Function at 0x408144
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push 0x274
mov eax, 0x438e7e
call fcn.0043805e
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x270], ebx
lea eax, [ebp - 0x270]
mov dword [ebp - 4], ebx
push eax
push 0x43fb40
xor eax, eax
inc eax
push eax
push ebx
push 0x43fb60
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x40841c
mov eax, dword [ebp - 0x270]
mov esi, str.RobloxGameUpdater
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov dword [ebp - 0x268], ebx
xor edx, edx
inc edx
mov byte [ebp - 4], dl
lea edx, [ebp - 0x268]
mov eax, dword [ebp - 0x270]
push edx
push 0x43fb30
push 0x43fb50
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
js 0x408409
mov dword [ebp - 0x26c], ebx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x26c]
mov eax, dword [ebp - 0x268]
push edx
push 0x43fb20
push eax
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
test esi, esi
js 0x4083f3
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov byte [ebp - 4], 3
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 0x26c]
push edx
lea edx, [ebp - 0x27c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
js 0x4083df
push 0x30
pop esi
push esi
lea eax, [ebp - 0x24c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov ax, word [edi + 0x2a0]
lea ecx, [ebp - 0x24c]
mov word [ebp - 0x244], ax
add esp, 0xc
mov ax, word [edi + 0x29c]
mov word [ebp - 0x246], ax
mov ax, word [edi + 0x298]
mov word [ebp - 0x248], ax
mov ax, word [edi + 0x2ac]
mov word [ebp - 0x23e], ax
mov ax, word [edi + 0x2a8]
mov word [ebp - 0x240], ax
mov ax, word [edi + 0x2a4]
mov word [ebp - 0x242], ax
mov ax, word [edi + 0x294]
mov word [ebp - 0x23c], ax
xor eax, eax
inc eax
mov word [ebp - 0x24c], si
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov word [ebp - 0x228], ax
mov eax, dword [ebp - 0x278]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
test esi, esi
js 0x4083df
mov esi, dword [ebp - 0x268]
lea eax, [ebp - 0x264]
push eax
mov ecx, edi
call fcn.004235bd
mov ecx, eax
mov byte [ebp - 4], 4
cmp dword [ecx + 0x14], 7
jbe 0x4082fd
mov ecx, dword [ecx]
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x80]
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.00402ab8
test esi, esi
js 0x4083df
mov eax, dword [ebp - 0x268]
push str._qbg
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov esi, eax
test esi, esi
js 0x4083df
mov eax, dword [ebp - 0x26c]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov esi, eax
test esi, esi
js 0x4083df
lea eax, [ebp - 0x280]
mov dword [ebp - 0x280], 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 0x26c]
lea edx, [ebp - 0x21c]
push ebx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov esi, eax
test esi, esi
js 0x4083df
mov dword [ebp - 0x274], ebx
mov byte [ebp - 4], 5
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 0x268]
push edx
push 0x43fb70
push eax
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
test esi, esi
js 0x4083cb
mov eax, dword [ebp - 0x274]
xor edx, edx
inc edx
push edx
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x274]
test eax, eax
je 0x4083df
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x4083f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x26c]
test eax, eax
je 0x408409
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x40841c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x408430
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.0043800d
ret