Function at 0x40e2da
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
lea eax, [ebp - 0x18]
push eax
push 0x42fc30
push 1
push 0
push 0x42fc20
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e30b
xor al, al
jmp 0x40e69e
lea eax, [ebp - 0x14]
push eax
push 0x42fc40
push str.Watchmon_Service
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 0x18]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e366
lea eax, [ebp - 0x14]
push eax
push 0x42fc40
push 0x42fc10
push str.Watchmon_Service
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 0x20]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e366
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
cmp dword [ebp + 0x10], 0x28
jge 0x40e3b1
push 0x2000
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x70]
mov dword [ebp - 0x58], 0x400
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40e3af
push 0
lea eax, [ebp - 0x858]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x78]
mov dword [ebp - 0x50], eax
jmp 0x40e3c6
push 0
push 0x4276e8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x78]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e3e9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
push 1
push str..exe
mov ecx, dword [ebp + 8]
call fcn.00415c32
push eax
xor edx, edx
mov ecx, dword [ebp + 8]
call fcn.004120dc
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x40e438
push 0
mov ecx, dword [ebp + 8]
call fcn.00415c32
mov edx, eax
mov ecx, dword [ebp + 8]
call fcn.00413434
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x40e438
xor al, al
jmp 0x40e69e
mov eax, dword [ebp + 0xc]
push dword [eax]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x80]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e471
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
push 4
lea edx, [ebp - 0x10]
mov ecx, dword [ebp + 8]
call fcn.00413c8f
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x88]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e4b6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
push 0x4276e8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x90]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e4ef
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0xa8]
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 0x20
push dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x98]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0xc]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e556
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
push 0x30
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.004031e0
add esp, 0xc
mov word [ebp - 0x3e], 0x80c
mov word [ebp - 0x3c], 1
mov word [ebp - 0x3a], 1
mov word [ebp - 0x36], 0x2d
mov dword [ebp - 0x34], 0xa
mov dword [ebp - 0x30], 1
mov word [ebp - 0x40], 1
mov word [ebp - 0x42], 1
mov word [ebp - 0x44], 0x7d0
mov word [ebp - 0x48], 0x30
xor eax, eax
cmp dword [ebp + 0x10], 0x28
setl al
add eax, 6
mov dword [ebp - 0x28], eax
mov word [ebp - 0x38], 0x13
mov word [ebp - 0x24], 1
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
push dword [ebp - 0x54]
call dword [eax + 0xc]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e5f4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
push dword [ebp - 0x54]
call dword [eax + 8]
lea eax, [ebp - 8]
push eax
push 0x42fc50
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e635
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
push 1
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push dword [ebp - 8]
call dword [eax + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push dword [ebp - 8]
call dword [eax + 8]
cmp dword [ebp + 0x10], 0x32
je 0x40e686
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x30]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jge 0x40e686
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
xor al, al
jmp 0x40e69e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x18]
call dword [eax + 8]
mov al, 1
leave
ret