Function at 0x4f4c27
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push ebp
sub esp, 0x38
push 0x1d4
mov eax, 0x5db472
call fcn.005234b0
mov esi, ecx
mov edi, dword [ebp + 0x44]
xor ebx, ebx
cmp byte [0x721f30], bl
mov dword [ebp + 0x38], ebx
je 0x4f4eb7
mov al, byte [edi + 2]
cmp al, 0x5a
jae 0x4f4eb7
cmp al, 0x1b
je 0x4f4eb7
cmp al, 0x47
je 0x4f4eb7
push ebx
mov edi, 0x69dd8c
push edi
lea ecx, [ebp]
call fcn.004ac9bc
mov dword [ebp - 4], ebx
push ebx
push edi
lea ecx, [ebp - 0x78]
call fcn.004ac9bc
mov byte [ebp - 4], 1
push ebx
push edi
lea ecx, [ebp - 0x174]
call fcn.004ac9bc
mov byte [ebp - 4], 2
push ebx
push edi
lea ecx, [ebp - 0x12c]
call fcn.004ac9bc
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0xe4]
call fcn.004ac9bc
mov byte [ebp - 4], 4
push ebx
push edi
lea ecx, [ebp - 0x54]
call fcn.004ac9bc
mov byte [ebp - 4], 5
push ebx
push 0x67eb74
lea ecx, [ebp - 0x9c]
call fcn.004ac9bc
mov byte [ebp - 4], 6
push ebx
push str._To
lea ecx, [ebp - 0x150]
call fcn.004ac9bc
mov byte [ebp - 4], 7
push ebx
push str._From
lea ecx, [ebp - 0xc0]
call fcn.004ac9bc
mov byte [ebp - 4], 8
push ebx
push str._CT.Send.
lea ecx, [ebp - 0x108]
call fcn.004ac9bc
mov byte [ebp - 4], 9
push dword [esi + 0x21c]
mov edi, dword [ebp + 0x44]
push dword [esi + 0x2c]
movzx eax, word [edi + 4]
push ebx
push eax
lea ecx, [ebp - 0x30]
call fcn.004ac6f7
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 0xa
push ebx
push dword [esi + 0x220]
lea ecx, [ebp - 0x1bc]
call fcn.004ac7aa
mov dword [ebp + 0x2c], eax
mov byte [ebp - 4], 0xb
push ebx
push dword [0x722278]
lea ecx, [ebp - 0x1e0]
call fcn.004ac6f7
mov dword [ebp + 0x24], eax
mov byte [ebp - 4], 0xc
movzx eax, byte [edi + 2]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004e325f
mov byte [ebp - 4], 0xd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x34], esp
lea edx, [ebp]
push edx
lea edx, [ebp - 0x78]
push edx
lea edx, [ebp - 0x174]
push edx
lea edx, [ebp - 0x12c]
push edx
lea edx, [ebp - 0xe4]
push edx
lea edx, [ebp - 0x54]
push edx
push dword [ebp + 0x28]
lea edx, [ebp - 0x9c]
push edx
push dword [ebp + 0x2c]
lea edx, [ebp - 0x150]
push edx
push dword [ebp + 0x24]
lea edx, [ebp - 0xc0]
push edx
push eax
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.004add2f
add esp, 0x3c
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xd
mov ecx, 0x721f30
call fcn.004cc5c3
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x198]
call fcn.004ac66a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1e0]
call fcn.004ac66a
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1bc]
call fcn.004ac66a
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x30]
call fcn.004ac66a
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x108]
call fcn.004ac66a
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc0]
call fcn.004ac66a
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x150]
call fcn.004ac66a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
call fcn.004ac66a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x54]
