Function at 0x1400e67c0
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f0
mov qword [rsp + 0x178], 0xfffffffffffffffe
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov r13, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov r12, qword [rsp + 0x550]
mov rax, qword [rsp + 0x558]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x50], 0x80004001
lea r8, [rsp + 0x50]
lea rdx, str._Utils::SystemSchedulerVista::CreateTask_
lea rcx, [rsp + 0x180]
call fcn.1400e5130
nop
xor edi, edi
mov qword [rsp + 0x60], rdi
lea ecx, [rdi + 0x18]
call fcn.140129aa4
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400e687d
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x14025f110]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400e6880
mov ecx, 0x8007000e
call fcn.14012afb0
mov rbx, rdi
mov qword [rsp + 0x68], rbx
test rbx, rbx
jne 0x1400e6895
mov ecx, 0x8007000e
call fcn.14012afb0
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400e68a5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x60], rdi
mov rax, qword [r14]
lea r8, [rsp + 0x60]
mov rdx, qword [rbx]
mov rcx, r14
call qword [rax + 0x38]
mov dword [rsp + 0x50], eax
mov rcx, rbx
call fcn.1400e0a90
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x1400e68f9
mov dword [rsp + 0xb8], eax
lea rax, str.ITaskService::GetFolder
mov qword [rsp + 0xc0], rax
lea rdx, [0x1402d6470]
lea rcx, [rsp + 0xb8]
call fcn.14012ccc0
mov rdi, qword [rsp + 0x60]
mov ecx, 0x18
call fcn.140129aa4
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400e6944
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400e6946
test r15, r15
je 0x1400e6946
mov ecx, 0x8007000e
call fcn.14012afb0
xor ebx, ebx
mov qword [rsp + 0x68], rbx
test rbx, rbx
jne 0x1400e695b
mov ecx, 0x8007000e
call fcn.14012afb0
nop
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rdi
call qword [rax + 0x78]
nop
mov rcx, rbx
call fcn.1400e0a90
nop
mov qword [rsp + 0x58], 0
mov rax, qword [r14]
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, r14
call qword [rax + 0x48]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400e69c0
mov dword [rsp + 0xc8], eax
lea rax, str.ITaskService::GetFolder
mov qword [rsp + 0xd0], rax
lea rdx, [0x1402d5f30]
lea rcx, [rsp + 0xc8]
call fcn.14012ccc0
nop
xor r14d, r14d
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
call qword [rax + 0x38]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400e6a0a
mov dword [rsp + 0xd8], eax
lea rax, str.ITaskDefinition::get_RegistrationInfo
mov qword [rsp + 0xe0], rax
lea rdx, [0x1402d5f30]
lea rcx, [rsp + 0xd8]
call fcn.14012ccc0
mov dword [rsp + 0x80], 0x200
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x2e0]
call qword [rax + 0x50]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400e6a70
mov dword [rsp + 0xe8], eax
lea rax, str.IRegistrationInfo::put_Author
mov qword [rsp + 0xf0], rax
lea rdx, [0x1402d5f30]
lea rcx, [rsp + 0xe8]
call fcn.14012ccc0
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.1400e8570
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400e6aaf
mov dword [rsp + 0xf8], eax
lea rax, str.Urils::SystemSchedulerVista::SetTaskPrincipal
mov qword [rsp + 0x100], rax
lea rdx, [0x1402d5f30]
lea rcx, [rsp + 0xf8]
call fcn.14012ccc0
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.1400e8770
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400e6aee
mov dword [rsp + 0x108], eax
lea rax, str.Urils::SystemSchedulerVista::SetTaskSettings
mov qword [rsp + 0x110], rax
lea rdx, [0x1402d5f30]
lea rcx, [rsp + 0x108]
call fcn.14012ccc0
mov r8, r12
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.1400e8980
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400e6b30
mov dword [rsp + 0x118], eax
lea rax, str.Urils::SystemSchedulerVista::SetTaskTrigger
mov qword [rsp + 0x120], rax
lea rdx, [0x1402d5f30]
lea rcx, [rsp + 0x118]
call fcn.14012ccc0
mov r8, r13
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.1400e8270
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400e6b72
mov dword [rsp + 0x128], eax
lea rax, str.Urils::SystemSchedulerVista::SetTaskAction
mov qword [rsp + 0x130], rax
lea rdx, [0x1402d5f30]
lea rcx, [rsp + 0x128]
call fcn.14012ccc0
mov qword [rsp + 0x70], r14
mov eax, 8
mov word [rsp + 0xa0], ax
lea rcx, [0x14025d868]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x1400e6ba9
mov ecx, 0x8007000e
call fcn.14012afb0
nop
movups xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x190], xmm0
movsd xmm1, qword [rsp + 0xb0]
movsd qword [rsp + 0x1a0], xmm1
lea rcx, [rsp + 0x160]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x1b0], xmm0
movsd xmm1, qword [rsp + 0x170]
movsd qword [rsp + 0x1c0], xmm1
lea rcx, [rsp + 0x148]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rsp + 0x148]
movaps xmmword [rsp + 0x2c0], xmm0
movsd xmm1, qword [rsp + 0x158]
movsd qword [rsp + 0x2d0], xmm1
mov rdi, qword [rsp + 0x60]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14007c558
mov rbx, rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400e6c52
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [rsp + 0x70], r14
mov rax, qword [rbx]
test rax, rax
je 0x1400e6c64
mov rdx, qword [rax]
jmp 0x1400e6c67
mov rdx, r14
mov rax, qword [rdi]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x190]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x20], rcx
mov r9d, 6
mov r8, qword [rsp + 0x58]
mov rcx, rdi
call qword [rax + 0x88]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e6ccf
call fcn.1400e0a90
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0x148]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x160]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x1400e6d2d
mov dword [rsp + 0x138], eax
lea rax, str.ITaskFolder::RegisterTaskDefinition
mov qword [rsp + 0x140], rax
lea rdx, [0x1402d5f30]
lea rcx, [rsp + 0x138]
call fcn.14012ccc0
mov rax, qword [rsp + 0x58]
mov rcx, r14
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x88]
mov qword [rdx], rax
mov dword [rsp + 0x50], r14d
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400e6d62
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x70], r14
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400e6d7f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x78], r14
test rcx, rcx
je 0x1400e6d8f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x58], r14
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400e6da5
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov ebx, dword [rsp + 0x50]
lea rcx, [rsp + 0x180]
call fcn.1400e58f0
mov eax, ebx
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.14012a1e0
add rsp, 0x4f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret