Function at 0x4094b0
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5535d3
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push esi
push edi
mov eax, dword [0x5ad6f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x409dbe
cmp dword [ebp + 0xc], 0
je 0x409dbe
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 0x564568
push 0x17
push 0
push 0x57eeb4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x409535
push eax
push str.Cant_CoCreateInstance_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d95
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x6c], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 1
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
test eax, eax
jns 0x409590
push eax
push str.Cant_Connect_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d8b
mov dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push 0x563b18
mov byte [ebp - 4], 2
call fcn.00408240
mov eax, dword [eax]
mov byte [ebp - 4], 3
test eax, eax
je 0x4095b9
mov ecx, dword [eax]
jmp 0x4095bb
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x38]
push edx
push ecx
push esi
call dword [eax + 0x1c]
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x24], eax
test esi, esi
je 0x409619
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x409619
test esi, esi
je 0x409619
mov eax, dword [esi]
test eax, eax
je 0x4095f4
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40960b
push eax
call fcn.004d68b3
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004d65a7
mov eax, dword [ebp - 0x24]
add esp, 8
test eax, eax
jns 0x409632
push eax
push str.Cant_GetFolder_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d7a
mov dword [ebp - 0x34], 0
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x24]
push str.360safe
mov byte [ebp - 4], 4
call fcn.00408240
mov eax, dword [eax]
mov byte [ebp - 4], 5
test eax, eax
je 0x40965b
mov ecx, dword [eax]
jmp 0x40965d
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x34]
push edx
push ecx
push esi
call dword [eax + 0x24]
mov esi, dword [ebp - 0x24]
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 4
test esi, esi
je 0x4096bb
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4096bb
test esi, esi
je 0x4096bb
mov eax, dword [esi]
test eax, eax
je 0x409696
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4096ad
push eax
call fcn.004d68b3
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004d65a7
mov ecx, dword [ebp - 0x10]
add esp, 8
test ecx, ecx
jns 0x409709
push ecx
push str.360safe
push str.Cant_GetFolder_:_s___x
call fcn.0040ad50
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
movups xmm0, xmmword [ebp - 0x6c]
add esp, 0xc
mov edx, dword [eax]
push ecx
sub esp, 0x10
mov ecx, esp
push str.360safe
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x2c]
test eax, eax
jns 0x409709
push eax
push str.Cant_CreateFolder_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d69
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 6
call dword [ecx + 0x24]
test eax, eax
jns 0x40973c
push eax
push str.Cant_NewTask_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d58
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x30]
push edx
push eax
mov byte [ebp - 4], 7
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x40976d
push eax
push str.Cant_get_Settings:__x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d47
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call fcn.00408f90
movzx eax, ax
push eax
push esi
call dword [edi + 0x48]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x4097ba
push esi
push str.Cant_put_DisallowStartIfOnBatteries:__x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d47
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 9
call fcn.00408f90
movzx eax, ax
push eax
push esi
call dword [edi + 0x40]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x409807
push esi
push str.Cant_put_StopIfGoingOnBatteries:__x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d47
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x409838
push eax
push str.Cant_get_Triggers_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d36
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x40986d
push esi
push str.Cant_CreateTask_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d25
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x409894
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x563e2c
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
test ecx, ecx
jne 0x4098b1
push esi
push str.Cant_logon_trigger_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409d14
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov edi, dword [ebp - 0x14]
push str.Trigger1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x409de0
mov eax, dword [edi]
push esi
push edi
mov byte [ebp - 4], 0xd
call dword [eax + 0x24]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov byte [ebp - 4], 0xc
call edi
cmp word [0x5b3b20], 0
mov esi, dword [ebp - 0x14]
jne 0x409910
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x100
push eax
push 0x5b3b20
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x409dea
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x5b3b20
mov byte [ebp - 4], 0xe
test eax, 0xffff0000
jne 0x40994a
movzx eax, ax
lea ecx, [ebp - 0x10]
push eax
call fcn.004069f0
jmp 0x40996f
mov ecx, 0x5b3b20
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409952
sub ecx, edx
sar ecx, 1
push ecx
push 0x5b3b20
lea ecx, [ebp - 0x10]