call fcn.004ac66a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe4]
call fcn.004ac66a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12c]
call fcn.004ac66a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x174]
call fcn.004ac66a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x78]
call fcn.004ac66a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.004ac66a
mov eax, dword [esi + 0x21c]
mov eax, dword [eax + 0x158]
cmp eax, 9
jne 0x4f4ecf
xor eax, eax
jmp 0x4f54c1
cmp dword [ebp + 0x50], ebx
jne 0x4f4ef8
cmp eax, 5
jne 0x4f4ef1
mov al, byte [0x7222b0]
neg al
sbb eax, eax
and eax, 0xffff7748
add eax, 0x9c40
mov dword [ebp + 0x50], eax
jmp 0x4f4ef8
mov dword [ebp + 0x50], 0x4e20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [ebp + 0x50]
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x44], eax
lea eax, [esi + 0xc]
push eax
call fcn.00411742
mov dword [ebp - 4], 0xf
jmp 0x4f4f45
cmp byte [esi + 0x21], bl
jne 0x4f4f91
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp + 0x44]
jae 0x4f4f91
lea ecx, [ebp + 0x30]
call fcn.004067c9
push 0x4e20
mov ecx, esi
call fcn.004d4fd9
lea ecx, [ebp + 0x30]
call fcn.0040dfd3
cmp byte [esi + 0x274], bl
jne 0x4f4f19
jmp 0x4f4f91
cmp byte [esi + 0x21], bl
jne 0x4f4f99
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp + 0x44]
jae 0x4f4f99
lea ecx, [ebp + 0x30]
call fcn.004067c9
jmp 0x4f4f81
cmp byte [esi + 0x21], bl
jne 0x4f4f89
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp + 0x44]
jae 0x4f4f89
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x275], bl
jne 0x4f4f69
lea ecx, [ebp + 0x30]
call fcn.0040dfd3
cmp byte [esi + 0x275], bl
jne 0x4f4f4f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp + 0x44]
jb 0x4f4fea
push ebx
push str.CT.Send.Timeout_
lea ecx, [ebp]
call fcn.004ac9bc
mov byte [ebp - 4], 0x10
lea eax, [ebp]
push eax
lea ecx, [esi + 0x29c]
call fcn.004acaa2
mov byte [ebp - 4], 0xf
lea ecx, [ebp]
call fcn.004ac66a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x34], bl
je 0x4f4fe2
mov ecx, dword [ebp + 0x30]
call fcn.0040df8b
xor eax, eax
inc eax
jmp 0x4f54c1
cmp byte [esi + 0x21], bl
jne 0x4f5480
cmp byte [esi + 0x274], bl
jne 0x4f5480
mov byte [esi + 0x275], 1
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x34], bl
je 0x4f5017
mov ecx, dword [ebp + 0x30]
call fcn.0040df8b
mov eax, dword [esi + 0x1c]
cmp eax, 0x11
je 0x4f5367
cmp eax, 0x12
je 0x4f5367
cmp eax, 6
je 0x4f52f0
cmp eax, 7
je 0x4f52f0
mov ecx, esi
call fcn.004d68ec
test al, al
jne 0x4f52b2
push 2
pop eax
cmp dword [ebp + 0x58], eax
mov dword [ebp + 0x44], ebx
je 0x4f506c
cmp dword [ebp + 0x58], ebx
jne 0x4f5076
mov ecx, dword [esi + 0x21c]
cmp dword [ecx + 0x158], 7
jne 0x4f5076
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x44], 3
movzx ecx, word [edi + 4]
mov eax, dword [edi + 0xc]
add ecx, eax
mov eax, dword [ebp + 0x44]
lea eax, [ecx + eax + 5]
push eax
call fcn.004fed14
cmp eax, ebx
pop ecx
mov dword [ebp + 0x2c], eax
jne 0x4f50c8
push ebx
sub esp, 0x24
mov ecx, esp
mov dword [ebp + 0x4c], esp
push ebx
push str.GWT.Send.NoBuf
mov byte [esi + 0x275], bl
