Function at 0x4091f0
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485183
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push esi
push edi
mov eax, dword [0x4b3630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x409afe
cmp dword [ebp + 0xc], 0
je 0x409afe
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 0x48e0b8
push 0x17
push 0
push 0x497dd4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x409275
push eax
push str.Cant_CoCreateInstance_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409ad5
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x6c], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 1
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
test eax, eax
jns 0x4092d0
push eax
push str.Cant_Connect_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409acb
mov dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push 0x48d69c
mov byte [ebp - 4], 2
call fcn.00407f80
mov eax, dword [eax]
mov byte [ebp - 4], 3
test eax, eax
je 0x4092f9
mov ecx, dword [eax]
jmp 0x4092fb
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x38]
push edx
push ecx
push esi
call dword [eax + 0x1c]
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x24], eax
test esi, esi
je 0x409359
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x409359
test esi, esi
je 0x409359
mov eax, dword [esi]
test eax, eax
je 0x409334
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40934b
push eax
call fcn.0044218f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00441e7b
mov eax, dword [ebp - 0x24]
add esp, 8
test eax, eax
jns 0x409372
push eax
push str.Cant_GetFolder_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409aba
mov dword [ebp - 0x34], 0
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x24]
push 0x48d69c
mov byte [ebp - 4], 4
call fcn.00407f80
mov eax, dword [eax]
mov byte [ebp - 4], 5
test eax, eax
je 0x40939b
mov ecx, dword [eax]
jmp 0x40939d
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x34]
push edx
push ecx
push esi
call dword [eax + 0x24]
mov esi, dword [ebp - 0x24]
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 4
test esi, esi
je 0x4093fb
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4093fb
test esi, esi
je 0x4093fb
mov eax, dword [esi]
test eax, eax
je 0x4093d6
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4093ed
push eax
call fcn.0044218f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00441e7b
mov ecx, dword [ebp - 0x10]
add esp, 8
test ecx, ecx
jns 0x409449
push ecx
push 0x48d69c
push str.Cant_GetFolder_:_s___x
call fcn.0040aa90
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
movups xmm0, xmmword [ebp - 0x6c]
add esp, 0xc
mov edx, dword [eax]
push ecx
sub esp, 0x10
mov ecx, esp
push 0x48d69c
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x2c]
test eax, eax
jns 0x409449
push eax
push str.Cant_CreateFolder_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409aa9
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 6
call dword [ecx + 0x24]
test eax, eax
jns 0x40947c
push eax
push str.Cant_NewTask_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a98
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x30]
push edx
push eax
mov byte [ebp - 4], 7
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x4094ad
push eax
push str.Cant_get_Settings:__x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a87
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call fcn.00408cd0
movzx eax, ax
push eax
push esi
call dword [edi + 0x48]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x4094fa
push esi
push str.Cant_put_DisallowStartIfOnBatteries:__x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a87
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 9
call fcn.00408cd0
movzx eax, ax
push eax
push esi
call dword [edi + 0x40]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x409547
push esi
push str.Cant_put_StopIfGoingOnBatteries:__x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a87
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x409578
push eax
push str.Cant_get_Triggers_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a76
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x4095ad
push esi
push str.Cant_CreateTask_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a65
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x4095d4
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x48d98c
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
test ecx, ecx
jne 0x4095f1
push esi
push str.Cant_logon_trigger_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a54
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov edi, dword [ebp - 0x14]
push str.Trigger1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x409b20
mov eax, dword [edi]
push esi
push edi
mov byte [ebp - 4], 0xd
call dword [eax + 0x24]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov byte [ebp - 4], 0xc
call edi
cmp word [0x4b68c8], 0
mov esi, dword [ebp - 0x14]
jne 0x409650
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x100
push eax
push 0x4b68c8
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.00406280
mov ecx, eax
test ecx, ecx
je 0x409b2a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x4b68c8
mov byte [ebp - 4], 0xe
test eax, 0xffff0000
jne 0x40968a
movzx eax, ax
lea ecx, [ebp - 0x10]
push eax
call fcn.00406740
jmp 0x4096af
mov ecx, 0x4b68c8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409692
sub ecx, edx
sar ecx, 1
push ecx
push 0x4b68c8
lea ecx, [ebp - 0x10]
call fcn.0040ab00
