Function at 0x4101c0
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c0a3
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push esi
push edi
mov eax, dword [0x557460]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x410ace
cmp dword [ebp + 0xc], 0
je 0x410ace
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 0x51866c
push 0x17
push 0
push 0x5308b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x410245
push eax
push str.Cant_CoCreateInstance_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410aa5
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x6c], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 1
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
test eax, eax
jns 0x4102a0
push eax
push str.Cant_Connect_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a9b
mov dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push 0x517d40
mov byte [ebp - 4], 2
call fcn.0040f010
mov eax, dword [eax]
mov byte [ebp - 4], 3
test eax, eax
je 0x4102c9
mov ecx, dword [eax]
jmp 0x4102cb
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x38]
push edx
push ecx
push esi
call dword [eax + 0x1c]
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x24], eax
test esi, esi
je 0x410329
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x410329
test esi, esi
je 0x410329
mov eax, dword [esi]
test eax, eax
je 0x410304
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x41031b
push eax
call fcn.00440551
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00440184
mov eax, dword [ebp - 0x24]
add esp, 8
test eax, eax
jns 0x410342
push eax
push str.Cant_GetFolder_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a8a
mov dword [ebp - 0x34], 0
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x24]
push 0x517d40
mov byte [ebp - 4], 4
call fcn.0040f010
mov eax, dword [eax]
mov byte [ebp - 4], 5
test eax, eax
je 0x41036b
mov ecx, dword [eax]
jmp 0x41036d
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x34]
push edx
push ecx
push esi
call dword [eax + 0x24]
mov esi, dword [ebp - 0x24]
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 4
test esi, esi
je 0x4103cb
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4103cb
test esi, esi
je 0x4103cb
mov eax, dword [esi]
test eax, eax
je 0x4103a6
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4103bd
push eax
call fcn.00440551
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00440184
mov ecx, dword [ebp - 0x10]
add esp, 8
test ecx, ecx
jns 0x410419
push ecx
push 0x517d40
push str.Cant_GetFolder_:_s___x
call fcn.00411770
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
movups xmm0, xmmword [ebp - 0x6c]
add esp, 0xc
mov edx, dword [eax]
push ecx
sub esp, 0x10
mov ecx, esp
push 0x517d40
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x2c]
test eax, eax
jns 0x410419
push eax
push str.Cant_CreateFolder_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a79
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 6
call dword [ecx + 0x24]
test eax, eax
jns 0x41044c
push eax
push str.Cant_NewTask_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a68
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x30]
push edx
push eax
mov byte [ebp - 4], 7
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x41047d
push eax
push str.Cant_get_Settings:__x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a57
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call fcn.0040fca0
movzx eax, ax
push eax
push esi
call dword [edi + 0x48]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x4104ca
push esi
push str.Cant_put_DisallowStartIfOnBatteries:__x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a57
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 9
call fcn.0040fca0
movzx eax, ax
push eax
push esi
call dword [edi + 0x40]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x410517
push esi
push str.Cant_put_StopIfGoingOnBatteries:__x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a57
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x410548
push eax
push str.Cant_get_Triggers_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a46
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x41057d
push esi
push str.Cant_CreateTask_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a35
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x4105a4
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x518028
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
test ecx, ecx
jne 0x4105c1
push esi
push str.Cant_logon_trigger_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a24
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov edi, dword [ebp - 0x14]
push str.Trigger1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x410af0
mov eax, dword [edi]
push esi
push edi
mov byte [ebp - 4], 0xd
call dword [eax + 0x24]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov byte [ebp - 4], 0xc
call edi
cmp word [0x55d738], 0
mov esi, dword [ebp - 0x14]
jne 0x410620
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x100
push eax
push 0x55d738
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x410afa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x55d738
mov byte [ebp - 4], 0xe
test eax, 0xffff0000
jne 0x41065a
movzx eax, ax
lea ecx, [ebp - 0x10]
push eax
call fcn.0040db00
jmp 0x41067f
mov ecx, 0x55d738
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410662
sub ecx, edx
sar ecx, 1
push ecx
push 0x55d738
lea ecx, [ebp - 0x10]
call fcn.004117e0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.0040ea70