call fcn.004ac9bc
mov dword [ebp - 4], 0x13
or dword [ebp - 4], 0xffffffff
mov ecx, 0x721f30
call fcn.00430cd8
jmp 0x4f54be
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x2c]
push 2
add eax, ecx
push 0x67e9dc
push eax
mov dword [ebp + 0x38], eax
call fcn.005229e0
lea eax, [edi + 2]
push 1
push eax
mov eax, dword [ebp + 0x38]
add eax, 2
push eax
call fcn.005229e0
mov ax, word [edi + 4]
mov ecx, dword [ebp + 0x38]
add esp, 0x18
mov word [ecx + 3], ax
cmp word [edi + 4], bx
jbe 0x4f5152
mov eax, ecx
movzx ecx, word [edi + 4]
push ecx
push dword [edi + 8]
add eax, 5
push eax
mov dword [ebp + 0x24], eax
call fcn.005229e0
add esp, 0xc
cmp dword [esi + 0x1c], 1
jne 0x4f5130
mov al, byte [edi + 2]
cmp al, 0x5a
je 0x4f5152
cmp al, 0x62
je 0x4f5152
mov al, byte [edi + 2]
cmp al, 0x5c
je 0x4f5152
cmp al, 0x63
je 0x4f5152
cmp al, 0x47
je 0x4f5152
cmp al, 0x2e
je 0x4f5152
movzx eax, word [edi + 4]
push eax
push dword [ebp + 0x24]
call fcn.004c112f
pop ecx
pop ecx
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jle 0x4f5175
mov eax, dword [edi + 0x10]
push ecx
mov ecx, dword [ebp + 0x44]
push eax
movzx eax, word [edi + 4]
add eax, dword [ebp + 0x2c]
lea eax, [eax + ecx + 5]
push eax
call fcn.005229e0
add esp, 0xc
cmp byte [edi + 2], 0xd
jne 0x4f517f
mov byte [ebp + 0x48], 1
movzx ecx, word [edi + 4]
mov eax, dword [edi + 0xc]
mov edx, dword [ebp + 0x44]
add ecx, eax
cmp eax, ebx
lea ecx, [ecx + edx + 5]
mov dword [ebp + 0x44], ecx
jle 0x4f519d
mov ecx, edi
call fcn.004e3244
lea eax, [ebp + 0x30]
push eax
mov ecx, esi
call fcn.0043b98f
mov dword [ebp - 4], 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp + 0x58], 2
mov dword [ebp + 0x28], eax
je 0x4f5255
mov eax, dword [esi + 0x1c]
cmp eax, 1
je 0x4f51f3
cmp eax, 2
je 0x4f51f3
mov eax, dword [ebp + 0x30]
cmp eax, ebx
je 0x4f51f3
mov eax, dword [eax + 0x54]
cmp eax, dword [ebp + 0x28]
jbe 0x4f51f3
sub eax, dword [ebp + 0x28]
lea ecx, [eax - 4]
cmp ecx, 0x1383
ja 0x4f51f3
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x54]
mov ecx, dword [esi + 0x21c]
push dword [ebp + 0x50]
push dword [ebp + 0x48]
push ebx
push dword [ebp + 0x44]
push dword [ebp + 0x2c]
call fcn.004efde6
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x30]
cmp eax, ebx
je 0x4f523b
mov ecx, dword [eax + 0x50]
cmp ecx, ebx
jle 0x4f523b
mov eax, dword [ebp + 0x44]
cmp eax, 0x1f40
jle 0x4f523b
imul eax, eax, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp + 0x30]
add eax, dword [ebp + 0x28]
mov dword [ecx + 0x54], eax
push dword [ebp + 0x2c]
call fcn.0051d89c
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
call fcn.00448c99
jmp 0x4f5390
sub esp, 0x24
lea eax, [esi + 0x278]
mov ecx, esp
mov dword [ebp + 0x58], esp
push eax
call fcn.004ac698
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x14
mov ecx, 0x721f18
call fcn.004bee9c
push dword [ebp + 0x60]
mov cx, word [esi + 0x2c]
push dword [ebp + 0x5c]
add cx, ax
mov eax, dword [ebp + 0x2c]
push dword [ebp + 0x44]
mov word [eax], cx
mov ecx, dword [esi + 0x21c]
push eax
call fcn.004ea67e
cmp byte [edi + 2], 0x47