call fcn.0040adc0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.00407ca0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x10
call dword [ecx + 0x5c]
push dword [ebp - 0x1c]
call edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.00405f10
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x409df4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x11
push str.PT3S
push eax
call fcn.00406440
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
add esp, 8
push dword [ebp - 0x10]
call fcn.00407ca0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x12
call dword [ecx + 0x54]
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x13
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x409a1c
push eax
push str.Cant_get_Actions_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cfb
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x30]
test eax, eax
jns 0x409a4f
push eax
push str.Cant_Create_action_:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cea
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.00407810
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x15
call fcn.00407ca0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x16
call dword [ecx + 0x2c]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x409a9c
push esi
push str.Cant_put_Path:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cd9
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x409adf
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.00407ca0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x17
call dword [ecx + 0x34]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x409adf
push esi
push str.Cant_put_Arguments:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cd9
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x409b1e
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.00407ca0
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x18
call dword [ecx + 0x3c]
push dword [ebp + 0xc]
mov esi, eax
call edi
test esi, esi
jns 0x409b1e
push esi
push str.Cant_put_WorkingDirectory:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cd9
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x409b4f
push eax
push str.Cant_get_Principal:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cc8
mov eax, dword [ebp - 0x28]
push str.Users
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp + 0x14], esi
test esi, esi
je 0x409dfe
mov ecx, dword [ebp + 0xc]
push esi
push ecx
mov byte [ebp - 4], 0x1a
mov eax, dword [ecx]
call dword [eax + 0x40]
push esi
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0x19
call edi
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x409ba1
push eax
push str.Cant_put_GroupId:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cc8
mov eax, dword [ebp - 0x28]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jns 0x409bc5
push eax
push str.Cant_put_RunLevel:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cc8
mov dword [ebp - 0x4c], 0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x8c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x8c]
lea eax, [ebp - 0x7c]
push eax
movups xmmword [ebp - 0x9c], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x7c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x7c]
lea eax, [ebp - 0x5c]
push eax
movups xmmword [ebp - 0xac], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x5c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x5c]
mov esi, dword [ebp - 0x34]
lea ecx, [ebp + 0xc]
push dword [ebp + 8]
mov byte [ebp - 4], 0x1e
movups xmmword [ebp - 0xbc], xmm0
call fcn.00407ca0
mov ecx, dword [eax]
lea eax, [ebp - 0x4c]
movups xmm0, xmmword [ebp - 0x9c]
push eax
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov byte [ebp - 4], 0x1f
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xac]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xbc]
push 6
push dword [ebp - 0x18]
movups xmmword [eax], xmm0
push ecx
push esi
call dword [edx + 0x44]
push dword [ebp + 0xc]
mov esi, eax
call edi
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x5c]
push eax
call edi
lea eax, [ebp - 0x7c]
push eax
call edi
lea eax, [ebp - 0x8c]
push eax
call edi
test esi, esi
jns 0x409cb2
push esi
push str.Cant_RegisterTaskDefinition:_x
call fcn.0040ad50
add esp, 8
xor esi, esi
jmp 0x409cb7
mov esi, 1
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x409cc8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x409cd9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x409cea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x13
test eax, eax
je 0x409cfb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x11
test eax, eax
je 0x409d0c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.00405f10
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x409d25
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x409d36
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 7
test eax, eax
je 0x409d47
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 6
test eax, eax
je 0x409d58
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 4
test eax, eax
je 0x409d69
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 2
test eax, eax
je 0x409d7a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x409d8b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x409da9
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str.Name_or_Path_IsNULL
call fcn.0040ad50
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00406210
push 0x80004005
call fcn.00406210
push 0x80004005
call fcn.00406210
push 0x8007000e
call fcn.00406210
int3