Function at 0x180001121
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0xd78
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.180009e0b
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
lea rdx, [rbp - 0x5a8]
call fcn.18000a125
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp - 0x7a8]
call fcn.18000a125
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.ole32.dll_CoInitialize]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [0x18000d0c5]
mov rdx, 0x10
lea r8, [rbp - 0x9a8]
call fcn.18000386c
add rsp, 0x20
sub rsp, 0x20
lea rcx, [0x18000d0d5]
mov rdx, 0x10
lea r8, [rbp - 0xaa8]
call fcn.18000386c
add rsp, 0x20
sub rsp, 0x30
lea rcx, [rbp - 0x9a8]
mov rdx, 0
mov r8, 1
lea r9, [rbp - 0xaa8]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
cmp eax, 0
jl 0x1800015fa
sub rsp, 0x20
lea rcx, [0x18000d0e5]
mov rdx, 0x10
lea r8, [rbp - 0xba8]
call fcn.18000386c
add rsp, 0x20
sub rsp, 0x20
lea rcx, [0x18000d0f5]
mov rdx, 0x10
lea r8, [rbp - 0xca8]
call fcn.18000386c
add rsp, 0x20
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x5a8]
lea r8, [rbp - 0xca8]
lea r9, [rbp - 0xba8]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov rax, qword [rcx]
call qword [rax + 0x40]
add rsp, 0x30
cmp eax, 0
jl 0x1800015e8
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rdx, 0x2202
mov rax, qword [rcx]
call qword [rax + 0xe0]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x448]
mov rdx, 0x400
call fcn.180009e0b
add rsp, 0x20
sub rsp, 0x20
call fcn.180003d11
add rsp, 0x20
cmp eax, 0x4000
je 0x1800012f8
cmp eax, 0x3000
jne 0x1800012fb
nop
jmp 0x180001329
mov qword [rbp - 0x448], 0x100
sub rsp, 0x20
mov rcx, 2
lea rdx, [rbp - 0x440]
lea r8, [rbp - 0x448]
call qword [sym.imp.secur32.dll_GetUserNameExW]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x440]
mov r8, 0
mov rax, qword [rcx]
call qword [rax + 0xf0]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x7a8]
mov rax, qword [rcx]
call qword [rax + 0x100]
add rsp, 0x20
cmp qword [rbp + 0x28], 0
je 0x1800013a3
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp - 0x8a8]
call fcn.18000a125
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x8a8]
mov rax, qword [rcx]
call qword [rax + 0x110]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
movabs rdx, 0xd65cb580
mov rax, qword [rcx]
call qword [rax + 0x150]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x458]
lea r8, [rbp - 0x450]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x20
cmp eax, 0
jl 0x1800015d6
sub rsp, 0x20
lea rcx, [rbp - 0x488]
mov rdx, 0x30
call fcn.180009e0b
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x4a0]
call qword [sym.imp.kernel32.dll_GetLocalTime]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x4a0]
lea rdx, [rbp - 0x4a8]
call qword [sym.imp.kernel32.dll_SystemTimeToFileTime]
add rsp, 0x20
mov eax, 0x47868c00
cmp qword [rbp + 0x30], 1
jne 0x180001448
mov eax, 0x29b92700
xor edx, edx
add dword [rbp - 0x4a8], eax
adc dword [rbp - 0x4a4], edx
sub rsp, 0x20
lea rcx, [rbp - 0x4a8]
lea rdx, [rbp - 0x4a0]
call qword [sym.imp.kernel32.dll_FileTimeToSystemTime]
add rsp, 0x20
cmp qword [rbp + 0x30], 0
jne 0x1800014a2
mov dword [rbp - 0x468], 1
mov qword [rbp - 0x464], 1
mov dword [rbp - 0x474], 0x5a0
mov dword [rbp - 0x470], 2
mov word [rbp - 0x488], 0x30
mov ax, word [rbp - 0x496]
mov word [rbp - 0x476], ax
mov ax, word [rbp - 0x498]
mov word [rbp - 0x478], ax
mov ax, word [rbp - 0x49a]
mov word [rbp - 0x480], ax
mov ax, word [rbp - 0x49e]
mov word [rbp - 0x482], ax
mov ax, word [rbp - 0x4a0]
mov word [rbp - 0x484], ax
add ax, 0x64
mov word [rbp - 0x47e], ax
mov word [rbp - 0x47c], 1
mov word [rbp - 0x47a], 1
sub rsp, 0x20
mov rcx, qword [rbp - 0x450]
lea rdx, [rbp - 0x488]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [0x18000d105]
mov rdx, 0x10
lea r8, [rbp - 0xda8]
call fcn.18000386c
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0xda8]
lea r8, [rbp - 0x490]
mov rax, qword [rcx]
call qword [rax]
add rsp, 0x20
cmp eax, 0
jl 0x1800015c1
sub rsp, 0x20
mov rcx, qword [rbp - 0x490]
mov rdx, 0
mov r8, 1
mov rax, qword [rcx]
call qword [rax + 0x30]
add rsp, 0x20
cmp qword [rbp + 0x38], 0
je 0x1800015ac
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x60]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x490]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x450]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
call qword [sym.imp.ole32.dll_CoUninitialize]
add rsp, 0x20
add rsp, 0xd78
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret