Function at 0x479bc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0
push esi
push edi
test eax, eax
je 0x479bff
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm0
test ebx, ebx
je 0x479f6a
mov edi, dword [ebp + 0x10]
test edi, edi
jns 0x479c39
cmp dword [0x68a968], 0
jne 0x479c34
push str.readip_pcap
push edi
push str.WARNING:_Negative_timeout_value___lu__passed_to__s______using_0
mov dword [0x68a968], 1
call fcn.00431e00
add esp, 0xc
xor edi, edi
mov dword [ebp + 0x10], edi
push ebx
call dword [sym.imp.wpcap.dll_pcap_datalink]
add esp, 4
mov dword [ebp - 0x18], eax
test eax, eax
js 0x479f79
cmp eax, 0xe2
ja case.0x479c60.2
movzx eax, byte [eax + 0x479fc8]
jmp dword [eax*4 + 0x479fa4]
mov esi, 0xe
jmp 0x479c9a
mov esi, 0x16
jmp 0x479c9a
mov esi, 4
jmp 0x479c9a
xor esi, esi
jmp 0x479c9a
mov esi, 0x15
jmp 0x479c9a
mov esi, 0xc
jmp 0x479c9a
mov esi, 0x10
jmp 0x479c9a
mov esi, 0x18
test edi, edi
jle 0x479cb0
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004b6680
add esp, 8
lea esp, [esp]
xor edi, edi
call fcn.00403170
test eax, eax
jne 0x479d4d
push eax
push ebx
call dword [sym.imp.wpcap.dll_pcap_getnonblock]
mov edi, dword [sym.imp.MSVCR120.dll__wassert]
add esp, 8
mov dword [ebp - 0x30], eax
test eax, eax
je 0x479ceb
push 0x68e
push str..._tcpip.cc
push str.nonblock__0
call edi
add esp, 0xc
push 0
push 1
push ebx
call dword [sym.imp.wpcap.dll_pcap_setnonblock]
add esp, 0xc
test eax, eax
je 0x479d11
push 0x690
push str..._tcpip.cc
push str.rc__0
call edi
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.wpcap.dll_pcap_next]
push 0
push dword [ebp - 0x30]
mov edi, eax
push ebx
call dword [sym.imp.wpcap.dll_pcap_setnonblock]
add esp, 0x14
test eax, eax
je 0x479d49
push 0x693
push str..._tcpip.cc
push str.rc__0
call dword [sym.imp.MSVCR120.dll__wassert]
add esp, 0xc
test edi, edi
jne 0x479d7a
push dword [ebp + 0x10]
push ebx
call fcn.00403210
add esp, 8
test eax, eax
jne 0x479d66
mov dword [ebp - 0x24], 1
jmp 0x479dd5
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.wpcap.dll_pcap_next]
mov edi, eax
add esp, 8
test edi, edi
je 0x479dd5
cmp dword [ebp - 0xc], esi
jbe 0x479e44
test esi, esi
je 0x479dd1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x479dd1
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov dword [eax + 4], esi
cmp esi, 0x18
jbe 0x479db3
push 0x6a6
push str..._tcpip.cc
push str.offset___MAX_LINK_HEADERSZ
call dword [sym.imp.MSVCR120.dll__wassert]
add esp, 0xc
cmp esi, 0x18
mov ecx, 0x18
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp - 0x20]
add eax, 8
push edi
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
add edi, esi
jne 0x479e11
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x479e44
jle 0x479e03
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004b6680
mov eax, dword [ebp - 0x2c]
add esp, 8
sub eax, dword [ebp - 0x3c]
imul eax, eax, 0xf4240
sub eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0x10]
jge 0x479e44
cmp dword [ebp - 0x24], 0
jne 0x479e44
test edi, edi
je 0x479cb0
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x1c]
sub eax, esi
mov dword [ebx], eax
cmp eax, dword [0x68a964]
jbe 0x479e60
push eax
push dword [0x68a960]
call fcn.004b5420
mov ecx, dword [ebx]
mov esi, eax
add esp, 8
mov dword [0x68a960], esi
mov dword [0x68a964], ecx
jmp 0x479e66
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov esi, dword [0x68a960]
push dword [ebx]
push edi
push esi
call sub.MSVCR120.dll_memcpy
add esp, 0xc
cmp byte [ebp + 0x1c], 0
je 0x479ea5
push ebx
push esi
call fcn.0047b320
add esp, 8
test al, al
jne 0x479e9f
pop edi
pop esi
mov dword [ebx], 0
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov esi, dword [0x68a960]
mov edi, dword [ebp - 0x34]
push 0
test edi, edi
je 0x479eeb
lea eax, [ebp - 0x2c]
push eax
call fcn.004b6680
mov eax, dword [ebp - 0x2c]
mov dword [edi], eax
mov eax, dword [ebp - 0x28]
push edi
mov dword [edi + 4], eax
push dword [ebx]
push dword [0x68a960]
push 2
call fcn.0047ab50
mov eax, dword [0x68a960]
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
push dword [ebx]
push esi
push 2
call fcn.0047ab50
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [0x68a960]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.wpcap.dll_pcap_next]
lea eax, [ebp - 0x14]
push eax
push ebx
call edi
mov ecx, dword [ebp - 0xc]
add esp, 8
mov esi, eax
test ecx, ecx
jne 0x479f40
push 0x7a120
call fcn.004b66f0
lea eax, [ebp - 0x14]
push eax
push ebx
call edi
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov esi, eax
cmp ecx, 0x186a0
ja 0x479f8e
mov al, byte [0x77000186]
inc esi
push ecx
push dword [ebp - 0x18]
push str.FATAL:__Unknown_datalink_type___d_._Caplen:__d__Packet:
call fcn.00431e00
push dword [ebp - 0xc]
push esi
call fcn.00481df0
add esp, 0x14
push 1
call dword [sym.imp.MSVCR120.dll_exit]
push str.readip_pcap
push str.NULL_packet_device_passed_to__s
call fcn.00431e30
push ebx
call dword [sym.imp.wpcap.dll_pcap_geterr]
add esp, 4
push eax
push str.Cannot_obtain_datalink_information:__s
call fcn.00431e30
push dword [ebp - 0x18]
push ecx
push str.readip_pcap
push str.FATAL:__s:_bogus_caplen_from_libpcap___d__on_interface_type__d
call fcn.00431e30
lea ecx, [ecx]
jne 0x479f42
inc edi
add byte [edi - 0x64], ah
inc edi
add byte [esi - 0x64], ch
inc edi
add byte [ebp - 0x7fffb864], dl
pushfd
inc edi
add byte [esp + ebx*4 + 0x47], bh
add byte [edi - 0x71ffb864], al
pushfd
inc edi
add byte [esi], cl
lahf
inc edi
add byte [eax], al
add dword [eax], ecx
or byte [eax], cl
or byte [edx], al
or byte [ebx], al
add eax, dword [eax + ecx]
add eax, 50530312
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ebx], al
add ecx, dword [eax]
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], al
push es
or byte [eax], cl
or byte [edi], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add ecx, esp
int3