Function at 0x10001488
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10015266
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x1001c680]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push esi
push edi
mov eax, dword [0x1001c680]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
push str.C:ProgramDatamphost.exe
lea esi, [esp + 0xc0]
call fcn.10001c56
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0xf0], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x10001506
push 1
xor edi, edi
lea esi, [esp + 0xc0]
call fcn.10001d67
xor eax, eax
inc eax
jmp 0x10001ae0
push ebx
push ebx
push ebx
push 3
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x10001524
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x100014ee
lea eax, [esp + 0x20]
push eax
push 0x10016434
push 1
push ebx
push 0x10016644
mov dword [esp + 0x34], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x1000151c
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [esp + 0x6c]
lea edi, [esp + 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xac]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [esp + 0xac]
lea edi, [esp + 0x7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x4c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea esi, [esp + 0x4c]
lea edi, [esp + 0x8c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x5c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0xe8], 4
sub esp, 0x10
mov edi, esp
lea esi, [esp + 0xac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [esp + 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
mov eax, dword [esp + 0x50]
lea esi, [esp + 0xbc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [esp + 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x28]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, eax
lea eax, [esp + 0x5c]
push eax
call esi
lea eax, [esp + 0x4c]
push eax
call esi
lea eax, [esp + 0xac]
push eax
call esi
lea eax, [esp + 0x6c]
mov byte [esp + 0xe8], bl
push eax
call esi
cmp edi, ebx
jge 0x10001633
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1000151c
push 0x10019320
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
call fcn.10001155
mov byte [esp + 0xe8], 5
mov eax, dword [eax]
cmp eax, ebx
je 0x10001657
mov eax, dword [eax]
jmp 0x10001659
xor eax, eax
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
lea esi, [esp + 0x18]
push esi
push eax
push ecx
call dword [edx + 0x1c]
lea edi, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0xe8], bl
call fcn.100011b5
cmp esi, ebx
jl 0x10001624
push 0x10019324
lea edi, [esp + 0x20]
call fcn.10001155
mov byte [esp + 0xe8], 6
mov eax, dword [eax]
cmp eax, ebx
je 0x1000169f
mov eax, dword [eax]
jmp 0x100016a1
xor eax, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push ebx
push eax
push ecx
call dword [edx + 0x3c]
lea edi, [esp + 0x1c]
mov byte [esp + 0xe8], bl
call fcn.100011b5
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov esi, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jge 0x100016ea
mov eax, dword [esp + 0x18]
jmp 0x10001628
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jns 0x10001714
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
jmp 0x10001628
push str.AUTHOR_NAME
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x28]
mov edi, eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
jl 0x10001701
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp eax, ebx
jl 0x10001701
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x48]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x40]
push str.PT0S
lea edi, [esp + 0x20]
call fcn.10001155
mov byte [esp + 0xe8], 7
mov eax, dword [eax]
cmp eax, ebx
je 0x10001787
mov eax, dword [eax]
jmp 0x10001789
xor eax, eax
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x70]
lea edi, [esp + 0x1c]
mov byte [esp + 0xe8], bl
call fcn.100011b5
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
js 0x10001701
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x30]
push edx
push 9
mov dword [esp + 0x38], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov esi, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x10001701
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x40]
push edx
push 0x100164e4
mov dword [esp + 0x48], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x10001701
push str.Trigger1
lea edi, [esp + 0x20]
call fcn.10001155
mov byte [esp + 0xe8], 8
mov eax, dword [eax]
cmp eax, ebx
je 0x1000183d
mov eax, dword [eax]
jmp 0x1000183f
xor eax, eax
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
lea edi, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0xe8], bl
call fcn.100011b5
cmp esi, ebx
jl 0x10001701
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push edx
push eax
call dword [ecx + 0x3c]
test eax, eax
js 0x10001701
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
xor edi, edi
inc edi
push edi
push eax
call dword [ecx + 0x48]
test eax, eax
jns 0x100018b7
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
jmp 0x100014f0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
test eax, eax
js 0x10001897
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x2c]
push edx
push ebx
mov dword [esp + 0x34], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov esi, eax
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x10001897
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push edx
push str.MbLk
mov dword [esp + 0x30], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x10001897
cmp dword [esp + 0xd0], 8
mov eax, dword [esp + 0xbc]
jae 0x10001935
lea eax, [esp + 0xbc]
push eax
lea edi, [esp + 0x20]
call fcn.10001155
mov byte [esp + 0xe8], 9
mov eax, dword [eax]
cmp eax, ebx
je 0x10001951
mov eax, dword [eax]
jmp 0x10001953
xor eax, eax
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x2c]
lea edi, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0xe8], bl
call fcn.100011b5
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x10001701
push 8
pop eax
push 0x10019390
mov dword [esp + 0x48], ebx
mov word [esp + 0x60], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x64], eax
cmp eax, ebx
jne 0x100019ab
push 0x8007000e
call fcn.10004590
lea esi, [esp + 0x5c]
lea edi, [esp + 0x8c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x6c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0xe8], 0xb
lea esi, [esp + 0x6c]
lea edi, [esp + 0x7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 8
movsd dword es:[edi], dword [esi]
pop eax
push str.S_1_5_32_544
movsd dword es:[edi], dword [esi]
mov word [esp + 0x50], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x54], eax
cmp eax, ebx
je 0x100019a1
mov byte [esp + 0xe8], 0xc
lea esi, [esp + 0x4c]
lea edi, [esp + 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x10019324
lea edi, [esp + 0x20]
call fcn.10001155
mov byte [esp + 0xe8], 0xd
mov eax, dword [eax]
cmp eax, ebx
je 0x10001a2b
mov ecx, dword [eax]
jmp 0x10001a2d
xor ecx, ecx
lea esi, [esp + 0x44]
push esi
sub esp, 0x10
mov edi, esp
lea esi, [esp + 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
sub esp, 0x10
mov edi, esp
mov eax, dword [esp + 0x40]
lea esi, [esp + 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [eax]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [esp + 0xd4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
push dword [esp + 0x50]
movsd dword es:[edi], dword [esi]
push ecx
push eax
movsd dword es:[edi], dword [esi]
call dword [edx + 0x44]
lea edi, [esp + 0x1c]
mov esi, eax
call fcn.100011b5
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x4c]
push eax
call edi
lea eax, [esp + 0x6c]
push eax
call edi
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0xec], bl
call edi
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x1000151c
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 1
xor edi, edi
lea esi, [esp + 0xc0]
call fcn.10001d67
xor eax, eax
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.100046a1
mov esp, ebp
pop ebp
ret