Function at 0x40e6a0
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42390c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x91c
push esi
push edi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [ebp - 0xfc]
call fcn.00401963
and dword [ebp - 4], 0
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push 0x42fbd0
push 1
push 0
push 0x42fbe0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x40e71f
mov byte [ebp - 0x911], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x911]
jmp 0x40ef05
push dword [ebp - 0x24]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
push dword [ebp - 0x24]
call dword [eax + 0x28]
test eax, eax
jge 0x40e78d
mov byte [ebp - 0x912], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x912]
jmp 0x40ef05
lea eax, [ebp - 0x68]
push eax
push 0x426f7c
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
push dword [ebp - 0x24]
call dword [eax + 0x1c]
test eax, eax
jge 0x40e7c6
mov byte [ebp - 0x913], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x913]
jmp 0x40ef05
push dword [ebp - 0x68]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
lea eax, [ebp - 0x14]
push eax
push str.MicrosoftWindowsMedia_CenterPBDARegisterSW
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
push dword [ebp - 0x68]
call dword [eax + 0x34]
test eax, eax
jl 0x40e8c6
push dword [ebp - 0x14]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.0040e208
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x40e88f
cmp dword [ebp + 0x10], 0x32
je 0x40e86e
lea eax, [ebp - 0x100]
push eax
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [ebp - 0x14]
call dword [eax + 0x30]
test eax, eax
jl 0x40e86c
push dword [ebp - 0x100]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
mov byte [ebp - 0x914], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x914]
jmp 0x40ef05
jmp 0x40e88f
mov byte [ebp - 0x915], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x915]
jmp 0x40ef05
push 0
push str.MicrosoftWindowsMedia_CenterPBDARegisterSW
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
push dword [ebp - 0x68]
call dword [eax + 0x3c]
test eax, eax
jge 0x40e8c6
mov byte [ebp - 0x916], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x916]
jmp 0x40ef05
push 1
push str..exe
mov ecx, dword [ebp + 8]
call fcn.00415c32
push eax
xor edx, edx
mov ecx, dword [ebp + 8]
call fcn.004120dc
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x40e92f
push 0
mov ecx, dword [ebp + 8]
call fcn.00415c32
mov edx, eax
mov ecx, dword [ebp + 8]
call fcn.00413434
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x40e92f
mov byte [ebp - 0x917], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x917]
jmp 0x40ef05
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
push dword [ebp - 0x24]
call dword [eax + 0x24]
test eax, eax
jge 0x40e965
mov byte [ebp - 0x918], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x918]
jmp 0x40ef05
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
push dword [ebp - 0x20]
call dword [eax + 0x24]
test eax, eax
jge 0x40e9a7
mov byte [ebp - 0x919], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x919]
jmp 0x40ef05
push dword [ebp - 0x70]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
push dword [ebp - 0x20]
call dword [eax + 0x44]
test eax, eax
jge 0x40e9e9
mov byte [ebp - 0x91a], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x91a]
jmp 0x40ef05
push dword [ebp - 0x64]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
push dword [ebp - 0x20]
call dword [eax + 0x3c]
test eax, eax
jge 0x40ea2b
mov byte [ebp - 0x91b], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x91b]
jmp 0x40ef05
push dword [ebp - 0x30]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
push dword [ebp - 0x20]
call dword [eax + 0x2c]
test eax, eax
jge 0x40ea6d
mov byte [ebp - 0x91c], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x91c]
jmp 0x40ef05
push dword [ebp - 0x28]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
cmp dword [ebp + 0x10], 0x28
jge 0x40eab8
push 3
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
push dword [ebp - 0x30]
call dword [eax + 0x38]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x40eab8
mov byte [ebp - 0x91d], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x91d]
jmp 0x40ef05
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
push dword [ebp - 0x64]
call dword [eax + 0x30]
test eax, eax
jge 0x40eaee
mov byte [ebp - 0x91e], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x91e]
jmp 0x40ef05
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
lea eax, [ebp - 0x1c]
push eax
push str.MbLk
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
push dword [ebp - 0x10]
call dword [eax]
test eax, eax
jge 0x40eb34
mov byte [ebp - 0x91f], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x91f]
jmp 0x40ef05
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
mov eax, dword [ebp + 0xc]
push dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push dword [ebp - 0x1c]
