Function at 0x412910
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x66f988
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x244], eax
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004a6b00
test eax, eax
je 0x412b36
push str.DWBackUpCleaned
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
call fcn.004a6c80
test eax, eax
je 0x412b1c
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x230], ebx
push 0x10c
push ebx
lea ecx, [ebp - 0x22c]
push ecx
call fcn.005dfd60
xor esi, esi
mov dword [ebp - 0x240], esi
push ebx
push 1
push str.Compressing_FBackup...
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0x230], ebx
push str.SoftwareMicroWorldFBackUp
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x128], ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
lea ecx, [ebp - 0x230]
push ecx
push 0x4b21a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x238], eax
cmp eax, ebx
je 0x412ab0
mov edx, dword [ebp - 0x23c]
push edx
push 0xffffffffffffffff
push str.ENUM_REG_4a
call fcn.00411ca0
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
cmp dword [ebp - 0x128], ebx
jne 0x412a3e
push 1
call edi
jmp 0x412a30
push ebx
push 0x6d60
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
jne 0x412a98
cmp dword [ebp - 0x124], ebx
je 0x412a91
lea ecx, [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
jne 0x412a91
cmp dword [ebp - 0x234], 0x103
jne 0x412a91
mov eax, dword [ebp - 0x124]
mov dword [eax], 1
call fcn.004a6cd0
jmp 0x412aa4
mov esi, dword [ebp - 0x230]
mov dword [ebp - 0x240], esi
lea ecx, [ebp - 0x238]
push ecx
call fcn.004dca10
cmp dword [0x7431c8], ebx
je 0x412c0e
cmp esi, ebx
jle 0x412c0e
cmp dword [0x6b0544], ebx
jne 0x412c0e
push esi
push str.FBackup_Thread_Created___d_...
lea edx, [ebp - 0x120]
push edx
call fcn.005dfb23
push ebx
push 1
lea eax, [ebp - 0x120]
push eax
push 0x6aec98
call fcn.004311c0
mov ecx, dword [ebp - 0x244]
push ecx
push ebx
push 0x4b2220
call fcn.005e07ac
push ebx
push eax
push str.AVM_1a
call fcn.00411ca0
add esp, 0x34
jmp 0x412c0e
push ebx
push 1
push str.Not_Compressing_FBackup._Compression_Disabled.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x412c0e
push ebx
push 1
push str.Not_Compressing_FBackup._Backup_Disabled.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp esi, ebx
je 0x412c0e
cmp byte [esi], bl
je 0x412c0e
push esi
call fcn.004ec720
add esp, 4
test eax, eax
je 0x412c0e
mov dword [ebp - 0x234], ebx
lea edx, [ebp - 0x234]
push edx
push str.DWBackUpCleaned
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov eax, 2
cmp dword [ebp - 0x234], eax
jae 0x412c0e
mov dword [ebp - 0x234], eax
push eax
push str.DWBackUpCleaned
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push ebx
push ebx
push str.SoftwareMicroWorldFBackUp
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9480
push esi
push ebx
push 0x4127b0
call fcn.005e07ac
add esp, 0xc
mov edi, eax
cmp byte [esi], bl
je 0x412be5
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412bd7
push ebx
push edi
push str.AVM_1b
call fcn.00411ca0
add esp, 0xc
jmp 0x412c0e
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret