0x45ef2b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push 0x4fbe8c
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
cmp esi, ebp
jl 0x45ef2b
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push ebp
push eax
call edx
mov esi, eax
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x45ef3b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x45ef4b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x45ef5b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x45ef6b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x264]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x25c
ret 4