Function at 0x443790
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x495788
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov al, byte [esp + 2]
push ebx
mov ebx, ecx
mov byte [esp + 0x18], al
push ebp
xor edx, edx
xor eax, eax
xor ecx, ecx
push esi
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
lea esi, [ebx + 0x30]
lea edi, [esp + 0x24]
cmp edi, esi
mov dword [esp + 0x5c], ecx
je 0x4438d9
mov edi, dword [esi + 4]
test edi, edi
je 0x4437ed
mov eax, dword [esi + 8]
sub eax, edi
jne 0x443841
mov eax, dword [esi + 8]
push 0
push eax
push edi
call fcn.00443db0
mov ecx, dword [esp + 0x38]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0041b380
mov eax, dword [esi + 4]
test eax, eax
jne 0x443828
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
xor esi, esi
lea eax, [esi + edx]
mov dword [esp + 0x2c], eax
jmp 0x4438d9
mov esi, dword [esi + 8]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
sub esi, eax
lea eax, [esi + edx]
mov dword [esp + 0x2c], eax
jmp 0x4438d9
test eax, eax
push 0
ja 0x44387e
push edi
push edi
call fcn.00443db0
mov edx, dword [esp + 0x38]
mov eax, dword [esi + 8]
add esp, 0xc
lea ecx, [esp + 0x24]
push edx
push eax
push edi
call fcn.0041b390
mov eax, dword [esi + 4]
test eax, eax
jne 0x443828
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
xor esi, esi
lea eax, [esi + edx]
mov dword [esp + 0x2c], eax
jmp 0x4438d9
push 0
lea ecx, [esp + 0x2c]
call fcn.0041b380
mov eax, dword [esp + 0x28]
push eax
call fcn.0049038d
mov ecx, dword [esi + 4]
add esp, 4
test ecx, ecx
jne 0x4438a1
xor eax, eax
jmp 0x4438a6
mov eax, dword [esi + 8]
sub eax, ecx
test eax, eax
jge 0x4438ac
xor eax, eax
push eax
call fcn.004903ec
mov ecx, dword [esi + 8]
mov esi, dword [esi + 4]
add esp, 4
mov dword [esp + 0x28], eax
push eax
push ecx
push esi
lea ecx, [esp + 0x30]
call fcn.0041b390
mov edx, dword [esp + 0x28]
mov ecx, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov ebp, dword [ebx + 0x58]
mov ebx, dword [ebx + 0x54]
mov esi, ebp
sub ecx, eax
sub esi, ebx
mov dword [esp + 0x14], ebp
cmp ecx, esi
mov edi, eax
jae 0x4439ad
test edx, edx
je 0x4438ff
mov ecx, eax
sub ecx, edx
cmp esi, ecx
jb 0x443901
mov ecx, esi
test edx, edx
jne 0x443909
xor eax, eax
jmp 0x44390b
sub eax, edx
add eax, ecx
test eax, eax
mov dword [esp + 0x1c], eax
jge 0x443917
xor eax, eax
push eax
call fcn.004903ec
mov ecx, dword [esp + 0x2c]
add esp, 4
mov ebp, eax
push ebp
push edi
push ecx
lea ecx, [esp + 0x30]
call fcn.0041b390
mov edx, dword [esp + 0x14]
push eax
push edx
push ebx
lea ecx, [esp + 0x30]
call fcn.0041b390
push eax
mov eax, dword [esp + 0x30]
push eax
push edi
lea ecx, [esp + 0x30]
call fcn.0041b390
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0x2c]
call fcn.0041b380
mov eax, dword [esp + 0x28]
push eax
call fcn.0049038d
mov ecx, dword [esp + 0x20]
add esp, 4
lea edx, [ecx + ebp]
mov ecx, dword [esp + 0x28]
test ecx, ecx
mov dword [esp + 0x30], edx
jne 0x443997
xor eax, eax
mov edx, ebp
mov eax, ebp
mov dword [esp + 0x28], edx
add eax, esi
mov dword [esp + 0x2c], eax
jmp 0x443a04
mov eax, dword [esp + 0x2c]
mov edx, ebp
sub eax, ecx
mov dword [esp + 0x28], edx
add eax, ebp
add eax, esi
mov dword [esp + 0x2c], eax
jmp 0x443a04
test esi, esi
jbe 0x443a04
lea ecx, [eax + esi]
push ecx
push eax
push eax
lea ecx, [esp + 0x30]
call fcn.0041b390
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
push eax
sub eax, edi
add eax, ebx
push ebp
push eax
call fcn.0041b390
mov edx, dword [esp + 0x2c]
push edi
sub edx, edi
add edx, ebx
push edx
jmp 0x4439ed
push ebx
call fcn.00443db0
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
add esp, 0xc
add eax, esi
mov dword [esp + 0x2c], eax
test edx, edx
