Function at 0x1400010dc
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0xd78
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.1400034bd
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp - 0x7a8]
call fcn.1400036d8
add rsp, 0x20
lea rdi, [rbp - 0x5a8]
mov r12, 0x13
sub rsp, 0x20
mov rcx, 0x18
call fcn.14000360b
add rsp, 0x20
add rax, 0x61
stosw word [rdi], ax
dec r12
jne 0x140001145
xor rax, rax
stosw word [rdi], ax
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.ole32.dll_CoInitialize]
add rsp, 0x20
sub rsp, 0x30
lea rcx, [0x140005119]
mov rdx, 0
mov r8, 1
lea r9, [0x140005129]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
cmp eax, 0
jl 0x140001525
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x5a8]
lea r8, [0x140005149]
lea r9, [0x140005139]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov rax, qword [rcx]
call qword [rax + 0x40]
add rsp, 0x30
cmp eax, 0
jl 0x140001513
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rdx, 0x2202
mov rax, qword [rcx]
call qword [rax + 0xe0]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x448]
mov rdx, 0x400
call fcn.1400034bd
add rsp, 0x20
sub rsp, 0x20
call fcn.140002c78
add rsp, 0x20
cmp eax, 0x4000
je 0x140001245
cmp eax, 0x3000
jne 0x140001248
nop
jmp 0x140001276
mov qword [rbp - 0x448], 0x100
sub rsp, 0x20
mov rcx, 2
lea rdx, [rbp - 0x440]
lea r8, [rbp - 0x448]
call qword [sym.imp.secur32.dll_GetUserNameExW]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x440]
mov r8, 0
mov rax, qword [rcx]
call qword [rax + 0xf0]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x7a8]
mov rax, qword [rcx]
call qword [rax + 0x100]
add rsp, 0x20
cmp qword [rbp + 0x28], 0
je 0x1400012f0
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp - 0x8a8]
call fcn.1400036d8
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x8a8]
mov rax, qword [rcx]
call qword [rax + 0x110]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
movabs rdx, 0xd65cb580
mov rax, qword [rcx]
call qword [rax + 0x150]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x458]
lea r8, [rbp - 0x450]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x20
cmp eax, 0
jl 0x140001501
sub rsp, 0x20
lea rcx, [rbp - 0x488]
mov rdx, 0x30
call fcn.1400034bd
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x4a0]
call qword [sym.imp.kernel32.dll_GetLocalTime]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x4a0]
lea rdx, [rbp - 0x4a8]
call qword [sym.imp.kernel32.dll_SystemTimeToFileTime]
add rsp, 0x20
mov eax, 0x47868c00
cmp qword [rbp + 0x30], 1
jne 0x140001395
mov eax, 0x29b92700
xor edx, edx
add dword [rbp - 0x4a8], eax
adc dword [rbp - 0x4a4], edx
sub rsp, 0x20
lea rcx, [rbp - 0x4a8]
lea rdx, [rbp - 0x4a0]
call qword [sym.imp.kernel32.dll_FileTimeToSystemTime]
add rsp, 0x20
cmp qword [rbp + 0x30], 0
jne 0x1400013ef
mov dword [rbp - 0x468], 1
mov qword [rbp - 0x464], 1
mov dword [rbp - 0x474], 0x5a0
mov dword [rbp - 0x470], 2
mov word [rbp - 0x488], 0x30
mov ax, word [rbp - 0x496]
mov word [rbp - 0x476], ax
mov ax, word [rbp - 0x498]
mov word [rbp - 0x478], ax
mov ax, word [rbp - 0x49a]
mov word [rbp - 0x480], ax
mov ax, word [rbp - 0x49e]
mov word [rbp - 0x482], ax
mov ax, word [rbp - 0x4a0]
mov word [rbp - 0x484], ax
add ax, 0x64
mov word [rbp - 0x47e], ax
mov word [rbp - 0x47c], 1
mov word [rbp - 0x47a], 1
sub rsp, 0x20
mov rcx, qword [rbp - 0x450]
lea rdx, [rbp - 0x488]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, [0x140005159]
lea r8, [rbp - 0x490]
mov rax, qword [rcx]
call qword [rax]
add rsp, 0x20
cmp eax, 0
jl 0x1400014ec
sub rsp, 0x20
mov rcx, qword [rbp - 0x490]
mov rdx, 0
mov r8, 1
mov rax, qword [rcx]
call qword [rax + 0x30]
add rsp, 0x20
cmp qword [rbp + 0x38], 0
je 0x1400014d7
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x60]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x490]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x450]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x20
sub rsp, 0x20
call qword [sym.imp.ole32.dll_CoUninitialize]
add rsp, 0x20
add rsp, 0xd78
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret