Function at 0x4414c0
Capabilities:
Check for peb beingdebugged flag
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
xor edx, edx
pushfd
pop eax
xor eax, 0x200000
push eax
popfd
pushfd
pop ebx
cmp eax, ebx
jne 0x4414f1
mov eax, 1
cpuid
and edx, 0x800000
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
xor edi, edi
cmp eax, edi
jne 0x441517
push 0x30
push edi
push str.MMX_technology_suport_required.
push edi
call dword [0x4a13fc]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [0x4a1740]
test al, al
jne 0x44153a
push 0x30
push edi
push str.Pack_is_not_yet.
push edi
call dword [0x4a13fc]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Initialize_Error.
push 0xd09bfc
call dword [0x4a1204]
mov esi, dword [ebp + 8]
mov dword [0x8d26fc], esi
mov dword [0x8c39d0], esi
mov ecx, dword [esi + 0x3c]
add ecx, esi
mov dword [0x8c3adc], ecx
mov eax, dword [ecx + 0x80]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 0xc]
cmp eax, edi
mov dword [ebp - 4], edi
mov dword [ebp + 8], edi
je 0x441620
lea edx, [eax + esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00474180
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
add ebx, eax
mov eax, dword [ecx + 0x10]
mov dword [ebp + 8], ebx
mov ebx, dword [ecx]
add eax, esi
add ebx, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add esp, 8
test eax, eax
je 0x441606
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
mov edx, dword [ecx]
add edi, edx
test eax, 0x80000000
mov dword [ebp - 4], edi
je 0x4415d1
and eax, 0x7fffffff
jmp 0x4415eb
lea edx, [eax + esi + 2]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00474180
add esp, 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebx + 4]
add ebx, 4
add edi, 4
test eax, eax
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], edi
jne 0x4415b6
mov eax, dword [ebp - 0xc]
add eax, 0x14
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x441580
mov ecx, dword [0x8c3adc]
mov dword [0x4ffc24], 1
mov eax, dword [esi + 0x3c]
add eax, esi
xor edi, edi
mov di, word [eax + 6]
xor edx, edx
mov dx, word [eax + 0x14]
xor ebx, ebx
test edi, edi
lea edx, [edx + eax + 0x18]
jbe 0x44165b
mov eax, 0x74786574
cmp dword [edx + 1], eax
je 0x441811
add edx, 0x28
inc ebx
cmp ebx, edi
jb 0x44164a
mov eax, dword [0x8c39d4]
cmp ebx, edi
jne 0x441685
mov eax, dword [ecx + 0x2c]
add eax, dword [0x8c39d0]
mov dword [0x8c39d4], eax
mov ecx, dword [ecx + 0x1c]
mov dword [0x8c35bc], ecx
mov dword [0x4ffc24], 1
mov ecx, dword [0x8c35bc]
lea edx, [ebp - 8]
push edx
push 0x20
push ecx
push eax
mov dword [0x4c2010], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
call dword [0x4a1150]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push ecx
push edx
mov dword [0x4c2014], eax
call fcn.00474180
mov dword [0x8c3ee8], eax
mov eax, dword [ebp + 0x10]
mov cl, byte [eax]
add esp, 8
test cl, cl
je 0x4416ea
push eax
call dword [0x4a13e4]
lea eax, [ebp + 0x10]
push eax
call fcn.004412a0
add esp, 4
test eax, eax
je 0x441889
cmp ebx, edi
jne 0x441700
mov eax, dword [0xd09bf4]
mov ecx, dword [0x8c3ee8]
xor eax, ecx
mov dword [0xd09bf4], eax
lea edx, [ebp - 0xc0]
push edx
mov dword [ebp - 0xc0], 0x94
call dword [0x4a10d0]
xor eax, eax
mov ecx, 0x41
lea edi, [ebp - 0x1c4]
push str.kernel32.dll
rep stosd dword es:[edi], eax
call dword [0x4a115c]
mov edi, dword [0x4a1128]
push str.GetProcAddress
push eax
mov dword [0x8c8c5c], eax
call edi
mov dword [0x8c96c4], eax
mov eax, dword [0x8c8c5c]
push str.IsDebuggerPresent
push eax
call edi
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov al, byte [eax + 2]
and eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x441889
mov eax, dword [ebp - 0xb0]
mov ebx, 1
cmp eax, ebx
jb 0x4417cc
mov eax, dword [ebp - 0xbc]
cmp eax, 4
ja 0x44179b
jne 0x4417cc
mov eax, dword [ebp - 0xb8]
test eax, eax
jbe 0x4417cc
call dword [0x4a114c]
test eax, eax
jne 0x441889
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov eax, dword [edi + 8]
mov dword [ebp - 0x1c4], ecx
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x1c0], edx
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1b8], ecx
cmp dword [ebp - 0xb0], 2
jne 0x4417e4
cmp dword [ebp - 0xbc], 4
mov dword [0xd09bf8], ebx
ja 0x4417ee
mov dword [0xd09bf8], 0
mov dword [0xd0abe8], ebx
call dword [0x4a14e4]
mov dword [ebp - 8], eax
call fcn.00408b40
test eax, eax
jne 0x441829
mov eax, dword [0xd09dfc]
test eax, eax
je 0x44186f
jmp 0x441861
mov eax, dword [edx + 0xc]
add eax, esi
mov dword [0x8c39d4], eax
mov edx, dword [edx + 8]
mov dword [0x8c35bc], edx
jmp 0x441660
mov edi, dword [0x4a1204]
push str.Start_Error.
