Function at 0x4101b0
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50af43
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push esi
push edi
mov eax, dword [0x554418]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x410abe
cmp dword [ebp + 0xc], 0
je 0x410abe
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 0x51765c
push 0x17
push 0
push 0x52e4a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x410235
push eax
push str.Cant_CoCreateInstance_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a95
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x6c], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 1
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
test eax, eax
jns 0x410290
push eax
push str.Cant_Connect_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a8b
mov dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push 0x516d30
mov byte [ebp - 4], 2
call fcn.0040f000
mov eax, dword [eax]
mov byte [ebp - 4], 3
test eax, eax
je 0x4102b9
mov ecx, dword [eax]
jmp 0x4102bb
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x38]
push edx
push ecx
push esi
call dword [eax + 0x1c]
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x24], eax
test esi, esi
je 0x410319
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x410319
test esi, esi
je 0x410319
mov eax, dword [esi]
test eax, eax
je 0x4102f4
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x41030b
push eax
call fcn.0043f1f1
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0043ee21
mov eax, dword [ebp - 0x24]
add esp, 8
test eax, eax
jns 0x410332
push eax
push str.Cant_GetFolder_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a7a
mov dword [ebp - 0x34], 0
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x24]
push 0x516d30
mov byte [ebp - 4], 4
call fcn.0040f000
mov eax, dword [eax]
mov byte [ebp - 4], 5
test eax, eax
je 0x41035b
mov ecx, dword [eax]
jmp 0x41035d
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x34]
push edx
push ecx
push esi
call dword [eax + 0x24]
mov esi, dword [ebp - 0x24]
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 4
test esi, esi
je 0x4103bb
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4103bb
test esi, esi
je 0x4103bb
mov eax, dword [esi]
test eax, eax
je 0x410396
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4103ad
push eax
call fcn.0043f1f1
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0043ee21
mov ecx, dword [ebp - 0x10]
add esp, 8
test ecx, ecx
jns 0x410409
push ecx
push 0x516d30
push str.Cant_GetFolder_:_s___x
call fcn.00411760
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
movups xmm0, xmmword [ebp - 0x6c]
add esp, 0xc
mov edx, dword [eax]
push ecx
sub esp, 0x10
mov ecx, esp
push 0x516d30
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x2c]
test eax, eax
jns 0x410409
push eax
push str.Cant_CreateFolder_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a69
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 6
call dword [ecx + 0x24]
test eax, eax
jns 0x41043c
push eax
push str.Cant_NewTask_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a58
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x30]
push edx
push eax
mov byte [ebp - 4], 7
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x41046d
push eax
push str.Cant_get_Settings:__x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a47
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call fcn.0040fc90
movzx eax, ax
push eax
push esi
call dword [edi + 0x48]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x4104ba
push esi
push str.Cant_put_DisallowStartIfOnBatteries:__x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a47
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 9
call fcn.0040fc90
movzx eax, ax
push eax
push esi
call dword [edi + 0x40]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x410507
push esi
push str.Cant_put_StopIfGoingOnBatteries:__x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a47
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x410538
push eax
push str.Cant_get_Triggers_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a36
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x41056d
push esi
push str.Cant_CreateTask_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a25
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x410594
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x517018
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
test ecx, ecx
jne 0x4105b1
push esi
push str.Cant_logon_trigger_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x410a14
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov edi, dword [ebp - 0x14]
push str.Trigger1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x410ae0
mov eax, dword [edi]
push esi
push edi
mov byte [ebp - 4], 0xd
call dword [eax + 0x24]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov byte [ebp - 4], 0xc
call edi
cmp word [0x55a6e8], 0
mov esi, dword [ebp - 0x14]
jne 0x410610
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x100
push eax
push 0x55a6e8
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x410aea
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x55a6e8
mov byte [ebp - 4], 0xe
test eax, 0xffff0000
jne 0x41064a
movzx eax, ax
lea ecx, [ebp - 0x10]
push eax
call fcn.0040daf0
jmp 0x41066f
mov ecx, 0x55a6e8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410652
sub ecx, edx
sar ecx, 1
push ecx
push 0x55a6e8
lea ecx, [ebp - 0x10]
call fcn.004117d0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.0040ea60