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.004079e0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x10
call dword [ecx + 0x5c]
push dword [ebp - 0x1c]
call edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.00405c60
call fcn.00406280
mov ecx, eax
test ecx, ecx
je 0x409b34
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x11
push str.PT3S
push eax
call fcn.00406190
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
add esp, 8
push dword [ebp - 0x10]
call fcn.004079e0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x12
call dword [ecx + 0x54]
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x13
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x40975c
push eax
push str.Cant_get_Actions_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a3b
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x30]
test eax, eax
jns 0x40978f
push eax
push str.Cant_Create_action_:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a2a
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.00407550
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x15
call fcn.004079e0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x16
call dword [ecx + 0x2c]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x4097dc
push esi
push str.Cant_put_Path:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a19
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40981f
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.004079e0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x17
call dword [ecx + 0x34]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x40981f
push esi
push str.Cant_put_Arguments:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a19
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40985e
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.004079e0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x18
call dword [ecx + 0x3c]
push dword [ebp + 0xc]
mov esi, eax
call edi
test esi, esi
jns 0x40985e
push esi
push str.Cant_put_WorkingDirectory:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a19
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x40988f
push eax
push str.Cant_get_Principal:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a08
mov eax, dword [ebp - 0x28]
push str.Users
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp + 0x14], esi
test esi, esi
je 0x409b3e
mov ecx, dword [ebp + 0xc]
push esi
push ecx
mov byte [ebp - 4], 0x1a
mov eax, dword [ecx]
call dword [eax + 0x40]
push esi
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0x19
call edi
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x4098e1
push eax
push str.Cant_put_GroupId:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a08
mov eax, dword [ebp - 0x28]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jns 0x409905
push eax
push str.Cant_put_RunLevel:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x409a08
mov dword [ebp - 0x4c], 0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x8c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x8c]
lea eax, [ebp - 0x7c]
push eax
movups xmmword [ebp - 0x9c], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x7c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x7c]
lea eax, [ebp - 0x5c]
push eax
movups xmmword [ebp - 0xac], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x5c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x5c]
mov esi, dword [ebp - 0x34]
lea ecx, [ebp + 0xc]
push dword [ebp + 8]
mov byte [ebp - 4], 0x1e
movups xmmword [ebp - 0xbc], xmm0
call fcn.004079e0
mov ecx, dword [eax]
lea eax, [ebp - 0x4c]
movups xmm0, xmmword [ebp - 0x9c]
push eax
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov byte [ebp - 4], 0x1f
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xac]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xbc]
push 6
push dword [ebp - 0x18]
movups xmmword [eax], xmm0
push ecx
push esi
call dword [edx + 0x44]
push dword [ebp + 0xc]
mov esi, eax
call edi
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x5c]
push eax
call edi
lea eax, [ebp - 0x7c]
push eax
call edi
lea eax, [ebp - 0x8c]
push eax
call edi
test esi, esi
jns 0x4099f2
push esi
push str.Cant_RegisterTaskDefinition:_x
call fcn.0040aa90
add esp, 8
xor esi, esi
jmp 0x4099f7
mov esi, 1
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x409a08
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x409a19
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x409a2a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x13
test eax, eax
je 0x409a3b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x11
test eax, eax
je 0x409a4c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.00405c60
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x409a65
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x409a76
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 7
test eax, eax
je 0x409a87
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 6
test eax, eax
je 0x409a98
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 4
test eax, eax
je 0x409aa9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 2
test eax, eax
je 0x409aba
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x409acb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x409ae9
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str.Name_or_Path_IsNULL
call fcn.0040aa90
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00405f60
push 0x80004005
call fcn.00405f60
push 0x80004005
call fcn.00405f60
push 0x8007000e
call fcn.00405f60
int3