Function at 0x10005300
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1013d1cb
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
push edi
mov eax, dword [0x10170024]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, dword [esp + 0x60]
xor esi, esi
mov dword [esp + 0x58], esi
mov ecx, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [esp + 0x58], esi
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x5c], 1
call fcn.10003040
add esp, 4
push 0x1014cde8
lea ecx, [esp + 0x34]
call dword [0x101464cc]
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x58], 2
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
jae 0x100053a2
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x100053bc
lea eax, [esp + 0x18]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.CheduleItem
push str.BackupParam
call esi
cmp dword [esp + 0x64], 0
je 0x1000547c
cmp eax, 1
je 0x10005446
cmp eax, 2
je 0x10005422
cmp eax, 3
je 0x10005422
cmp eax, 5
je 0x1000543f
cmp eax, 4
jne 0x10005489
push 1
mov ecx, str.EventType
mov edx, str.BackupParam
lea eax, [esp + 0x18]
call fcn.10001780
cmp eax, 5
mov ecx, edi
jne 0x1000541b
push 0x1014ce90
jmp 0x10005483
push 0x1014ce94
jmp 0x10005483
cmp eax, 5
je 0x1000543f
cmp eax, 2
jne 0x10005433
push str.weekly
jmp 0x10005481
cmp eax, 3
jne 0x10005489
push str.monthly
jmp 0x10005481
push str.once
jmp 0x10005481
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x10005455
lea eax, [esp + 0x18]
push eax
push 1
push str.DailyItem
push str.BackupParam
call esi
cmp eax, 1
jne 0x10005470
push str.daily
jmp 0x10005481
cmp eax, 2
jne 0x10005489
push str.hourly
jmp 0x10005481
push str.manual
mov ecx, edi
call dword [0x10146514]
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.1012d370
add esp, 0x50
ret 8