Function at 0x440420
Capabilities:
Check for peb beingdebugged flag
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
xor edx, edx
pushfd
pop eax
xor eax, 0x200000
push eax
popfd
pushfd
pop ebx
cmp eax, ebx
jne 0x440451
mov eax, 1
cpuid
and edx, 0x800000
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
xor edi, edi
cmp eax, edi
jne 0x440477
push 0x30
push edi
push str.MMX_technology_suport_required.
push edi
call dword [0x4a4400]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [0x4a4740]
test al, al
jne 0x44049a
push 0x30
push edi
push str.Pack_is_not_yet.
push edi
call dword [0x4a4400]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Initialize_Error.
push 0xc50e54
call dword [0x4a41ec]
mov esi, dword [ebp + 8]
mov dword [0x81ed54], esi
mov dword [0x814428], esi
mov ecx, dword [esi + 0x3c]
add ecx, esi
mov dword [0x814d3c], ecx
mov eax, dword [ecx + 0x80]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 0xc]
cmp eax, edi
mov dword [ebp - 4], edi
mov dword [ebp + 8], edi
je 0x440580
lea edx, [eax + esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.004730a0
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
add ebx, eax
mov eax, dword [ecx + 0x10]
mov dword [ebp + 8], ebx
mov ebx, dword [ecx]
add eax, esi
add ebx, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add esp, 8
test eax, eax
je 0x440566
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
mov edx, dword [ecx]
add edi, edx
test eax, 0x80000000
mov dword [ebp - 4], edi
je 0x440531
and eax, 0x7fffffff
jmp 0x44054b
lea edx, [eax + esi + 2]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.004730a0
add esp, 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebx + 4]
add ebx, 4
add edi, 4
test eax, eax
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], edi
jne 0x440516
mov eax, dword [ebp - 0xc]
add eax, 0x14
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4404e0
mov ecx, dword [0x814d3c]
push ecx
call fcn.00414ed0
mov eax, dword [esi + 0x3c]
add eax, esi
xor ecx, ecx
mov cx, word [eax + 6]
xor edx, edx
mov dx, word [eax + 0x14]
add esp, 4
xor edi, edi
test ecx, ecx
lea edx, [edx + eax + 0x18]
jbe 0x4405ba
mov eax, 0x74786574
cmp dword [edx + 1], eax
je 0x44067a
add edx, 0x28
inc edi
cmp edi, ecx
jb 0x4405a9
mov eax, dword [0x814830]
cmp edi, ecx
jne 0x4405ea
mov ecx, dword [0x814d3c]
mov eax, dword [ecx + 0x2c]
add eax, dword [0x814428]
mov dword [0x814830], eax
mov ecx, dword [ecx + 0x1c]
mov dword [0x814010], ecx
mov dword [0x4fbcb4], 1
mov ebx, dword [0x814010]
lea edx, [ebp - 8]
push edx
push 0x20
mov edi, eax
push ebx
push edi
mov dword [0x4c2b58], 0
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call dword [0x4a4140]
mov eax, dword [ebp - 4]
push ebx
push edi
mov dword [0x4c2b5c], eax
call fcn.004730a0
mov dword [0x814d44], eax
mov eax, dword [ebp + 0x10]
mov cl, byte [eax]
add esp, 8
test cl, cl
je 0x44064b
push eax
call dword [0x4a43d4]
lea ecx, [ebp + 0x10]
push ecx
call fcn.00440200
add esp, 4
test eax, eax
je 0x440834
mov eax, dword [esi + 0x3c]
add eax, esi
xor edi, edi
mov di, word [eax + 6]
xor edx, edx
mov dx, word [eax + 0x14]
xor ebx, ebx
test edi, edi
lea eax, [edx + eax + 0x18]
jbe 0x4406b1
mov ecx, 0x786f6972
cmp dword [eax + 1], ecx
je 0x440692
add eax, 0x28
inc ebx
cmp ebx, edi
jb 0x44066b
jmp 0x4406b1
mov eax, dword [edx + 0xc]
add eax, esi
mov dword [0x814830], eax
mov edx, dword [edx + 8]
mov dword [0x814010], edx
jmp 0x4405bf
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
add ecx, esi
push eax
push ecx
call fcn.004730a0
mov ecx, dword [0x814d44]
add esp, 8
xor eax, ecx
mov dword [0xc50e4c], eax
cmp ebx, edi
jne 0x4406c7
mov eax, dword [0xc50e4c]
mov ecx, dword [0x814d44]
xor eax, ecx
mov dword [0xc50e4c], eax
lea edx, [ebp - 0xc0]
push edx
mov dword [ebp - 0xc0], 0x94
call dword [0x4a40cc]
xor eax, eax
mov ecx, 0x41
lea edi, [ebp - 0x1c4]
push str.kernel32.dll
rep stosd dword es:[edi], eax
call dword [0x4a4160]
mov edi, dword [0x4a4164]
push str.GetProcAddress
push eax
mov dword [0x8182b4], eax
call edi
mov dword [0x818d1c], eax
mov eax, dword [0x8182b4]
push str.IsDebuggerPresent
push eax
call edi
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov al, byte [eax + 2]
and eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x440834
mov eax, dword [ebp - 0xb0]
mov ebx, 1
cmp eax, ebx
jb 0x440793
mov eax, dword [ebp - 0xbc]
cmp eax, 4
ja 0x440762
jne 0x440793
mov eax, dword [ebp - 0xb8]
test eax, eax
jbe 0x440793
call dword [0x4a413c]
test eax, eax
jne 0x440834
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov eax, dword [edi + 8]
mov dword [ebp - 0x1c4], ecx
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x1c0], edx
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1b8], ecx
cmp dword [ebp - 0xb0], 2
jne 0x4407ab
cmp dword [ebp - 0xbc], 4
mov dword [0xc50e50], ebx
ja 0x4407b5
mov dword [0xc50e50], 0
mov dword [0xc51e24], ebx
call dword [0x4a44e0]
mov dword [ebp - 8], eax
call fcn.00408ce0
test eax, eax
jne 0x4407d8
mov eax, dword [0xc51054]
test eax, eax
je 0x44081a
jmp 0x440810
mov edi, dword [0x4a41ec]
push str.Start_Error.
