Function at 0x4dd54e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
sub esp, 0x38
push 0x1d4
mov eax, 0x5bd333
call fcn.00518b46
mov esi, ecx
mov edi, dword [ebp + 0x44]
xor ebx, ebx
cmp byte [0x6ed748], bl
mov dword [ebp + 0x38], ebx
je 0x4dd7de
mov al, byte [edi + 2]
cmp al, 0x5a
jae 0x4dd7de
cmp al, 0x1b
je 0x4dd7de
cmp al, 0x47
je 0x4dd7de
push ebx
mov edi, 0x67c6e4
push edi
lea ecx, [ebp]
call fcn.0049eefc
mov dword [ebp - 4], ebx
push ebx
push edi
lea ecx, [ebp - 0x78]
call fcn.0049eefc
mov byte [ebp - 4], 1
push ebx
push edi
lea ecx, [ebp - 0x174]
call fcn.0049eefc
mov byte [ebp - 4], 2
push ebx
push edi
lea ecx, [ebp - 0x12c]
call fcn.0049eefc
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0xe4]
call fcn.0049eefc
mov byte [ebp - 4], 4
push ebx
push edi
lea ecx, [ebp - 0x54]
call fcn.0049eefc
mov byte [ebp - 4], 5
push ebx
push 0x65aa3c
lea ecx, [ebp - 0x9c]
call fcn.0049eefc
mov byte [ebp - 4], 6
push ebx
push str._To
lea ecx, [ebp - 0x150]
call fcn.0049eefc
mov byte [ebp - 4], 7
push ebx
push str._From
lea ecx, [ebp - 0xc0]
call fcn.0049eefc
mov byte [ebp - 4], 8
push ebx
push str._CT.Send.
lea ecx, [ebp - 0x108]
call fcn.0049eefc
mov byte [ebp - 4], 9
push dword [esi + 0x21c]
mov edi, dword [ebp + 0x44]
push dword [esi + 0x2c]
movzx eax, word [edi + 4]
push ebx
push eax
lea ecx, [ebp - 0x30]
call fcn.0049ec37
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 0xa
push ebx
push dword [esi + 0x220]
lea ecx, [ebp - 0x1bc]
call fcn.0049ecea
mov dword [ebp + 0x2c], eax
mov byte [ebp - 4], 0xb
push ebx
push dword [0x6eda90]
lea ecx, [ebp - 0x1e0]
call fcn.0049ec37
mov dword [ebp + 0x24], eax
mov byte [ebp - 4], 0xc
movzx eax, byte [edi + 2]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004d3352
mov byte [ebp - 4], 0xd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x34], esp
lea edx, [ebp]
push edx
lea edx, [ebp - 0x78]
push edx
lea edx, [ebp - 0x174]
push edx
lea edx, [ebp - 0x12c]
push edx
lea edx, [ebp - 0xe4]
push edx
lea edx, [ebp - 0x54]
push edx
push dword [ebp + 0x28]
lea edx, [ebp - 0x9c]
push edx
push dword [ebp + 0x2c]
lea edx, [ebp - 0x150]
push edx
push dword [ebp + 0x24]
lea edx, [ebp - 0xc0]
push edx
push eax
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.004a01de
add esp, 0x3c
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xd
mov ecx, 0x6ed748
call fcn.004c25fd
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x198]
call fcn.0049ebaa
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1e0]
call fcn.0049ebaa
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1bc]
call fcn.0049ebaa
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x30]
call fcn.0049ebaa
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x108]
call fcn.0049ebaa
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc0]
call fcn.0049ebaa
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x150]
call fcn.0049ebaa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
call fcn.0049ebaa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x54]
call fcn.0049ebaa
