Function at 0x407cd0
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5061f6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb8
push esi
push edi
mov eax, dword [0x54e758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 8], 0
je 0x408638
cmp dword [ebx + 0xc], 0
je 0x408638
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 0x511298
push 0x17
push 0
push 0x526380
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x407d69
push eax
push str.Cant_CoCreateInstance_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408620
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x78], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x28]
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x78]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call edx
test eax, eax
jns 0x407dc6
push eax
push str.Cant_Connect_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408616
mov dword [ebp - 0x3c], 0
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
push 0x510958
mov byte [ebp - 4], 4
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
call fcn.00406ad0
mov eax, dword [eax]
mov byte [ebp - 4], 5
test eax, eax
je 0x407df4
mov eax, dword [eax]
jmp 0x407df6
xor eax, eax
lea ecx, [ebp - 0x3c]
push ecx
push eax
push esi
call edi
mov esi, dword [ebp - 0x18]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x407e51
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x407e51
test esi, esi
je 0x407e51
mov eax, dword [esi]
test eax, eax
je 0x407e2c
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x407e43
push eax
call fcn.0049b9f8
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0049b6ec
mov eax, dword [ebp - 0x1c]
add esp, 8
test eax, eax
jns 0x407e6a
push eax
push str.Cant_GetFolder_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408605
mov dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x18]
push 0x510958
mov byte [ebp - 4], 8
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x1c], eax
call fcn.00406ad0
mov eax, dword [eax]
mov byte [ebp - 4], 9
test eax, eax
je 0x407e9b
mov eax, dword [eax]
jmp 0x407e9d
xor eax, eax
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 8
test esi, esi
je 0x407ef9
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x407ef9
test esi, esi
je 0x407ef9
mov eax, dword [esi]
test eax, eax
je 0x407ed4
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x407eeb
push eax
call fcn.0049b9f8
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0049b6ec
mov ecx, dword [ebp - 0x1c]
add esp, 8
test ecx, ecx
jns 0x407f49
push ecx
push 0x510958
push str.Cant_GetFolder_:_s___x
call fcn.00409500
mov eax, dword [ebp - 0x3c]
add esp, 0xc
movups xmm0, xmmword [ebp - 0x78]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
lea ecx, [ebp - 0x38]
push ecx
sub esp, 0x10
mov ecx, esp
push 0x510958
push eax
movups xmmword [ecx], xmm0
call edx
test eax, eax
jns 0x407f49
push eax
push str.Cant_CreateFolder_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x4085f4
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xd
call dword [ecx + 0x24]
test eax, eax
jns 0x407f7c
push eax
push str.Cant_NewTask_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x4085e3
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x34]
push edx
push eax
mov byte [ebp - 4], 0x12
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x407fad
push eax
push str.Cant_get_Settings:__x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x4085d2
mov esi, dword [ebp - 0x34]
mov eax, dword [esi]
mov edi, dword [eax + 0x48]
mov eax, 0xb
mov word [ebp - 0x68], ax
xor eax, eax
mov word [ebp - 0x60], ax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x18
call fcn.004077b0
movzx eax, ax
push eax
push esi
call edi
mov esi, eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x407ffc
push esi
push str.Cant_put_DisallowStartIfOnBatteries:__x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x4085d2
mov esi, dword [ebp - 0x34]
mov eax, dword [esi]
mov edi, dword [eax + 0x40]
mov eax, 0xb
mov word [ebp - 0x68], ax
xor eax, eax
mov word [ebp - 0x60], ax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x1e
call fcn.004077b0
movzx eax, ax
push eax
push esi
call edi
mov esi, eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x40804b
push esi
push str.Cant_put_StopIfGoingOnBatteries:__x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x4085d2
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x50]
push edx
push eax
mov byte [ebp - 4], 0x24
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x40807c
push eax
push str.Cant_get_Triggers_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x4085c1
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x2b
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x4080b1
push esi
push str.Cant_CreateTask_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x4085b0
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x20], ecx
test eax, eax
je 0x4080dc
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push 0x510bc0
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x20]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 0x34
test ecx, ecx
jne 0x4080f9
push esi
push str.Cant_logon_trigger_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x40859f
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov edi, dword [ebp - 0x20]
push str.Trigger1
mov eax, dword [edi]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x40865d
push esi
push edi
mov byte [ebp - 4], 0x3d
call dword [ebp - 0x1c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov byte [ebp - 4], 0x34
call edi
cmp word [0x554120], 0
mov esi, dword [ebp - 0x20]
mov eax, dword [esi]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x40], eax
jne 0x408166
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x100
push eax
push 0x554120
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.00404ec0
mov ecx, eax
test ecx, ecx
je 0x408667
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x554120
mov byte [ebp - 4], 0x3e
test eax, 0xffff0000
jne 0x4081a0
movzx eax, ax
lea ecx, [ebp - 0x18]
push eax
call fcn.004053c0
jmp 0x4081cd
mov ecx, 0x554120
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4081b0
sub ecx, edx
sar ecx, 1
push ecx
push 0x554120
lea ecx, [ebp - 0x18]
