Function at 0x401141
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2a4
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
lea eax, [ebp - 0x55c]
push eax
push dword [ebp + 8]
call fcn.00403980
lea eax, [ebp - 0x75c]
push eax
push dword [ebp + 0x10]
call fcn.00403980
push dword [ebp + 8]
call fcn.004014ab
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0x95c]
push eax
push 0x10
push 0x405163
call fcn.00403501
lea eax, [ebp - 0xa5c]
push eax
push 0x10
push 0x405173
call fcn.00403501
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa5c]
push eax
push 1
push 0
lea eax, [ebp - 0x95c]
push eax
call sub.ole32.dll_CoCreateInstance
cmp eax, 0
jl 0x40149f
lea eax, [ebp - 0xb5c]
push eax
push 0x10
push 0x405183
call fcn.00403501
lea eax, [ebp - 0xc5c]
push eax
push 0x10
push 0x405193
call fcn.00403501
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xb5c]
push eax
lea eax, [ebp - 0xc5c]
push eax
lea eax, [ebp - 0x55c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x20]
call eax
cmp eax, 0
jl 0x401494
push 0x2202
mov eax, dword [ebp - 8]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x70]
call eax
push 0x400
lea eax, [ebp - 0x408]
push eax
call fcn.004037af
call fcn.004036ec
mov dword [ebp - 0x408], 0x100
cmp eax, 0x4000
jne 0x401273
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
call sub.advapi32.dll_GetUserNameW
jmp 0x401288
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push 2
call sub.secur32.dll_GetUserNameExW
push 0
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x78]
call eax
lea eax, [ebp - 0x75c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push eax
call edx
cmp dword [ebp + 0x14], 0
je 0x4012db
lea eax, [ebp - 0x85c]
push eax
push dword [ebp + 0x14]
call fcn.00403980
lea eax, [ebp - 0x85c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push eax
call edx
push 0xd65cb580
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push eax
call edx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0xc]
call eax
cmp eax, 0
jl 0x401489
push 0x30
lea eax, [ebp - 0x440]
push eax
call fcn.004037af
lea eax, [ebp - 0x454]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x454]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
mov eax, 0x47868c00
cmp dword [ebp + 0x18], 1
jne 0x40134d
mov eax, 0x29b92700
xor edx, edx
add dword [ebp - 0x45c], eax
adc dword [ebp - 0x458], edx
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x45c]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
cmp dword [ebp + 0x18], 0
jne 0x401399
mov dword [ebp - 0x420], 1
mov byte [ebp - 0x41c], 1
mov dword [ebp - 0x42c], 0x5a0
mov dword [ebp - 0x428], 2
mov word [ebp - 0x440], 0x30
mov ax, word [ebp - 0x44a]
mov word [ebp - 0x42e], ax
mov ax, word [ebp - 0x44c]
mov word [ebp - 0x430], ax
mov ax, word [ebp - 0x44e]
mov word [ebp - 0x438], ax
mov ax, word [ebp - 0x452]
mov word [ebp - 0x43a], ax
mov ax, word [ebp - 0x454]
mov word [ebp - 0x43c], ax
add ax, 0x64
mov word [ebp - 0x436], ax
mov word [ebp - 0x434], 1
mov word [ebp - 0x432], 1
lea eax, [ebp - 0x440]
push eax
mov eax, dword [ebp - 0x40c]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push eax
call edx
lea eax, [ebp - 0xd5c]
push eax
push 0x10
push 0x4051a3
call fcn.00403501
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xd5c]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx]
call eax
cmp eax, 0
jl 0x40147b
push 1
push 0
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
cmp dword [ebp + 0x1c], 0
je 0x40146d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push eax
call edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x40c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call sub.ole32.dll_CoUninitialize
pop edi
pop esi
pop ebx
leave
ret 0x18