mov dword [ebp + 0x38], eax
jne 0x4f5211
mov dword [ebp + 0x38], ebx
jmp 0x4f5211
cmp byte [edi + 2], 0x5a
mov byte [ebp + 0x4c], bl
jne 0x4f53d2
movzx eax, word [edi + 4]
cmp ax, bx
jbe 0x4f53d2
push dword [ebp + 0x54]
mov ecx, dword [esi + 0x21c]
push dword [ebp + 0x50]
movzx eax, ax
push dword [ebp + 0x48]
push ebx
push eax
push dword [edi + 8]
call fcn.004efde6
mov dword [ebp + 0x38], eax
jmp 0x4f5390
cmp byte [edi + 2], 0x5a
jne 0x4f53d2
movzx eax, word [edi + 4]
cmp ax, bx
jbe 0x4f53d2
mov ecx, dword [esi + 0x2dc]
cmp ecx, 0xc
jae 0x4f5346
push 0xc
pop eax
push 1
sub eax, ecx
mov ecx, dword [esi + 0xb4]
push 1
push eax
push dword [edi + 8]
mov dword [ebp + 0x4c], eax
call fcn.004d2356
movzx eax, word [edi + 4]
cmp eax, dword [ebp + 0x4c]
jbe 0x4f535b
sub eax, dword [ebp + 0x4c]
push ebx
push 1
push eax
mov eax, dword [edi + 8]
add eax, dword [ebp + 0x4c]
push eax
jmp 0x4f5350
push ebx
movzx eax, ax
push 1
push eax
push dword [edi + 8]
mov ecx, dword [esi + 0xb4]
call fcn.004d2356
movzx eax, word [edi + 4]
add dword [esi + 0x2dc], eax
jmp 0x4f53d2
push ebx
sub esp, 0x24
mov ecx, esp
mov dword [ebp + 0x58], esp
push ebx
push str.ThreadMode_is_TM_VPNin_or_TM_VPNout
call fcn.004ac9bc
mov dword [ebp - 4], 0x12
or dword [ebp - 4], 0xffffffff
mov ecx, 0x721f30
call fcn.00430cd8
cmp dword [ebp + 0x38], ebx
je 0x4f53d2
cmp byte [ebp + 0x4c], bl
je 0x4f53cc
cmp byte [ebp + 0x48], bl
jne 0x4f53cc
push 0x4e20
mov ecx, esi
call fcn.004d4fd9
test al, al
je 0x4f53cc
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x50]
mov ecx, esi
push ebx
push ebx
push edi
mov byte [esi + 0x275], bl
call fcn.004f4c27
mov dword [ebp + 0x38], eax
jmp 0x4f53d2
mov byte [esi + 0x238], bl
cmp byte [ebp + 0x64], bl
jne 0x4f53dd
mov byte [esi + 0x275], bl
cmp dword [ebp + 0x38], ebx
je 0x4f547b
lea eax, [ebp + 0x30]
push eax
mov ecx, esi
call fcn.0043b98f
mov dword [ebp - 4], 0x16
mov ecx, dword [ebp + 0x30]
cmp ecx, ebx
je 0x4f5408
call fcn.004d27ba
test al, al
jne 0x4f546f
mov ecx, dword [esi + 0x21c]
cmp ecx, ebx
je 0x4f5437
lea eax, [ebp - 0x30]
push eax
call fcn.004f4a8a
mov byte [ebp - 4], 0x17
push eax
lea ecx, [esi + 0x29c]
call fcn.004acaa2
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x30]
call fcn.004ac66a
add esi, 0x29c
cmp dword [esi], ebx
je 0x4f5446
cmp dword [esi + 4], ebx
jne 0x4f546f
push ebx
push str.CT.Send.Failed
lea ecx, [ebp]
call fcn.004ac9bc
mov byte [ebp - 4], 0x18
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004acaa2
mov byte [ebp - 4], 0x16
lea ecx, [ebp]
call fcn.004ac66a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
call fcn.00448c99
mov eax, dword [ebp + 0x38]
jmp 0x4f54c1
push ebx
push str.CT.Send.Destroying
lea ecx, [ebp]
call fcn.004ac9bc
mov byte [ebp - 4], 0x11
lea eax, [ebp]
push eax
lea ecx, [esi + 0x29c]
call fcn.004acaa2
mov byte [ebp - 4], 0xf
lea ecx, [ebp]
call fcn.004ac66a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x34], bl
je 0x4f54be
mov ecx, dword [ebp + 0x30]
call fcn.0040df8b
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x3c
leave
ret 0x24