call fcn.004056b0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3f
call fcn.004067b0
push dword [eax]
mov byte [ebp - 4], 0x40
push esi
call dword [ebp - 0x40]
push dword [ebp - 0x14]
call edi
lea ecx, [ebp - 0x18]
call fcn.00404890
mov byte [ebp - 4], 0x41
call fcn.00404ec0
mov ecx, eax
test ecx, ecx
je 0x408671
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x42
push str.PT3S
push eax
call fcn.00404dd0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
add esp, 8
mov eax, dword [esi]
push dword [ebp - 0x18]
mov edi, dword [eax + 0x54]
call fcn.004067b0
push dword [eax]
mov byte [ebp - 4], 0x43
push esi
call edi
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0x44
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x40827e
push eax
push str.Cant_get_Actions_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408586
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x4e
call dword [ecx + 0x30]
test eax, eax
jns 0x4082b1
push eax
push str.Cant_Create_action_:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408575
push dword [ebp - 0x44]
lea ecx, [ebp - 0x30]
call fcn.00406150
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x14]
push dword [ebx + 0xc]
mov byte [ebp - 4], 0x59
mov eax, dword [esi]
mov edi, dword [eax + 0x2c]
call fcn.004067b0
push dword [eax]
mov byte [ebp - 4], 0x5a
push esi
call edi
push dword [ebp - 0x14]
mov esi, eax
mov byte [ebp - 4], 0x59
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
jns 0x408304
push esi
push str.Cant_put_Path:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408564
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x40834d
mov esi, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x14]
mov eax, dword [esi]
mov edi, dword [eax + 0x34]
call fcn.004067b0
push dword [eax]
mov byte [ebp - 4], 0x66
push esi
call edi
push dword [ebp - 0x14]
mov esi, eax
mov byte [ebp - 4], 0x59
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
jns 0x40834d
push esi
push str.Cant_put_Arguments:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408564
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x408392
mov esi, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x14]
mov eax, dword [esi]
mov edi, dword [eax + 0x3c]
call fcn.004067b0
push dword [eax]
mov byte [ebp - 4], 0x72
push esi
call edi
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
jns 0x408392
push esi
push str.Cant_put_WorkingDirectory:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408564
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 0x7e
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x4083c3
push eax
push str.Cant_get_Principal:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408553
mov edi, dword [ebp - 0x2c]
push str.Users
mov eax, dword [edi]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x14], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x40867b
push esi
push edi
mov byte [ebp - 4], 0x8b
call dword [ebp - 0x14]
push esi
mov edi, eax
mov byte [ebp - 4], 0x7e
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x408415
push edi
push str.Cant_put_GroupId:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408553
mov eax, dword [ebp - 0x2c]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jns 0x408439
push eax
push str.Cant_put_RunLevel:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408553
mov dword [ebp - 0x54], 0
mov esi, dword [ebp - 0x38]
xorps xmm0, xmm0
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esi]
movups xmmword [ebp - 0x98], xmm0
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x98]
push eax
call edi
movups xmm0, xmmword [ebp - 0x98]
lea eax, [ebp - 0x88]
push eax
movups xmmword [ebp - 0xa8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x88], xmm0
call edi
movups xmm0, xmmword [ebp - 0x88]
lea eax, [ebp - 0x68]
push eax
movups xmmword [ebp - 0xb8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x68], xmm0
call edi
movups xmm0, xmmword [ebp - 0x68]
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x40]
push dword [ebx + 8]
mov byte [ebp - 4], 0xa7
movups xmmword [ebp - 0xc8], xmm0
call fcn.004067b0
mov ecx, dword [eax]
lea eax, [ebp - 0x54]
movups xmm0, xmmword [ebp - 0xa8]
push eax
sub esp, 0x10
mov byte [ebp - 4], 0xa8
mov eax, esp
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xb8]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xc8]
push 6
push edi
push ecx
push esi
movups xmmword [eax], xmm0
call dword [ebp - 0x14]
push dword [ebp - 0x40]
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x68]
push eax
call edi
lea eax, [ebp - 0x88]
push eax
call edi
lea eax, [ebp - 0x98]
push eax
call edi
test esi, esi
jns 0x40853d
push esi
push str.Cant_RegisterTaskDefinition:_x
call fcn.00409500
add esp, 8
xor esi, esi
jmp 0x408542
mov esi, 1
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xb6
test eax, eax
je 0x408553
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xb7
test eax, eax
je 0x408564
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0xb8
test eax, eax
je 0x408575
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xb9
test eax, eax
je 0x408586
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0xba
test eax, eax
je 0x408597
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x18]
call fcn.00404890
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 0xbb
test eax, eax
je 0x4085b0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0xbc
test eax, eax
je 0x4085c1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 0xbd
test eax, eax
je 0x4085d2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0xbe
test eax, eax
je 0x4085e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 0xbf
test eax, eax
je 0x4085f4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 0xc0
test eax, eax
je 0x408605
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0xc1
test eax, eax
je 0x408616
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 4], 0xc2
test ecx, ecx
je 0x408634
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
jmp 0x408647
push str.Name_or_Path_IsNULL
call fcn.00409500
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
push 0x8007000e
call fcn.00404b90
push 0x80004005
call fcn.00404b90
push 0x80004005
call fcn.00404b90
push 0x8007000e
call fcn.00404b90
int3