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe4]
call fcn.0049ebaa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12c]
call fcn.0049ebaa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x174]
call fcn.0049ebaa
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x78]
call fcn.0049ebaa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0049ebaa
mov eax, dword [esi + 0x21c]
mov eax, dword [eax + 0x158]
cmp eax, 9
jne 0x4dd7f6
xor eax, eax
jmp 0x4ddde8
cmp dword [ebp + 0x50], ebx
jne 0x4dd81f
cmp eax, 5
jne 0x4dd818
mov al, byte [0x6edac8]
neg al
sbb eax, eax
and eax, 0xffff7748
add eax, 0x9c40
mov dword [ebp + 0x50], eax
jmp 0x4dd81f
mov dword [ebp + 0x50], 0x4e20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [ebp + 0x50]
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x44], eax
lea eax, [esi + 0xc]
push eax
call fcn.00411378
mov dword [ebp - 4], 0xf
jmp 0x4dd86c
cmp byte [esi + 0x21], bl
jne 0x4dd8b8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp + 0x44]
jae 0x4dd8b8
lea ecx, [ebp + 0x30]
call fcn.00406687
push 0x4e20
mov ecx, esi
call fcn.004d51da
lea ecx, [ebp + 0x30]
call fcn.0040dc78
cmp byte [esi + 0x274], bl
jne 0x4dd840
jmp 0x4dd8b8
cmp byte [esi + 0x21], bl
jne 0x4dd8c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp + 0x44]
jae 0x4dd8c0
lea ecx, [ebp + 0x30]
call fcn.00406687
jmp 0x4dd8a8
cmp byte [esi + 0x21], bl
jne 0x4dd8b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp + 0x44]
jae 0x4dd8b0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x275], bl
jne 0x4dd890
lea ecx, [ebp + 0x30]
call fcn.0040dc78
cmp byte [esi + 0x275], bl
jne 0x4dd876
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp + 0x44]
jb 0x4dd911
push ebx
push str.CT.Send.Timeout_
lea ecx, [ebp]
call fcn.0049eefc
mov byte [ebp - 4], 0x10
lea eax, [ebp]
push eax
lea ecx, [esi + 0x29c]
call fcn.0049efe2
mov byte [ebp - 4], 0xf
lea ecx, [ebp]
call fcn.0049ebaa
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x34], bl
je 0x4dd909
mov ecx, dword [ebp + 0x30]
call fcn.0040dc30
xor eax, eax
inc eax
jmp 0x4ddde8
cmp byte [esi + 0x21], bl
jne 0x4ddda7
cmp byte [esi + 0x274], bl
jne 0x4ddda7
mov byte [esi + 0x275], 1
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x34], bl
je 0x4dd93e
mov ecx, dword [ebp + 0x30]
call fcn.0040dc30
mov eax, dword [esi + 0x1c]
cmp eax, 0x11
je 0x4ddc8e
cmp eax, 0x12
je 0x4ddc8e
cmp eax, 6
je 0x4ddc17
cmp eax, 7
je 0x4ddc17
mov ecx, esi
call fcn.004c7b12
test al, al
jne 0x4ddbd9
push 2
pop eax
cmp dword [ebp + 0x58], eax
mov dword [ebp + 0x44], ebx
je 0x4dd993
cmp dword [ebp + 0x58], ebx
jne 0x4dd99d
mov ecx, dword [esi + 0x21c]
cmp dword [ecx + 0x158], 7
jne 0x4dd99d
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x44], 3
movzx ecx, word [edi + 4]
mov eax, dword [edi + 0xc]
add ecx, eax
mov eax, dword [ebp + 0x44]
lea eax, [ecx + eax + 5]
push eax
call fcn.004f3ce5
cmp eax, ebx
pop ecx
mov dword [ebp + 0x2c], eax
jne 0x4dd9ef
push ebx
sub esp, 0x24
mov ecx, esp
mov dword [ebp + 0x4c], esp
push ebx
push str.GWT.Send.NoBuf
mov byte [esi + 0x275], bl