call dword [eax + 0x2c]
push 4
lea edx, [ebp - 0x5c]
mov ecx, dword [ebp + 8]
call fcn.00413c8f
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push dword [ebp - 0x1c]
call dword [eax + 0x34]
cmp dword [ebp + 0x10], 0x28
jl 0x40ebbd
lea eax, [ebp - 0x60]
push eax
push 8
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
push dword [ebp - 0x70]
call dword [eax + 0x28]
test eax, eax
jge 0x40ebaa
mov byte [ebp - 0x920], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x920]
jmp 0x40ef05
push dword [ebp - 0x60]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
jmp 0x40ecbd
lea eax, [ebp - 0x60]
push eax
push 9
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
push dword [ebp - 0x70]
call dword [eax + 0x28]
test eax, eax
jge 0x40ebf3
mov byte [ebp - 0x921], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x921]
jmp 0x40ef05
push dword [ebp - 0x60]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
and dword [ebp - 0x104], 0
lea eax, [ebp - 0x104]
push eax
push 0x42fc00
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
push dword [ebp - 0x60]
call dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x40ec48
mov byte [ebp - 0x922], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x922]
jmp 0x40ef05
push dword [ebp - 0x104]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
mov dword [ebp - 0x108], 0x400
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x90c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40ecbd
lea eax, [ebp - 0x90c]
push eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
push dword [ebp - 0x104]
call dword [eax + 0x5c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x40ecbd
mov byte [ebp - 0x923], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x923]
jmp 0x40ef05
cmp dword [ebp + 0x10], 0x28
jl 0x40ecd0
push 1
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
push dword [ebp - 0x30]
call dword [eax + 0x48]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
push dword [ebp - 0x28]
call dword [eax + 0x98]
push 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
push dword [ebp - 0x28]
call dword [eax + 0x50]
push str.PT1M
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
push dword [ebp - 0x28]
call dword [eax + 0x28]
push 0x1f4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
push dword [ebp - 0x28]
call dword [eax + 0x30]
push str.PT0S
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
push dword [ebp - 0x28]
call dword [eax + 0x70]
push 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
push dword [ebp - 0x28]
call dword [eax + 0x48]
push 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
push dword [ebp - 0x28]
call dword [eax + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
push dword [ebp - 0x28]
call dword [eax + 0x9c]
test eax, eax
jge 0x40ed6e
mov byte [ebp - 0x924], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x924]
jmp 0x40ef05
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
push 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
push dword [ebp - 0x2c]
call dword [eax + 0x30]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 8
push 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push str.NT_AUTHORITYSystem
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x4c], eax
cmp dword [ebp + 0x10], 0x28
jge 0x40edfd
lea eax, [ebp - 0x6c]
push eax
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 3
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
push dword [ebp - 0x20]
push str.PBDARegisterSW
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
push dword [ebp - 0x68]
call dword [eax + 0x44]
mov dword [ebp - 0x18], eax
jmp 0x40ee3f
lea eax, [ebp - 0x6c]
push eax
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 5
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x54]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
push dword [ebp - 0x20]
push str.MicrosoftWindowsMedia_CenterPBDARegisterSW
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
push dword [ebp - 0x68]
call dword [eax + 0x44]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x40ee70
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 0x925], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x925]
jmp 0x40ef05
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
cmp dword [ebp + 0x10], 0x32
je 0x40eedf
lea eax, [ebp - 0x910]
push eax
sub esp, 0x10
lea esi, [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
push dword [ebp - 0x6c]
call dword [eax + 0x30]
test eax, eax
jge 0x40eece
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 0x926], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x926]
jmp 0x40ef05
push dword [ebp - 0x910]
lea ecx, [ebp - 0xfc]
call fcn.004019ba
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 0x927], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00401979
mov al, byte [ebp - 0x927]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
leave
ret