Function at 0x481fd0
Capabilities:
Create thread
Resume thread
Shutdown system
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f0bb6
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebx + 0x14e4]
mov ecx, eax
push 0
mov dword [ebp - 0x2bc], eax
call fcn.005c5730
push 0x270
mov esi, eax
lea eax, [ebp - 0x2b0]
push 0
push eax
call fcn.00420090
add esp, 8
lea eax, [ebx + 0x14a8]
lea ecx, [ebp - 0x2b0]
push esi
push 0xffffffffffffffff
push SysReAllocString
push 0
push 0
push 0x12c
push 0x1c2
push str.Backup__Restore
push str.UVK_BACKUP_GUI
push eax
call fcn.005c6220
push 0
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 4], 0
call fcn.005c5730
mov edi, eax
mov edx, esi
push 0
mov ecx, edi
call fcn.005d3010
mov ecx, dword [ebp - 0x2bc]
push edi
call fcn.005c6150
push 0
lea ecx, [ebp - 0x2b0]
call fcn.005c44a0
push 0xffffff
call fcn.005c44b0
movsd xmm1, qword [0x6edaf8]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
test edi, edi
je 0x482114
push 1
push 0x12c
push 0x1c2
call fcn.0043dc00
push 0x12c
mov esi, eax
lea ecx, [ebp - 0x2b0]
push 0x1c2
push esi
call fcn.005c44c0
push 0xc
push 0x12c
push 0x1c2
push ecx
mov ecx, edi
call fcn.005d0c40
test esi, esi
je 0x482114
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push ecx
push 0xffffffffffffffff
push 0x30
push 0x30
push 0xa
push 0xa
push 0
lea ecx, [ebp - 0x2b0]
call fcn.005c00b0
mov cl, byte [ebp + 0xc]
mov dword [ebp - 0x2c0], eax
cmp cl, 1
jne 0x482141
mov edx, str.Restore_operation_progress
jmp 0x482151
cmp cl, 2
mov edx, str.Copy_Move_operation_progress
mov eax, str.Backup_operation_progress
cmovne edx, eax
push 0xffffffffffffffff
push 0x10000001
push 0x16
push 0x17e
push 0x14
push 0x3a
push edx
lea ecx, [ebp - 0x2b0]
call fcn.005c0890
movsd xmm0, qword [0x6edb20]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x320
push 0xffffffffffffffff
lea ecx, [ebp - 0x2b0]
call fcn.005beb10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x1ae
push 0x5a
push 0xa
push 0
lea ecx, [ebp - 0x2b0]
call fcn.005c0890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x1ae
push 0x73
push 0xa
push 0
lea ecx, [ebp - 0x2b0]
mov edi, eax
call fcn.005c0890
sub esp, 0xc
lea ecx, [ebp - 0x2b0]
mov esi, eax
push 0x12
push 0x1ae
push 0x91
push 0xa
call fcn.005bff60
push 0x3e8
push 0
push 0x406
push 0xffffffffffffffff
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2d0], eax
call fcn.005befd0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x1ae
push 0xa8
push 0xa
push 0
lea ecx, [ebp - 0x2b0]
call fcn.005c0890
push 0xffffffffffffffff
push 0
push 0x12
push 0x1ae
push 0xa8
push 0xa
push str.Operation_paused__press__Resume__to_continue
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2cc], eax
call fcn.005c0890
push edi
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2d8], eax
call fcn.005c5730
mov edi, dword [ebp - 0x2c8]
lea ecx, [ebp - 0x2b0]
push esi
mov dword [edi + 0x20], eax
call fcn.005c5730
mov dword [edi + 0x24], eax
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2b0]
call fcn.005c5730
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0x2b0]
mov dword [edi + 0x28], eax
call fcn.005c5730
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x2b0]
push 0
push str.Arial
push 1
push 0x190
mov dword [edi + 0x2c], eax
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0xc8
push 0xd1
push 0x28
push str.When_the_operation_completes_
lea ecx, [ebp - 0x2b0]
call fcn.005c0890
sub esp, 8
lea ecx, [ebp - 0x2b0]
push 0x10000043
push 0x19
push 0xa0
push 0xcd
push 0xfa
push str.Do_nothing_nClose_application_nLog_off_nSleep_nHibernate_nShut_down_nRestart
call fcn.005c1650
movsd xmm0, qword [ebx + 8]
comisd xmm0, xmmword [0x6edb10]
mov dword [ebp - 0x2dc], eax
jbe 0x482338
mov ecx, dword [ebp - 0x2bc]
push 0x800
push 0xffffffffffffffff
call fcn.005bda80
mov al, byte [ebp + 0xc]
cmp al, 1
jne 0x482346
mov esi, str.restore
jmp 0x482355
cmp al, 2
mov esi, str.copy_move
mov ecx, str.backup
cmovne esi, ecx
sub esp, 8
mov dword [ebp - 0x2bc], esi
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._operation
push esi
push str.Pause_the
call fcn.005dc520
lea eax, [ebp - 0x2b0]
mov byte [ebp - 4], 1
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov dword [esp], 0x41500000
call fcn.005dc190
push eax
push 0x1a
push 0x64
push 0x109
push 0xbe
push 0x89
push str.Pause
mov ecx, ebx
call fcn.0045fd50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._operation
push esi
push str.Stop_the
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x2c4], eax
call fcn.005dc200
lea eax, [ebp - 0x2b0]
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov dword [esp], 0x41500000
