Function at 0x404550
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f0
push ebx
push esi
push edi
lea edi, [ebp - 0x8f0]
mov ecx, 0x23c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x44], 0
mov ecx, 0xb
xor eax, eax
lea edi, [ebp - 0x42]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], 0
xor eax, eax
mov dword [ebp - 0x5a], eax
mov dword [ebp - 0x56], eax
mov dword [ebp - 0x52], eax
mov word [ebp - 0x4e], ax
mov dword [ebp - 0x448], 0x1f4
mov esi, esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00406480
mov esi, esp
push 0x64
lea ecx, [ebp - 0x4ac]
push ecx
push str.a3d2peUt
call fcn.00406400
add esp, 4
push eax
push str.a3d2peUt
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 0x8b0], eax
mov edx, dword [ebp - 0x8b0]
mov word [ebp + edx*2 - 0x4ac], 0
mov esi, esp
push 0x400
lea eax, [ebp - 0x8ac]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406400
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8b0]
mov word [ebp + eax*2 - 0x8ac], 0
mov esi, esp
lea ecx, [ebp - 8]
push ecx
push 0x425060
push 1
push 0
push 0x425080
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40469c
jmp 0x404915
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x425040
push 0x425070
lea eax, [ebp - 0x4ac]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
call dword [edx + 0x20]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4046d4
jmp 0x404910
mov esi, esp
lea ecx, [ebp - 0x8ac]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [eax + 0x80]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404701
jmp 0x40490b
mov esi, esp
push 0x2000
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [eax + 0x70]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404729
jmp 0x404906
mov esi, esp
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp esi, esp
call fcn.00406480
mov esi, esp
push 0
lea ecx, [ebp - 0x444]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [eax + 0x78]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404772
jmp 0x404901
mov esi, esp
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
call dword [edx + 0xc]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40479d
jmp 0x4048fc
mov esi, esp
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp esi, esp
call fcn.00406480
mov word [ebp - 0x44], 0x30
mov dx, word [ebp - 0x56]
mov word [ebp - 0x3c], dx
mov ax, word [ebp - 0x5a]
mov word [ebp - 0x3e], ax
mov cx, word [ebp - 0x5c]
mov word [ebp - 0x40], cx
mov word [ebp - 0x34], 0xf
mov dword [ebp - 0x24], 7
mov word [ebp - 0x20], 1
mov esi, esp
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0xc]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404808
jmp 0x4048f7
mov esi, esp
lea eax, [ebp - 0x10]
push eax
push 0x4256e0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
call dword [edx]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x404833
jmp 0x4048f2
mov esi, esp
push 1
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
push eax
call dword [edx + 0x18]
cmp esi, esp
call fcn.00406480
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40485a
jmp 0x4048ed
mov dword [ebp - 0x4c], 1
cmp dword [ebp - 0xc], 0
je 0x40487c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [edx + 8]
cmp esi, esp
call fcn.00406480
cmp dword [ebp - 0x10], 0
je 0x404897
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 0x10]
push eax
call dword [edx + 8]
cmp esi, esp
call fcn.00406480
cmp dword [ebp - 0x14], 0
je 0x4048b2
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [edx + 8]
cmp esi, esp
call fcn.00406480
cmp dword [ebp - 8], 0
je 0x4048cd
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [edx + 8]
cmp esi, esp
call fcn.00406480
mov esi, esp
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp esi, esp
call fcn.00406480
cmp dword [ebp - 0x4c], 0
jne 0x4048e6
xor eax, eax
jmp 0x40491a
mov eax, 1
jmp 0x40491a
jmp 0x404861
jmp 0x404861
jmp 0x404861
jmp 0x404861
jmp 0x404861
jmp 0x404861
jmp 0x404861
jmp 0x404861
jmp 0x404861
pop edi
pop esi
pop ebx
add esp, 0x8f0
cmp ebp, esp
call fcn.00406480
mov esp, ebp
pop ebp
ret