jne 0x443a0c
xor eax, eax
jmp 0x443a0e
sub eax, edx
mov ebp, dword [esp + 0x20]
push eax
lea esi, [ebp + 0xc]
mov ecx, esi
call fcn.004210ba
mov cl, byte [esp + 0x12]
xor ebx, ebx
mov dword [esp + 0x18], eax
mov byte [esp + 0x34], cl
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
cmp eax, ebx
mov byte [esp + 0x5c], 1
mov byte [esp + 0x12], bl
jbe 0x443a54
lea edx, [esp + 0x12]
lea ecx, [esp + 0x34]
push edx
push eax
push ebx
call fcn.00413a75
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
jne 0x443a60
xor eax, eax
jmp 0x443a66
mov eax, dword [esp + 0x2c]
sub eax, ecx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x3c]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041f7c6
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
cmp eax, ebx
mov byte [esp + 0x12], 0
jne 0x443a8e
xor esi, esi
jmp 0x443a92
mov esi, edx
sub esi, eax
mov ecx, dword [esp + 0x18]
cmp esi, ecx
jae 0x443aba
cmp eax, ebx
jne 0x443aa2
xor esi, esi
jmp 0x443aa6
mov esi, edx
sub esi, eax
lea eax, [esp + 0x12]
sub ecx, esi
push eax
push ecx
push edx
lea ecx, [esp + 0x40]
call fcn.00413a75
jmp 0x443ad3
cmp eax, ebx
je 0x443adb
mov esi, edx
sub esi, eax
cmp ecx, esi
jae 0x443adb
add eax, ecx
push edx
push eax
lea ecx, [esp + 0x3c]
call fcn.00413beb
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov esi, dword [ebp + 0x44]
cmp esi, ebx
jne 0x443ae6
xor ecx, ecx
jmp 0x443aeb
mov ecx, dword [ebp + 0x48]
sub ecx, esi
cmp eax, ebx
jne 0x443af3
xor edx, edx
jmp 0x443af5
sub edx, eax
lea esi, [ebp + 0x60]
lea ecx, [edx + ecx + 0xc]
mov word [esi], cx
mov ecx, esi
call fcn.0041b8a9
mov eax, dword [ebp + 0x44]
mov byte [esp + 0x14], 0xfe
cmp eax, ebx
jne 0x443b16
xor ecx, ecx
jmp 0x443b1b
mov ecx, dword [ebp + 0x48]
sub ecx, eax
mov edx, dword [esp + 0x38]
cmp edx, ebx
jne 0x443b27
xor eax, eax
jmp 0x443b2d
mov eax, dword [esp + 0x3c]
sub eax, edx
lea edx, [esp + 0x13]
lea edi, [eax + ecx + 0xf]
push edx
lea ecx, [esp + 0x48]
mov word [esp + 0x19], di
call fcn.00412c62
movsx ecx, di
lea eax, [esp + 0x12]
mov byte [esp + 0x5c], 2
push eax
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1a], 0
call fcn.00412d13
mov edx, dword [esp + 0x48]
mov ax, word [esp + 0x14]
mov cl, byte [esp + 0x16]
mov word [edx], ax
mov byte [edx + 2], cl
mov edx, dword [esp + 0x48]
mov eax, dword [esi]
add edx, 3
mov dword [edx], eax
mov ecx, dword [esi + 4]
mov dword [edx + 4], ecx
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 0x44]
cmp eax, ebx
jne 0x443b95
xor ecx, ecx
jmp 0x443b9a
mov ecx, dword [ebp + 0x48]
sub ecx, eax
mov edx, dword [esp + 0x48]
mov esi, dword [ebp + 0x44]
mov eax, ecx
lea edi, [edx + 0xf]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x38]
cmp esi, ebx
jne 0x443bbe
xor ecx, ecx
jmp 0x443bc4
mov ecx, dword [esp + 0x3c]
sub ecx, esi
mov edx, dword [ebp + 0x44]
cmp edx, ebx
jne 0x443bcf
xor eax, eax
jmp 0x443bd4
mov eax, dword [ebp + 0x48]
sub eax, edx
mov edx, dword [esp + 0x48]
lea edi, [eax + edx + 0xf]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x1388
div ecx
mov ecx, ebp
add edx, 0x2710
push edx
call fcn.00443c80
push eax
mov ecx, ebp
call fcn.0044ab30
test al, al
je 0x443c3f
mov ecx, dword [esp + 0x48]
cmp ecx, ebx
jne 0x443c1f
xor eax, eax
jmp 0x443c25
mov eax, dword [esp + 0x4c]
sub eax, ecx
mov dx, word [ebp + 0x2c]
push eax
mov eax, dword [ebp + 0x28]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.0044ac30
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x44]
mov byte [esp + 0x5c], 1
call fcn.00414afd
lea ecx, [esp + 0x34]
mov byte [esp + 0x5c], 0
call fcn.00414afd
lea ecx, [esp + 0x24]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00414afd
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret