Function at 0x4085c0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Create thread
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x4400df
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x44e2d0]
xor eax, esp
mov dword [esp + 0x19c], eax
push ebx
push ebp
push edi
mov eax, dword [0x44e2d0]
xor eax, esp
push eax
lea eax, [esp + 0x1b0]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 8]
mov dword [esi], vtable.XFQuery::CCommunication_class_XFQuery::QQDiskBinPacket_.0
push eax
mov dword [esp + 0x1c], esi
mov dword [esi + 4], vtable.fund::lock::critical_section.0
call ebp
xor ebx, ebx
mov dword [esp + 0x1b8], ebx
call fcn.00421dd0
mov dword [esi + 0x24], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x24]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x24]
mov dword [eax], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 8], eax
mov dword [esi + 0x28], ebx
mov byte [esp + 0x1b8], 1
call fcn.00421dd0
mov dword [esi + 0x30], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x30]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x30]
mov dword [eax], eax
mov eax, dword [esi + 0x30]
mov dword [eax + 8], eax
mov dword [esi + 0x34], ebx
mov byte [esp + 0x1b8], 2
call fcn.00421dd0
mov dword [esi + 0x3c], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x3c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3c]
mov dword [eax], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov dword [esi + 0x40], ebx
mov dword [esi + 0x350], ebx
mov byte [esi + 0x354], bl
mov dword [esi + 0x35c], ebx
mov dword [esi + 0x360], ebx
mov dword [esi + 0x364], ebx
mov dword [esi + 0x36c], ebx
mov dword [esi + 0x370], ebx
mov dword [esi + 0x374], ebx
mov dword [esi + 0x37c], ebx
mov dword [esi + 0x380], ebx
mov dword [esi + 0x384], ebx
lea ecx, [esi + 0x38c]
push ecx
mov dword [esi + method.fund::lock::critical_section.virtual_0], vtable.fund::lock::critical_section.0
call ebp
mov byte [esp + 0x1b8], 7
call fcn.0040a9b0
mov dword [esi + 0x3a8], eax
mov byte [eax + 0x21], 1
mov eax, dword [esi + 0x3a8]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3a8]
mov dword [eax], eax
mov eax, dword [esi + 0x3a8]
mov dword [eax + 8], eax
mov dword [esi + 0x3ac], ebx
mov byte [esp + 0x1b8], 8
mov dword [esi + 0x3b0], edi
mov edi, dword [edi + 0x10]
add edi, 2
lea edx, [esi + 0x3b4]
push edx
call fcn.00409500
lea edi, [esi + 0x3cc]
mov byte [esi + 0x3c8], bl
mov eax, 0x40ad20
mov dword [edi], vtable.._AV__Thread_U__BindMember0_V__CCommunication_VQQDiskBinPacket_XFQuery___XFQuery__P812_AEXPAX_Z_fund___fund__.0
mov dword [edi + 4], ebx
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], eax
mov byte [edi + 0x18], 1
mov dword [esi + 0x3e8], ebx
lea eax, [esi + 0x400]
mov dword [esi + 0x3f0], ebx
mov dword [esi + 0x3f4], ebx
mov dword [esi + 0x3f8], ebx
push eax
mov dword [esi + 0x3fc], 0x446b58
call ebp
lea ecx, [esp + 0x1c]
push ecx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea edx, [esp + 0x14]
push edx
push ebx
lea eax, [edi + 8]
push eax
push 0x405600
mov dword [esi + 0x44], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x24c], ebx
push ebx
push ebx
mov byte [edi + 0x18], bl
mov dword [eax], edi
mov dword [edi + 0xc], ebx
call fcn.0042901e
add esp, 0x18
cmp eax, 0xffffffff
mov dword [edi + 4], eax
jne 0x4087d8
mov dword [edi + 4], ebx
cmp dword [edi + 4], ebx
mov eax, esi
jne 0x4087e3
mov byte [edi + 0x18], 1
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0042877c
add esp, 0x1ac
ret