Function at 0x100034d0
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], edx
push 0x2e
xor ebx, ebx
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4a]
mov edi, ecx
push ebx
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x258]
push eax
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x1000352c
mov esi, dword [ebp + 0xc]
cmp dword [esi], ebx
je 0x10003525
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor al, al
jmp 0x10003650
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, eax
test ecx, ecx
jns 0x10003545
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10003525
mov dword [eax], ecx
jmp 0x10003525
lea eax, [ebp - 8]
push eax
push 0x100066d8
xor eax, eax
inc eax
push eax
push ebx
push 0x100066f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x1000362d
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
add esi, 0x618
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push 0x100066c8
push 0x100066e8
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x20]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
js 0x1000362d
mov eax, dword [ebp - 4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov esi, eax
test esi, esi
js 0x1000362d
mov eax, dword [ebp - 4]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov esi, eax
test esi, esi
js 0x1000362d
mov eax, dword [ebp - 4]
push dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov esi, eax
test esi, esi
js 0x1000362d
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x258]
push ebx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov esi, eax
test esi, esi
js 0x1000362d
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov esi, eax
test esi, esi
js 0x1000362d
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jns 0x10003657
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10003636
mov dword [eax], esi
call dword [sym.imp.ole32.dll_CoUninitialize]
test bl, bl
jne 0x1000364e
mov ecx, dword [ebp + 8]
lea ecx, [ecx + 0x618]
call fcn.100036f2
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x30
pop eax
mov word [ebp - 0x4c], ax
lea edx, [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x2c], 7
inc eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x46], ax
mov eax, 0x7cf
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
test esi, esi
jns 0x1000369a
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
jmp 0x10003627
lea edx, [ebp - 0xc]
push edx
push 0x10006708
push eax
call dword [ecx]
mov esi, eax
test esi, esi
js 0x10003624
mov eax, dword [ebp - 0xc]
push 1
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
test esi, esi
js 0x1000362a
call dword [ecx + 0x30]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
js 0x1000362d
mov bl, 1
jmp 0x10003636