call fcn.0049eefc
mov dword [ebp - 4], 0x13
or dword [ebp - 4], 0xffffffff
mov ecx, 0x6ed748
call fcn.0043008c
jmp 0x4ddde5
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x2c]
push 2
add eax, ecx
push 0x65a8a4
push eax
mov dword [ebp + 0x38], eax
call fcn.005167a0
lea eax, [edi + 2]
push 1
push eax
mov eax, dword [ebp + 0x38]
add eax, 2
push eax
call fcn.005167a0
mov ax, word [edi + 4]
mov ecx, dword [ebp + 0x38]
add esp, 0x18
mov word [ecx + 3], ax
cmp word [edi + 4], bx
jbe 0x4dda79
mov eax, ecx
movzx ecx, word [edi + 4]
push ecx
push dword [edi + 8]
add eax, 5
push eax
mov dword [ebp + 0x24], eax
call fcn.005167a0
add esp, 0xc
cmp dword [esi + 0x1c], 1
jne 0x4dda57
mov al, byte [edi + 2]
cmp al, 0x5a
je 0x4dda79
cmp al, 0x62
je 0x4dda79
mov al, byte [edi + 2]
cmp al, 0x5c
je 0x4dda79
cmp al, 0x63
je 0x4dda79
cmp al, 0x47
je 0x4dda79
cmp al, 0x2e
je 0x4dda79
movzx eax, word [edi + 4]
push eax
push dword [ebp + 0x24]
call fcn.004b29f4
pop ecx
pop ecx
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jle 0x4dda9c
mov eax, dword [edi + 0x10]
push ecx
mov ecx, dword [ebp + 0x44]
push eax
movzx eax, word [edi + 4]
add eax, dword [ebp + 0x2c]
lea eax, [eax + ecx + 5]
push eax
call fcn.005167a0
add esp, 0xc
cmp byte [edi + 2], 0xd
jne 0x4ddaa6
mov byte [ebp + 0x48], 1
movzx ecx, word [edi + 4]
mov eax, dword [edi + 0xc]
mov edx, dword [ebp + 0x44]
add ecx, eax
cmp eax, ebx
lea ecx, [ecx + edx + 5]
mov dword [ebp + 0x44], ecx
jle 0x4ddac4
mov ecx, edi
call fcn.004d3337
lea eax, [ebp + 0x30]
push eax
mov ecx, esi
call fcn.00432ea8
mov dword [ebp - 4], 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp + 0x58], 2
mov dword [ebp + 0x28], eax
je 0x4ddb7c
mov eax, dword [esi + 0x1c]
cmp eax, 1
je 0x4ddb1a
cmp eax, 2
je 0x4ddb1a
mov eax, dword [ebp + 0x30]
cmp eax, ebx
je 0x4ddb1a
mov eax, dword [eax + 0x54]
cmp eax, dword [ebp + 0x28]
jbe 0x4ddb1a
sub eax, dword [ebp + 0x28]
lea ecx, [eax - 4]
cmp ecx, 0x1383
ja 0x4ddb1a
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x54]
mov ecx, dword [esi + 0x21c]
push dword [ebp + 0x50]
push dword [ebp + 0x48]
push ebx
push dword [ebp + 0x44]
push dword [ebp + 0x2c]
call fcn.004e36e3
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x30]
cmp eax, ebx
je 0x4ddb62
mov ecx, dword [eax + 0x50]
cmp ecx, ebx
jle 0x4ddb62
mov eax, dword [ebp + 0x44]
cmp eax, 0x1f40
jle 0x4ddb62
imul eax, eax, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp + 0x30]
add eax, dword [ebp + 0x28]
mov dword [ecx + 0x54], eax
push dword [ebp + 0x2c]
call fcn.00511c38
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
call fcn.004014ae
jmp 0x4ddcb7
sub esp, 0x24
lea eax, [esi + 0x278]
mov ecx, esp
mov dword [ebp + 0x58], esp
push eax
call fcn.0049ebd8
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x14
mov ecx, 0x6ed730
call fcn.004b71a4
push dword [ebp + 0x60]
mov cx, word [esi + 0x2c]
push dword [ebp + 0x5c]
add cx, ax
mov eax, dword [ebp + 0x2c]
push dword [ebp + 0x44]
mov word [eax], cx
mov ecx, dword [esi + 0x21c]
push eax
call fcn.004de148
cmp byte [edi + 2], 0x47