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x10
call dword [ecx + 0x5c]
push dword [ebp - 0x1c]
call edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.0040a4c0
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x410b04
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x11
push str.PT3S
push eax
call fcn.0040d5e0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
add esp, 8
push dword [ebp - 0x10]
call fcn.0040ea70
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x12
call dword [ecx + 0x54]
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x13
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x41072c
push eax
push str.Cant_get_Actions_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x410a0b
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x30]
test eax, eax
jns 0x41075f
push eax
push str.Cant_Create_action_:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x4109fa
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.0040e850
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x15
call fcn.0040ea70
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x16
call dword [ecx + 0x2c]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x4107ac
push esi
push str.Cant_put_Path:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x4109e9
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4107ef
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.0040ea70
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x17
call dword [ecx + 0x34]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x4107ef
push esi
push str.Cant_put_Arguments:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x4109e9
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41082e
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.0040ea70
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x18
call dword [ecx + 0x3c]
push dword [ebp + 0xc]
mov esi, eax
call edi
test esi, esi
jns 0x41082e
push esi
push str.Cant_put_WorkingDirectory:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x4109e9
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x41085f
push eax
push str.Cant_get_Principal:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x4109d8
mov eax, dword [ebp - 0x28]
push str.Users
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp + 0x14], esi
test esi, esi
je 0x410b0e
mov ecx, dword [ebp + 0xc]
push esi
push ecx
mov byte [ebp - 4], 0x1a
mov eax, dword [ecx]
call dword [eax + 0x40]
push esi
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0x19
call edi
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x4108b1
push eax
push str.Cant_put_GroupId:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x4109d8
mov eax, dword [ebp - 0x28]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jns 0x4108d5
push eax
push str.Cant_put_RunLevel:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x4109d8
mov dword [ebp - 0x4c], 0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x8c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x8c]
lea eax, [ebp - 0x7c]
push eax
movups xmmword [ebp - 0x9c], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x7c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x7c]
lea eax, [ebp - 0x5c]
push eax
movups xmmword [ebp - 0xac], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x5c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x5c]
mov esi, dword [ebp - 0x34]
lea ecx, [ebp + 0xc]
push dword [ebp + 8]
mov byte [ebp - 4], 0x1e
movups xmmword [ebp - 0xbc], xmm0
call fcn.0040ea70
mov ecx, dword [eax]
lea eax, [ebp - 0x4c]
movups xmm0, xmmword [ebp - 0x9c]
push eax
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov byte [ebp - 4], 0x1f
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xac]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xbc]
push 6
push dword [ebp - 0x18]
movups xmmword [eax], xmm0
push ecx
push esi
call dword [edx + 0x44]
push dword [ebp + 0xc]
mov esi, eax
call edi
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x5c]
push eax
call edi
lea eax, [ebp - 0x7c]
push eax
call edi
lea eax, [ebp - 0x8c]
push eax
call edi
test esi, esi
jns 0x4109c2
push esi
push str.Cant_RegisterTaskDefinition:_x
call fcn.00411770
add esp, 8
xor esi, esi
jmp 0x4109c7
mov esi, 1
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x4109d8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x4109e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x4109fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x13
test eax, eax
je 0x410a0b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x11
test eax, eax
je 0x410a1c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.0040a4c0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x410a35
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x410a46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 7
test eax, eax
je 0x410a57
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 6
test eax, eax
je 0x410a68
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 4
test eax, eax
je 0x410a79
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 2
test eax, eax
je 0x410a8a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x410a9b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x410ab9
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str.Name_or_Path_IsNULL
call fcn.00411770
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.004062a0
push 0x80004005
call fcn.004062a0
push 0x80004005
call fcn.004062a0
push 0x8007000e
call fcn.004062a0
int3