Function at 0x40d070
Capabilities:
Get session user name
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5070d3
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push esi
push edi
mov eax, dword [0x551580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x40d97e
cmp dword [ebp + 0xc], 0
je 0x40d97e
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 0x513e24
push 0x17
push 0
push 0x52aca0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x40d0f5
push eax
push str.Cant_CoCreateInstance_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d955
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x6c], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 1
sub esp, 0x10
mov edx, dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x28]
test eax, eax
jns 0x40d150
push eax
push str.Cant_Connect_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d94b
mov dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push 0x5134f8
mov byte [ebp - 4], 2
call fcn.0040beb0
mov eax, dword [eax]
mov byte [ebp - 4], 3
test eax, eax
je 0x40d179
mov ecx, dword [eax]
jmp 0x40d17b
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x38]
push edx
push ecx
push esi
call dword [eax + 0x1c]
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x24], eax
test esi, esi
je 0x40d1d9
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x40d1d9
test esi, esi
je 0x40d1d9
mov eax, dword [esi]
test eax, eax
je 0x40d1b4
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40d1cb
push eax
call fcn.0043b335
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0043b077
mov eax, dword [ebp - 0x24]
add esp, 8
test eax, eax
jns 0x40d1f2
push eax
push str.Cant_GetFolder_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d93a
mov dword [ebp - 0x34], 0
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0x24]
push 0x5134f8
mov byte [ebp - 4], 4
call fcn.0040beb0
mov eax, dword [eax]
mov byte [ebp - 4], 5
test eax, eax
je 0x40d21b
mov ecx, dword [eax]
jmp 0x40d21d
xor ecx, ecx
mov eax, dword [esi]
lea edx, [ebp - 0x34]
push edx
push ecx
push esi
call dword [eax + 0x24]
mov esi, dword [ebp - 0x24]
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 4
test esi, esi
je 0x40d27b
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x40d27b
test esi, esi
je 0x40d27b
mov eax, dword [esi]
test eax, eax
je 0x40d256
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40d26d
push eax
call fcn.0043b335
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0043b077
mov ecx, dword [ebp - 0x10]
add esp, 8
test ecx, ecx
jns 0x40d2c9
push ecx
push 0x5134f8
push str.Cant_GetFolder_:_s___x
call fcn.0040e620
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
movups xmm0, xmmword [ebp - 0x6c]
add esp, 0xc
mov edx, dword [eax]
push ecx
sub esp, 0x10
mov ecx, esp
push 0x5134f8
push eax
movups xmmword [ecx], xmm0
call dword [edx + 0x2c]
test eax, eax
jns 0x40d2c9
push eax
push str.Cant_CreateFolder_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d929
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 6
call dword [ecx + 0x24]
test eax, eax
jns 0x40d2fc
push eax
push str.Cant_NewTask_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d918
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x30]
push edx
push eax
mov byte [ebp - 4], 7
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x40d32d
push eax
push str.Cant_get_Settings:__x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d907
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call fcn.0040cb50
movzx eax, ax
push eax
push esi
call dword [edi + 0x48]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x40d37a
push esi
push str.Cant_put_DisallowStartIfOnBatteries:__x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d907
mov esi, dword [ebp - 0x30]
mov eax, 0xb
mov word [ebp - 0x5c], ax
xor eax, eax
mov word [ebp - 0x54], ax
mov edi, dword [esi]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 9
call fcn.0040cb50
movzx eax, ax
push eax
push esi
call dword [edi + 0x40]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jns 0x40d3c7
push esi
push str.Cant_put_StopIfGoingOnBatteries:__x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d907
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x48]
push edx
push eax
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x40d3f8
push eax
push str.Cant_get_Triggers_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d8f6
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push 9
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x28]
mov esi, eax
test esi, esi
jns 0x40d42d
push esi
push str.Cant_CreateTask_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d8e5
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x40d454
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x5137e0
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
test ecx, ecx
jne 0x40d471
push esi
push str.Cant_logon_trigger_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d8d4
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov edi, dword [ebp - 0x14]
push str.Trigger1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x40d9a0
mov eax, dword [edi]
push esi
push edi
mov byte [ebp - 4], 0xd
call dword [eax + 0x24]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov byte [ebp - 4], 0xc
call edi
cmp word [0x5576e0], 0
mov esi, dword [ebp - 0x14]
jne 0x40d4d0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x100
push eax
push 0x5576e0
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.00406c40
mov ecx, eax
test ecx, ecx
je 0x40d9aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x5576e0
mov byte [ebp - 4], 0xe
test eax, 0xffff0000
jne 0x40d50a
movzx eax, ax
lea ecx, [ebp - 0x10]
push eax
call fcn.0040a980
jmp 0x40d52f
mov ecx, 0x5576e0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d512
sub ecx, edx
