Function at 0x1000351a
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], edx
push 0x2e
xor ebx, ebx
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4a]
mov edi, ecx
push ebx
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x258]
push eax
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x10003576
mov esi, dword [ebp + 0xc]
cmp dword [esi], ebx
je 0x1000356f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor al, al
jmp 0x1000369a
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, eax
test ecx, ecx
jns 0x1000358f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000356f
mov dword [eax], ecx
jmp 0x1000356f
lea eax, [ebp - 8]
push eax
push 0x100066e8
xor eax, eax
inc eax
push eax
push ebx
push 0x10006708
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x10003677
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
add esi, 0x618
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push 0x100066d8
push 0x100066f8
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x20]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
js 0x10003677
mov eax, dword [ebp - 4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov esi, eax
test esi, esi
js 0x10003677
mov eax, dword [ebp - 4]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov esi, eax
test esi, esi
js 0x10003677
mov eax, dword [ebp - 4]
push dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov esi, eax
test esi, esi
js 0x10003677
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x258]
push ebx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov esi, eax
test esi, esi
js 0x10003677
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov esi, eax
test esi, esi
js 0x10003677
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jns 0x100036a1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10003680
mov dword [eax], esi
call dword [sym.imp.ole32.dll_CoUninitialize]
test bl, bl
jne 0x10003698
mov ecx, dword [ebp + 8]
lea ecx, [ecx + 0x618]
call fcn.1000373c
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x30
pop eax
mov word [ebp - 0x4c], ax
lea edx, [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x2c], 7
inc eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x46], ax
mov eax, 0x7cf
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
test esi, esi
jns 0x100036e4
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
jmp 0x10003671
lea edx, [ebp - 0xc]
push edx
push 0x10006718
push eax
call dword [ecx]
mov esi, eax
test esi, esi
js 0x1000366e
mov eax, dword [ebp - 0xc]
push 1
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
test esi, esi
js 0x10003674
call dword [ecx + 0x30]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
js 0x10003677
mov bl, 1
jmp 0x10003680