push 0xc50e54
call edi
mov edx, dword [ebp + 0x14]
push edx
push esi
call fcn.0043f910
add esp, 8
test eax, eax
jne 0x44083f
push str.CreateWindow_Error.
push 0xc50e54
call edi
mov eax, dword [0xc51054]
test eax, eax
je 0x44081a
call fcn.00413ef0
call fcn.00414310
mov al, byte [0xc50e54]
test al, al
je 0x440834
push 0x30
push 0
push 0xc50e54
push 0
call dword [0x4a4400]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0xc51054]
push 0
push 0
push 0x7e8
push eax
call dword [0x4a43c8]
mov edx, dword [ebp - 0xc]
xor eax, eax
test edx, edx
mov bl, 0xcc
jbe 0x440872
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + eax], bl
jne 0x44086d
inc dword [0x814d48]
inc eax
cmp eax, edx
jb 0x440862
call fcn.004097a0
test eax, eax
jne 0x4408d6
mov eax, dword [0xc51054]
test eax, eax
je 0x44088e
call fcn.00413ef0
call fcn.00414310
mov al, byte [0xc50e54]
test al, al
je 0x4408a8
push 0x30
push 0
push 0xc50e54
push 0
call dword [0x4a4400]
mov ecx, dword [0xc51054]
push ecx
call dword [0x4a4368]
test eax, eax
je 0x4408c6
mov edx, dword [0xc51054]
push edx
call dword [0x4a4494]
call fcn.00413150
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x4ec1d4
push 0xc50e54
call edi
mov eax, dword [0x4c2b58]
test eax, eax
mov dword [ebp + 0x14], 1
je 0x4408fb
cmp dword [ebp + 8], eax
jne 0x440a98
xor eax, eax
cmp byte [ebp + eax - 0x1c4], bl
je 0x44090e
inc eax
cmp eax, 0xd
jb 0x4408fd
jmp 0x440961
call fcn.0044d99b
mov edi, eax
and edi, 0x800003ff
jns 0x440925
dec edi
or edi, 0xfffffc00
inc edi
inc edi
shl edi, 0xa
mov dword [ebp + 8], 0x100
push edi
push 0
call dword [0x4a4184]
xor esi, esi
test edi, edi
mov ebx, eax
jbe 0x44095c
call fcn.0044d99b
and eax, 0x800000ff
jns 0x440954
dec eax
or eax, 0xffffff00
inc eax
mov byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x440941
dec dword [ebp + 8]
jne 0x440930
xor esi, esi
call dword [0x4a44e0]
sub eax, dword [ebp - 8]
cmp eax, 0xea60
ja 0x440a98
mov ebx, dword [0x4a4484]
mov edi, dword [0x4a4388]
mov eax, dword [0x4fbcc4]
cmp eax, esi
je 0x440a35
push 0x4fbcc0
push esi
push esi
push 0x440330
push esi
push esi
call fcn.0044e25b
add esp, 0x18
cmp eax, esi
mov dword [0x4fbcbc], eax
je 0x440a88
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
call ebx
test eax, eax
je 0x4409f1
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [0xc51054]
jne 0x4409d4
cmp dword [ebp - 0x28], 0x40a
je 0x4409fe
lea edx, [ebp - 0x2c]
push edx
call edi
lea eax, [ebp - 0x2c]
push eax
call dword [0x4a4384]
push esi
push esi
push esi
lea ecx, [ebp - 0x2c]
push ecx
call ebx
test eax, eax
jne 0x4409c0
cmp dword [ebp - 0x28], 0x40a
jne 0x440ac6
mov eax, dword [0x4fbcbc]
cmp eax, esi
mov dword [0x4bd850], esi
je 0x440a29
push 0xffffffffffffffff
push eax
call dword [0x4a416c]
mov edx, dword [0x4fbcbc]
push edx
call dword [0x4a4290]
mov dword [0x4fbcbc], esi
xor eax, eax
mov dword [0x4fbcc4], eax
jmp 0x440988
call fcn.00431b30
test eax, eax
jne 0x440a6b
cmp dword [0xc51054], esi
je 0x440a50
call fcn.00413ef0
call fcn.00414310
mov al, byte [0xc50e54]
test al, al
je 0x440a68
push 0x30
push esi
push 0xc50e54
push esi
call dword [0x4a4400]
mov dword [ebp + 0x14], esi
cmp dword [0x4fbcb8], esi
je 0x440a98
mov eax, 1
mov dword [0x4fbcc4], eax
mov dword [0x4fbcb8], esi
jmp 0x440988
mov eax, dword [0x4fbcc8]
push eax
push esi
call dword [0x4a41c4]
mov dword [ebp + 0x14], esi
mov edx, dword [0xc51054]
push edx
call dword [0x4a4368]
test eax, eax
je 0x440ab5
mov eax, dword [0xc51054]
push eax
call dword [0x4a4494]
call fcn.00413150
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x4fbcbc]
cmp eax, esi
je 0x440aba
push 0xffffffffffffffff
push eax
call dword [0x4a416c]
mov ecx, dword [0x4fbcbc]
push ecx
call dword [0x4a4290]
mov eax, dword [ebp + 0x14]
pop edi
mov dword [0x4fbcbc], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10