call fcn.005dc190
push eax
push 0x1a
push 0x64
push 0x109
push 0x140
push 0x9d
push str.Cancel
mov ecx, ebx
call fcn.0045fd50
xorps xmm0, xmm0
mov dword [ebp - 0x2d4], eax
lea ecx, [ebp - 0x40]
movq qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
lea ecx, [ebp - 0x28]
call fcn.005dc5e0
or esi, 0xffffffff
mov dword [ebp - 0x2b4], esi
mov al, byte [ebp + 0xc]
mov byte [ebp - 4], 5
cmp al, 1
jne 0x4824af
push 0
push 0
push edi
push 0x469c80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x2b4], esi
test esi, esi
jne 0x4824e7
or esi, 0xffffffff
jmp 0x4824e1
cmp al, 2
jne 0x4824bf
push 0
push 0
push edi
push 0x469c50
jmp 0x482494
test al, al
jne 0x4824e7
push 0
push 0
push edi
push 0x469cb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x2b4], esi
push 1
push 1
lea ecx, [ebp - 0x2b0]
call fcn.005c3f80
push 0xffffff
push 0x50
push 0xff000000
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0x2b0]
call fcn.005c5730
mov edx, 0x30
mov ecx, eax
call fcn.005d1e80
xor edi, edi
mov byte [ebp - 0x2b5], 0
push edi
mov ecx, ebx
mov dword [ebp - 0x2c0], edi
call fcn.004771c0
test eax, eax
je 0x482737
nop
mov eax, dword [ebx + 0x14a8]
cmp eax, 0xfffffffa
je 0x482680
lea ecx, [ebp - 0x2b0]
cmp dword [ebx + 0x14d8], ecx
jne 0x4826f2
cmp eax, dword [ebp - 0x2d4]
je 0x482680
cmp eax, dword [ebp - 0x2c4]
jne 0x4826f2
cmp byte [ebp - 0x2b5], 0
push esi
je 0x482591
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
sete cl
jmp 0x48259d
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne cl
push 0
mov edi, dword [ebp - 0x2c4]
test cl, cl
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov byte [ebp - 0x2b5], cl
mov eax, str.Resume_the
push str._operation
push dword [ebp - 0x2bc]
mov ecx, str.Pause_the
cmove eax, ecx
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
lea eax, [ebp - 0x2b0]
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov dword [esp], 0x41500000
call fcn.005dc190
mov cl, byte [ebp - 0x2b5]
mov edx, 0x96
push eax
push 0x1a
push 0x64
test cl, cl
mov eax, 0x89
push 0x109
cmovne eax, edx
mov ecx, str.Pause
push 0xbe
push eax
mov eax, str.Resume
cmove eax, ecx
mov ecx, ebx
push eax
call fcn.0045fd50
push edi
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2c4], eax
call fcn.005bf2f0
movzx eax, byte [ebp - 0x2b5]
lea ecx, [ebp - 0x2b0]
inc eax
push eax
push dword [ebp - 0x2d8]
call fcn.005bd3f0
movzx eax, byte [ebp - 0x2b5]
lea ecx, [ebp - 0x2b0]
xor eax, 1
inc eax
push eax
push dword [ebp - 0x2cc]
call fcn.005bd3f0
mov edi, dword [ebp - 0x2c0]
jmp 0x4826f2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._operation_
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x1c]
push str.Are_you_sure_you_want_to_cancel_the
call fcn.005dc200
sub esp, 8
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0x1c]
push 0x8c
push 0x190
push 0
push eax
push 1
call fcn.005dc190
push eax
mov ecx, ebx
call fcn.0043e2e0
test eax, eax
je 0x482726
cmp byte [ebp - 0x2b5], 0
mov eax, dword [ebp - 0x2c8]
mov dword [eax], 1
je 0x4826f2
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
je 0x482737
mov eax, dword [ebp - 0x2c8]
mov eax, dword [eax + 0x10]
cmp edi, eax
je 0x482726
mov edi, eax
lea ecx, [ebp - 0x2b0]
push edi
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2c0], edi
call fcn.005b9910
push 0
mov ecx, ebx
call fcn.004771c0
test eax, eax
jne 0x482540
mov edi, dword [ebp - 0x2dc]
lea ecx, [ebp - 0x2b0]
push 0
push 0
push 0x157
push edi
call fcn.005befd0
test eax, eax
je 0x482778
push 0
mov ecx, ebx
call fcn.004771c0
push 0
push 0
push 0x157
push edi
lea ecx, [ebp - 0x2b0]
call fcn.005befd0
test eax, eax
jne 0x482756
push 0
push 0
push 0x147
push edi
lea ecx, [ebp - 0x2b0]
call fcn.005befd0
test eax, eax
je 0x4827bf
mov byte [ebx + 0x1f80], 0
cmp eax, 2
jne 0x4827ae
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov edi, 2
jmp 0x4827c4
cmp eax, 3
jne 0x48281f
push 0
push 0
push 0
call dword [sym.imp.POWRPROF.dll_SetSuspendState]
mov edi, 1
cmp esi, 0xffffffff
je 0x4827d4
test esi, esi
je 0x4827d4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005dc430
lea ecx, [ebp - 0x40]
call fcn.005dc430
lea ecx, [ebp - 0x1c]
call fcn.005dc430
lea ecx, [ebp - 0x2b0]
call fcn.005c1c60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
cmp eax, 4
jne 0x48282c
push 0
push 0
push 1
jmp 0x4827b9
cmp eax, 5
jne 0x482842
push 0
push 1
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov edi, 2
jmp 0x4827c4
cmp eax, 6
jne 0x48285b
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov edi, 2
jmp 0x4827c4
cmp eax, 3
jl 0x482869
cmp eax, 4
jle 0x4827bf
mov edi, 2
jmp 0x4827c4