mov dword [ebp + 0x38], eax
jne 0x4ddb38
mov dword [ebp + 0x38], ebx
jmp 0x4ddb38
cmp byte [edi + 2], 0x5a
mov byte [ebp + 0x4c], bl
jne 0x4ddcf9
movzx eax, word [edi + 4]
cmp ax, bx
jbe 0x4ddcf9
push dword [ebp + 0x54]
mov ecx, dword [esi + 0x21c]
push dword [ebp + 0x50]
movzx eax, ax
push dword [ebp + 0x48]
push ebx
push eax
push dword [edi + 8]
call fcn.004e36e3
mov dword [ebp + 0x38], eax
jmp 0x4ddcb7
cmp byte [edi + 2], 0x5a
jne 0x4ddcf9
movzx eax, word [edi + 4]
cmp ax, bx
jbe 0x4ddcf9
mov ecx, dword [esi + 0x2dc]
cmp ecx, 0xc
jae 0x4ddc6d
push 0xc
pop eax
push 1
sub eax, ecx
mov ecx, dword [esi + 0xb4]
push 1
push eax
push dword [edi + 8]
mov dword [ebp + 0x4c], eax
call fcn.004cdac3
movzx eax, word [edi + 4]
cmp eax, dword [ebp + 0x4c]
jbe 0x4ddc82
sub eax, dword [ebp + 0x4c]
push ebx
push 1
push eax
mov eax, dword [edi + 8]
add eax, dword [ebp + 0x4c]
push eax
jmp 0x4ddc77
push ebx
movzx eax, ax
push 1
push eax
push dword [edi + 8]
mov ecx, dword [esi + 0xb4]
call fcn.004cdac3
movzx eax, word [edi + 4]
add dword [esi + 0x2dc], eax
jmp 0x4ddcf9
push ebx
sub esp, 0x24
mov ecx, esp
mov dword [ebp + 0x58], esp
push ebx
push str.ThreadMode_is_TM_VPNin_or_TM_VPNout
call fcn.0049eefc
mov dword [ebp - 4], 0x12
or dword [ebp - 4], 0xffffffff
mov ecx, 0x6ed748
call fcn.0043008c
cmp dword [ebp + 0x38], ebx
je 0x4ddcf9
cmp byte [ebp + 0x4c], bl
je 0x4ddcf3
cmp byte [ebp + 0x48], bl
jne 0x4ddcf3
push 0x4e20
mov ecx, esi
call fcn.004d51da
test al, al
je 0x4ddcf3
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x50]
mov ecx, esi
push ebx
push ebx
push edi
mov byte [esi + 0x275], bl
call fcn.004dd54e
mov dword [ebp + 0x38], eax
jmp 0x4ddcf9
mov byte [esi + 0x238], bl
cmp byte [ebp + 0x64], bl
jne 0x4ddd04
mov byte [esi + 0x275], bl
cmp dword [ebp + 0x38], ebx
je 0x4ddda2
lea eax, [ebp + 0x30]
push eax
mov ecx, esi
call fcn.00432ea8
mov dword [ebp - 4], 0x16
mov ecx, dword [ebp + 0x30]
cmp ecx, ebx
je 0x4ddd2f
call fcn.004cdf27
test al, al
jne 0x4ddd96
mov ecx, dword [esi + 0x21c]
cmp ecx, ebx
je 0x4ddd5e
lea eax, [ebp - 0x30]
push eax
call fcn.004dd2cd
mov byte [ebp - 4], 0x17
push eax
lea ecx, [esi + 0x29c]
call fcn.0049efe2
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x30]
call fcn.0049ebaa
add esi, 0x29c
cmp dword [esi], ebx
je 0x4ddd6d
cmp dword [esi + 4], ebx
jne 0x4ddd96
push ebx
push str.CT.Send.Failed
lea ecx, [ebp]
call fcn.0049eefc
mov byte [ebp - 4], 0x18
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0049efe2
mov byte [ebp - 4], 0x16
lea ecx, [ebp]
call fcn.0049ebaa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
call fcn.004014ae
mov eax, dword [ebp + 0x38]
jmp 0x4ddde8
push ebx
push str.CT.Send.Destroying
lea ecx, [ebp]
call fcn.0049eefc
mov byte [ebp - 4], 0x11
lea eax, [ebp]
push eax
lea ecx, [esi + 0x29c]
call fcn.0049efe2
mov byte [ebp - 4], 0xf
lea ecx, [ebp]
call fcn.0049ebaa
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x34], bl
je 0x4ddde5
mov ecx, dword [ebp + 0x30]
call fcn.0040dc30
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x3c
leave
ret 0x24