Function at 0x409ac0
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x206
push eax
mov word [ebp - 0x41c], ax
xor edi, edi
lea eax, [ebp - 0x41a]
push eax
call fcn.00417510
add esp, 0xc
xor eax, eax
mov word [ebp - 0x82c], ax
push 0x206
push eax
lea eax, [ebp - 0x82a]
push eax
call fcn.00417510
add esp, 0xc
lea eax, [ebp - 0x82c]
push esi
push ecx
push eax
push ecx
lea eax, [ebp - 0x41c]
push eax
call fcn.004098f0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00417510
add esp, 0xc
call fcn.004056a0
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call fcn.00405840
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.004056a0
push edi
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x86c]
push eax
push 0x421398
push 1
push edi
push 0x4213b8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x409d9a
mov eax, dword [ebp - 0x86c]
lea edx, [ebp - 0x41c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x86c]
lea edx, [ebp - 0x868]
push edx
push 0x421388
push 0x4213a8
mov ecx, dword [eax]
lea edx, [ebp - 0x41c]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
js 0x409d9a
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x82c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x868]
push str._check_update
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x868]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [ebp - 0x868]
push 0x2000
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
xor eax, eax
push 0x200
push eax
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push eax
call fcn.00417510
add esp, 0xc
mov dword [ebp - 0x830], 0x101
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x624]
push edi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x870]
push edx
lea edx, [ebp - 0x834]
mov esi, 1
push edx
mov ecx, dword [eax]
push eax
mov word [ebp - 0x87c], si
call dword [ecx + 0xc]
test eax, eax
js 0x409d49
push 0x30
lea eax, [ebp - 0x864]
push edi
push eax
call fcn.00417510
mov eax, 0x30
mov dword [ebp - 0x85e], 0x10001
mov word [ebp - 0x864], ax
lea edx, [ebp - 0x864]
xor eax, eax
mov dword [ebp - 0x850], 0x5a0
mov dword [ebp - 0x854], eax
add esp, 0xc
mov eax, 0x7d0
mov dword [ebp - 0x84c], 0x1e
mov word [ebp - 0x860], ax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x844], esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x870]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x868]
lea edx, [ebp - 0x874]
push edx
push 0x421378
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x409d80
mov eax, dword [ebp - 0x874]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x868]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00410c9e
mov esp, ebp
pop ebp
ret 4