sar ecx, 1
push ecx
push 0x5576e0
lea ecx, [ebp - 0x10]
call fcn.0040e690
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.0040b910
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x10
call dword [ecx + 0x5c]
push dword [ebp - 0x1c]
call edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.0040a140
call fcn.00406c40
mov ecx, eax
test ecx, ecx
je 0x40d9b4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x11
push str.PT3S
push eax
call fcn.0040a460
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
add esp, 8
push dword [ebp - 0x10]
call fcn.0040b910
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x12
call dword [ecx + 0x54]
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x40]
push edx
push eax
mov byte [ebp - 4], 0x13
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x40d5dc
push eax
push str.Cant_get_Actions_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d8bb
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x14
call dword [ecx + 0x30]
test eax, eax
jns 0x40d60f
push eax
push str.Cant_Create_action_:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d8aa
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.0040b6f0
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x15
call fcn.0040b910
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x16
call dword [ecx + 0x2c]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x40d65c
push esi
push str.Cant_put_Path:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d899
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40d69f
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.0040b910
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x17
call dword [ecx + 0x34]
push dword [ebp + 0xc]
mov esi, eax
mov byte [ebp - 4], 0x15
call edi
test esi, esi
jns 0x40d69f
push esi
push str.Cant_put_Arguments:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d899
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40d6de
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp + 0xc]
push eax
call fcn.0040b910
push dword [eax]
mov ecx, dword [esi]
push esi
mov byte [ebp - 4], 0x18
call dword [ecx + 0x3c]
push dword [ebp + 0xc]
mov esi, eax
call edi
test esi, esi
jns 0x40d6de
push esi
push str.Cant_put_WorkingDirectory:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d899
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x40d70f
push eax
push str.Cant_get_Principal:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d888
mov eax, dword [ebp - 0x28]
push str.Users
mov dword [ebp + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp + 0x14], esi
test esi, esi
je 0x40d9be
mov ecx, dword [ebp + 0xc]
push esi
push ecx
mov byte [ebp - 4], 0x1a
mov eax, dword [ecx]
call dword [eax + 0x40]
push esi
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0x19
call edi
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x40d761
push eax
push str.Cant_put_GroupId:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d888
mov eax, dword [ebp - 0x28]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
jns 0x40d785
push eax
push str.Cant_put_RunLevel:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d888
mov dword [ebp - 0x4c], 0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x8c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x8c]
lea eax, [ebp - 0x7c]
push eax
movups xmmword [ebp - 0x9c], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x7c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x7c]
lea eax, [ebp - 0x5c]
push eax
movups xmmword [ebp - 0xac], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x5c], xmm0
call esi
movups xmm0, xmmword [ebp - 0x5c]
mov esi, dword [ebp - 0x34]
lea ecx, [ebp + 0xc]
push dword [ebp + 8]
mov byte [ebp - 4], 0x1e
movups xmmword [ebp - 0xbc], xmm0
call fcn.0040b910
mov ecx, dword [eax]
lea eax, [ebp - 0x4c]
movups xmm0, xmmword [ebp - 0x9c]
push eax
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov byte [ebp - 4], 0x1f
push 3
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xac]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xbc]
push 6
push dword [ebp - 0x18]
movups xmmword [eax], xmm0
push ecx
push esi
call dword [edx + 0x44]
push dword [ebp + 0xc]
mov esi, eax
call edi
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x5c]
push eax
call edi
lea eax, [ebp - 0x7c]
push eax
call edi
lea eax, [ebp - 0x8c]
push eax
call edi
test esi, esi
jns 0x40d872
push esi
push str.Cant_RegisterTaskDefinition:_x
call fcn.0040e620
add esp, 8
xor esi, esi
jmp 0x40d877
mov esi, 1
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x40d888
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x40d899
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x14
test eax, eax
je 0x40d8aa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x13
test eax, eax
je 0x40d8bb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0x11
test eax, eax
je 0x40d8cc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.0040a140
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x40d8e5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x40d8f6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 7
test eax, eax
je 0x40d907
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 6
test eax, eax
je 0x40d918
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 4
test eax, eax
je 0x40d929
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 2
test eax, eax
je 0x40d93a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 1
test eax, eax
je 0x40d94b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x40d969
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str.Name_or_Path_IsNULL
call fcn.0040e620
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00405910
push 0x80004005
call fcn.00405910
push 0x80004005
call fcn.00405910
push 0x8007000e
call fcn.00405910
int3