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x10
call dword [ecx + 0x5c]
push dword [ebp - 0x1c]
call edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.0040a4b0
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x410af4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x11
push str.PT3S
push eax
call fcn.0040d5d0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
add esp, 8
push dword [ebp - 0x10]
call fcn.0040ea60
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x12
call dword [ecx + 0x54]
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x13
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x41071c
push eax
push str.Cant_get_Actions_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109fb
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x30]
test eax, eax
jns 0x41074f
push eax
push str.Cant_Create_action_:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109ea
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.0040e840
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x15
call fcn.0040ea60
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x16
call dword [ecx + 0x2c]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x41079c
push esi
push str.Cant_put_Path:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109d9
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4107df
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.0040ea60
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x17
call dword [ecx + 0x34]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x4107df
push esi
push str.Cant_put_Arguments:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109d9
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41081e
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.0040ea60
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x18
call dword [ecx + 0x3c]
push dword [ebp + 0xc]
mov esi, eax
call edi
test esi, esi
jns 0x41081e
push esi
push str.Cant_put_WorkingDirectory:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109d9
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x41084f
push eax
push str.Cant_get_Principal:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109c8
mov eax, dword [ebp - 0x28]
push str.Users
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp + 0x14], esi
test esi, esi
je 0x410afe
mov ecx, dword [ebp + 0xc]
push esi
push ecx
mov byte [ebp - 4], 0x1a
mov eax, dword [ecx]
call dword [eax + 0x40]
push esi
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0x19
call edi
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x4108a1
push eax
push str.Cant_put_GroupId:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109c8
mov eax, dword [ebp - 0x28]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jns 0x4108c5
push eax
push str.Cant_put_RunLevel:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109c8
mov dword [ebp - 0x4c], 0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x8c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x8c]
lea eax, [ebp - 0x7c]
push eax
movups xmmword [ebp - 0x9c], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x7c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x7c]
lea eax, [ebp - 0x5c]
push eax
movups xmmword [ebp - 0xac], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x5c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x5c]
mov esi, dword [ebp - 0x34]
lea ecx, [ebp + 0xc]
push dword [ebp + 8]
mov byte [ebp - 4], 0x1e
movups xmmword [ebp - 0xbc], xmm0
call fcn.0040ea60
mov ecx, dword [eax]
lea eax, [ebp - 0x4c]
movups xmm0, xmmword [ebp - 0x9c]
push eax
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov byte [ebp - 4], 0x1f
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xac]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xbc]
push 6
push dword [ebp - 0x18]
movups xmmword [eax], xmm0
push ecx
push esi
call dword [edx + 0x44]
push dword [ebp + 0xc]
mov esi, eax
call edi
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x5c]
push eax
call edi
lea eax, [ebp - 0x7c]
push eax
call edi
lea eax, [ebp - 0x8c]
push eax
call edi
test esi, esi
jns 0x4109b2
push esi
push str.Cant_RegisterTaskDefinition:_x
call fcn.00411760
add esp, 8
xor esi, esi
jmp 0x4109b7
mov esi, 1
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x4109c8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x4109d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x4109ea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x13
test eax, eax
je 0x4109fb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x11
test eax, eax
je 0x410a0c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.0040a4b0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x410a25
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x410a36
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 7
test eax, eax
je 0x410a47
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 6
test eax, eax
je 0x410a58
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 4
test eax, eax
je 0x410a69
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 2
test eax, eax
je 0x410a7a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x410a8b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x410aa9
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str.Name_or_Path_IsNULL
call fcn.00411760
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00406290
push 0x80004005
call fcn.00406290
push 0x80004005
call fcn.00406290
push 0x8007000e
call fcn.00406290
int3