push 0xd09bfc
call edi
mov edx, dword [ebp + 0x14]
push edx
push esi
call fcn.004409b0
add esp, 8
test eax, eax
jne 0x441894
push str.CreateWindow_Error.
push 0xd09bfc
call edi
mov eax, dword [0xd09dfc]
test eax, eax
je 0x44186f
push ebx
call fcn.00414270
add esp, 4
call fcn.00414780
mov al, byte [0xd09bfc]
test al, al
je 0x441889
push 0x30
push 0
push 0xd09bfc
push 0
call dword [0x4a13fc]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0xd09dfc]
push 0
push 0
push 0x7e8
push eax
call dword [0x4a13e0]
mov edx, dword [ebp - 0xc]
xor eax, eax
test edx, edx
mov bl, 0xcc
jbe 0x4418c7
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + eax], bl
jne 0x4418c2
inc dword [0x8c3eec]
inc eax
cmp eax, edx
jb 0x4418b7
call fcn.00409620
test eax, eax
jne 0x441930
mov eax, dword [0xd09dfc]
test eax, eax
je 0x4418e8
push 1
call fcn.00414270
add esp, 4
call fcn.00414780
mov al, byte [0xd09bfc]
test al, al
je 0x441902
push 0x30
push 0
push 0xd09bfc
push 0
call dword [0x4a13fc]
mov ecx, dword [0xd09dfc]
push ecx
call dword [0x4a13dc]
test eax, eax
je 0x441920
mov edx, dword [0xd09dfc]
push edx
call dword [0x4a1498]
call fcn.00413370
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x4eb920
push 0xd09bfc
call edi
mov eax, dword [0x4c2010]
test eax, eax
mov dword [ebp + 0x14], 1
je 0x441955
cmp dword [ebp + 8], eax
jne 0x441af7
xor eax, eax
cmp byte [ebp + eax - 0x1c4], bl
je 0x441968
inc eax
cmp eax, 0xd
jb 0x441957
jmp 0x4419bb
call fcn.0044ea0b
mov edi, eax
and edi, 0x800003ff
jns 0x44197f
dec edi
or edi, 0xfffffc00
inc edi
inc edi
shl edi, 0xa
mov dword [ebp + 8], 0x100
push edi
push 0
call dword [0x4a1194]
xor esi, esi
test edi, edi
mov ebx, eax
jbe 0x4419b6
call fcn.0044ea0b
and eax, 0x800000ff
jns 0x4419ae
dec eax
or eax, 0xffffff00
inc eax
mov byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44199b
dec dword [ebp + 8]
jne 0x44198a
xor esi, esi
call dword [0x4a14e4]
sub eax, dword [ebp - 8]
cmp eax, 0xea60
ja 0x441af7
mov ebx, dword [0x4a1488]
mov edi, dword [0x4a138c]
mov eax, dword [0x4ffc34]
cmp eax, esi
je 0x441a8f
push 0x4ffc30
push esi
push esi
push 0x4413d0
push esi
push esi
call fcn.0044f2cb
add esp, 0x18
cmp eax, esi
mov dword [0x4ffc2c], eax
je 0x441ae7
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
call ebx
test eax, eax
je 0x441a4b
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [0xd09dfc]
jne 0x441a2e
cmp dword [ebp - 0x28], 0x40a
je 0x441a58
lea edx, [ebp - 0x2c]
push edx
call edi
lea eax, [ebp - 0x2c]
push eax
call dword [0x4a1388]
push esi
push esi
push esi
lea ecx, [ebp - 0x2c]
push ecx
call ebx
test eax, eax
jne 0x441a1a
cmp dword [ebp - 0x28], 0x40a
jne 0x441b25
mov eax, dword [0x4ffc2c]
cmp eax, esi
mov dword [0x4ba878], esi
je 0x441a83
push 0xffffffffffffffff
push eax
call dword [0x4a117c]
mov edx, dword [0x4ffc2c]
push edx
call dword [0x4a1290]
mov dword [0x4ffc2c], esi
xor eax, eax
mov dword [0x4ffc34], eax
jmp 0x4419e2
call fcn.00432710
test eax, eax
jne 0x441aca
cmp dword [0xd09dfc], esi
je 0x441aaf
push 1
call fcn.00414270
add esp, 4
call fcn.00414780
mov al, byte [0xd09bfc]
test al, al
je 0x441ac7
push 0x30
push esi
push 0xd09bfc
push esi
call dword [0x4a13fc]
mov dword [ebp + 0x14], esi
cmp dword [0x4ffc28], esi
je 0x441af7
mov eax, 1
mov dword [0x4ffc34], eax
mov dword [0x4ffc28], esi
jmp 0x4419e2
mov eax, dword [0x4ffc38]
push eax
push esi
call dword [0x4a11d0]
mov dword [ebp + 0x14], esi
mov edx, dword [0xd09dfc]
push edx
call dword [0x4a13dc]
test eax, eax
je 0x441b14
mov eax, dword [0xd09dfc]
push eax
call dword [0x4a1498]
call fcn.00413370
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x4ffc2c]
cmp eax, esi
je 0x441b19
push 0xffffffffffffffff
push eax
call dword [0x4a117c]
mov ecx, dword [0x4ffc2c]
push ecx
call dword [0x4a1290]
mov eax, dword [ebp + 0x14]
pop edi
mov dword [0x4ffc2c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10