Function at 0x1400804e0
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x570
mov qword [rsp + 0x118], 0xfffffffffffffffe
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov qword [rsp + 0xc8], r9
mov r14, r8
mov r13, rdx
mov r12, rcx
mov r15, qword [rsp + 0x5d0]
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x50], 0x80004001
lea rdx, str._Utils::SystemSchedulerVista::CreateTask_
mov qword [rsp + 0xb8], rdx
lea rax, [rsp + 0x50]
mov qword [rsp + 0xc0], rax
cmp qword [0x140260548], 0
je 0x140080576
lea rcx, [rsp + 0xb8]
call fcn.14007ed30
nop
xor edi, edi
mov qword [rsp + 0x78], rdi
lea ecx, [rdi + 0x18]
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400805bf
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x1401b8374]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400805c2
mov ecx, 0x8007000e
call fcn.140155fb0
mov rbx, rdi
mov qword [rsp + 0x110], rbx
test rbx, rbx
jne 0x1400805da
mov ecx, 0x8007000e
call fcn.140155fb0
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400805ea
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x78], rdi
mov rax, qword [r13]
lea r8, [rsp + 0x78]
mov rdx, qword [rbx]
mov rcx, r13
call qword [rax + 0x38]
mov dword [rsp + 0x50], eax
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 0x10], eax
add eax, edi
jne 0x140080637
mov rcx, qword [rbx]
test rcx, rcx
je 0x140080621
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14008062f
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x140080671
mov dword [rsp + 0x60], eax
lea rax, str.ITaskService::GetFolder
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0xf0], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0xf0]
call sub.MSVCR90.dll__CxxThrowException
mov rsi, qword [rsp + 0x78]
mov ecx, 0x18
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x1400806bf
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400806c1
test r14, r14
je 0x1400806c1
mov ecx, 0x8007000e
call fcn.140155fb0
xor ebx, ebx
mov qword [rsp + 0x1c0], rbx
test rbx, rbx
jne 0x1400806d9
mov ecx, 0x8007000e
call fcn.140155fb0
nop
mov rax, qword [rsi]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rsi
call qword [rax + 0x78]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
add eax, 0xffffffff
jne 0x14008071a
mov rcx, qword [rbx]
test rcx, rcx
je 0x140080703
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140080711
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
nop
mov qword [rsp + 0x70], 0
mov rax, qword [r13]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, r13
call qword [rax + 0x48]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x14008076f
mov dword [rsp + 0x60], eax
lea rax, str.ITaskService::GetFolder
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x120], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x120]
call sub.MSVCR90.dll__CxxThrowException
nop
xor r13d, r13d
mov qword [rsp + 0x88], r13
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + 0x38]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400807c7
mov dword [rsp + 0x60], eax
lea rax, str.ITaskDefinition::get_RegistrationInfo
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x190], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x190]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x90], 0x200
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
lea rdx, [rsp + 0x360]
call qword [rax + 0x50]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140080838
mov dword [rsp + 0x60], eax
lea rax, str.IRegistrationInfo::put_Author
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x150], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x150]
call sub.MSVCR90.dll__CxxThrowException
mov rdx, qword [rsp + 0x70]
mov rcx, r12
call fcn.140080c40
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x14008087f
mov dword [rsp + 0x60], eax
lea rax, str.Urils::SystemSchedulerVista::SetTaskPrincipal
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x1b0]
call sub.MSVCR90.dll__CxxThrowException
mov rdx, qword [rsp + 0x70]
mov rcx, r12
call fcn.140080eb0
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400808c6
mov dword [rsp + 0x60], eax
lea rax, str.Urils::SystemSchedulerVista::SetTaskSettings
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x180], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x180]
call sub.MSVCR90.dll__CxxThrowException
mov r8, r15
mov rdx, qword [rsp + 0x70]
mov rcx, r12
call fcn.140081560
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140080910
mov dword [rsp + 0x60], eax
lea rax, str.Urils::SystemSchedulerVista::SetTaskTrigger
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x1d0], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x1d0]
call sub.MSVCR90.dll__CxxThrowException
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0x70]
mov rcx, r12
call fcn.140081140
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x14008095f
mov dword [rsp + 0x60], eax
lea rax, str.Urils::SystemSchedulerVista::SetTaskAction
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x1a0], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x1a0]
call sub.MSVCR90.dll__CxxThrowException
mov qword [rsp + 0x80], r13
mov eax, 8
mov word [rsp + 0xd8], ax
lea rcx, [0x1401b68b0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0xe0], rax
test rax, rax
jne 0x140080999
mov ecx, 0x8007000e
call fcn.140155fb0
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0xd8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
lea rcx, [rsp + 0x160]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x160]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
lea rcx, [rsp + 0x130]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x130]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rbx, qword [rsp + 0x78]
mov rdx, r14
lea rcx, [rsp + 0xa0]
call fcn.1400108b0
mov rsi, rax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140080a54
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [rsp + 0x80], r13
mov rax, qword [rsi]
test rax, rax
je 0x140080a69
mov rdx, qword [rax]
jmp 0x140080a6c
mov rdx, r13
mov rax, qword [rbx]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x1e0]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x200]
mov qword [rsp + 0x20], rcx
mov r9d, 6
mov r8, qword [rsp + 0x70]
mov rcx, rbx
call qword [rax + 0x88]
mov dword [rsp + 0x50], eax
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x140080b0b
lock xadd dword [rbx + 0x10], edi
add edi, 0xffffffff
jne 0x140080b03
test rbx, rbx
je 0x140080b03
mov rcx, qword [rbx]
test rcx, rcx
je 0x140080aed
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140080afb
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0xa0], r13
lea rcx, [rsp + 0x130]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x160]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0xd8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov r11d, dword [rsp + 0x50]
test r11d, r11d
jns 0x140080b74
mov dword [rsp + 0x60], r11d
lea rax, str.ITaskFolder::RegisterTaskDefinition
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x100], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x100]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x70], rcx
mov rdx, qword [rsp + 0xd0]
mov qword [rdx], rax
mov dword [rsp + 0x50], r13d
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x140080bac
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x80], r13
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x140080bcf
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x88], r13
test rcx, rcx
je 0x140080be2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x70], r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140080bf7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x78], r13
mov ebx, dword [rsp + 0x50]
lea rcx, [rsp + 0xb8]
call fcn.14007ee60
mov eax, ebx
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140155650
add rsp, 0x570
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret