Function at 0x10014350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x10094d08
mov eax, dword fs:[0]
push eax
sub esp, 0xac
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
call fcn.100166d0
call fcn.100164c0
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x44], esp
xor ebp, ebp
push ebp
mov ebx, 7
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], ax
call fcn.10013510
mov dword [esp + 0xe4], ebp
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x58], esp
push ebp
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x100], 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push ebp
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], dx
call fcn.10013510
mov byte [esp + 0x11c], 2
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x8c], esp
push 8
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.VMon.exe
mov word [esi + 4], ax
call fcn.10013510
mov byte [esp + 0x138], 3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0xb0], esp
push 8
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.VMon.exe
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x154], 4
or edi, 0xffffffff
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 5
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
mov dword [esi + 0x18], ebx
push ebp
xor eax, eax
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], ax
call fcn.10013510
mov dword [esp + 0xe4], 6
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push 0xd
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Rohitab_Batra
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x100], bl
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push 0xe
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.API_Monitor_v2
mov word [esi + 4], dx
call fcn.10013510
mov byte [esp + 0x11c], 8
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x90], esp
push 0x12
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.apimonitor_x86.exe
mov word [esi + 4], ax
call fcn.10013510
mov byte [esp + 0x138], 9
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0xb4], esp
push 0x12
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.apimonitor_x86.exe
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x154], 0xa
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0xb
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push ebp
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], ax
call fcn.10013510
mov dword [esp + 0xe4], 0xc
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push 0xd
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Rohitab_Batra
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x100], 0xd
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push 0xe
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.API_Monitor_v2
mov word [esi + 4], dx
call fcn.10013510
mov byte [esp + 0x11c], 0xe
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x90], esp
push 0x12
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.apimonitor_x64.exe
mov word [esi + 4], ax
call fcn.10013510
mov byte [esp + 0x138], 0xf
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0xb4], esp
push 0x12
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.apimonitor_x64.exe
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x154], 0x10
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x11
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push ebp
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], ax
call fcn.10013510
mov dword [esp + 0xe4], 0x12
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push ebp
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x100], 0x13
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push 0x12
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.PE_Dropper_Monitor
mov word [esi + 4], dx
call fcn.10013510
mov byte [esp + 0x11c], 0x14
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x90], esp
push ebx
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.PDM.exe
mov word [esi + 4], ax
call fcn.10013510
mov byte [esp + 0x138], 0x15
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0xb4], esp
push ebx
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.PDM.exe
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x154], 0x16
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x17
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push ebp
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], ax
call fcn.10013510
mov dword [esp + 0xe4], 0x18
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push 6
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.360.cn
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x100], 0x19
sub esp, 0x1c
mov esi, esp
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
mov dword [esp + 0x6c], esp
mov word [esi + 4], dx
push 0x10
push str.Malware_Defender
call fcn.10013510
mov byte [esp + 0x11c], 0x1a
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x90], esp
push 0x13
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.MalwareDefender.exe
mov word [esi + 4], ax
call fcn.10013510
mov byte [esp + 0x138], 0x1b
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0xb4], esp
push 0x13
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.MalwareDefender.exe
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x154], 0x1c
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x1d
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push ebp
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], ax
call fcn.10013510
mov dword [esp + 0xe4], 0x1e
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push 0xc
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Sysinternals
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x100], 0x1f
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push 0xf
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Process_Monitor
mov word [esi + 4], dx
call fcn.10013510
mov byte [esp + 0x11c], 0x20
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x90], esp
mov dword [esi + 0x18], ebx
push 0xb
xor eax, eax
mov dword [esi + 0x14], ebp
push str.Procmon.exe
mov word [esi + 4], ax
call fcn.10013510
mov byte [esp + 0x138], 0x21
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0xb4], esp
push 0xd
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Procmon64.exe
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x154], 0x22
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x23
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push ebp
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x1009edfc
mov word [esi + 4], ax
call fcn.10013510
mov dword [esp + 0xe4], 0x24
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push 0x15
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Microsoft_Corporation
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x100], 0x25
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push 0xf
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Process_Monitor
mov word [esi + 4], dx
call fcn.10013510
mov byte [esp + 0x11c], 0x26
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x90], esp
push 0xb
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Procmon.exe
mov word [esi + 4], ax
call fcn.10013510
mov byte [esp + 0x138], 0x27
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0xb4], esp
push 0xb
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.Procmon.exe
mov word [esi + 4], cx
call fcn.10013510
mov byte [esp + 0x154], 0x28
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x29
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x2a
sub esp, 0x1c
mov edx, str.Microsoft_Corporation
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x2b
sub esp, 0x1c
mov edx, str.TCP_UDP_endpoint_viewer
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x2c
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x2d
sub esp, 0x1c
mov edx, str.Tcpview.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x2e
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x2f
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov eax, esi
push eax
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x30
sub esp, 0x1c
mov dword [esp + 0x54], esp
mov edx, 0x1009edfc
mov eax, esp
call fcn.10013330
mov byte [esp + 0x100], 0x31
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x32
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x33
sub esp, 0x1c
mov edx, str.pedolls.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x34
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x35
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov ecx, esi
push ecx
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x36
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x37
sub esp, 0x1c
mov edx, str.Pin_Executable
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x38
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x39
sub esp, 0x1c
mov edx, str.pin.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x3a
push ebp
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x3b
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x3c
sub esp, 0x1c
mov edx, str.Nir_Sofer
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x3d
sub esp, 0x1c
mov edx, str.HTTPNetworkSniffer
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x3e
sub esp, 0x1c
mov edx, str.HTTPNetworkSniffer.exe
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x3f
sub esp, 0x1c
mov edx, str.HTTPNetworkSniffer.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x40
push 1
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x41
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov eax, esi
push eax
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x42
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x43
sub esp, 0x1c
mov edx, 0x1009f114
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x44
sub esp, 0x1c
mov edx, str.SnifferView.exe
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x45
sub esp, 0x1c
mov dword [esp + 0xb4], esp
mov edx, str.SnifferView.exe
mov eax, esp
call fcn.10013330
mov byte [esp + 0x154], 0x46
push 1
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x47
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov ecx, esi
push ecx
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x48
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x49
sub esp, 0x1c
mov edx, str.NetAnalyzer
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x4a
sub esp, 0x1c
mov edx, str.NetAnalyzer.exe
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x4b
sub esp, 0x1c
mov edx, str.NetAnalyzer.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x4c
push 1
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x4d
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x4e
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x4f
sub esp, 0x1c
mov edx, str.sniffx
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x50
sub esp, 0x1c
mov edx, str.sniffx.exe
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x51
sub esp, 0x1c
mov edx, str.sniffx.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x52
push 1
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x53
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov eax, esi
push eax
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x54
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x55
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x56
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x57
sub esp, 0x1c
mov edx, str.WinDump.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x58
push 1
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x59
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov ecx, esi
push ecx
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x5a
sub esp, 0x1c
mov edx, str.Microsoft_Corporation
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x5b
sub esp, 0x1c
mov edx, str.Microsoft_Network_Monitor
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x5c
sub esp, 0x1c
mov edx, str.netmon.exe
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x5d
sub esp, 0x1c
mov edx, str.netmon.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x5e
push 1
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x5f
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov edx, esi
push edx
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x60
sub esp, 0x1c
mov edx, str.Wireshark_Foundation
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x61
sub esp, 0x1c
mov edx, str.Wireshark
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x62
sub esp, 0x1c
mov edx, str.Wireshark.exe
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x63
sub esp, 0x1c
mov edx, str.Wireshark.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x64
push 1
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x65
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov eax, esi
push eax
call fcn.10015360
sub esp, 0x1c
mov edx, 0x1009edfc
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.10013330
mov dword [esp + 0xe4], 0x66
sub esp, 0x1c
mov edx, str.TELERIK_AD
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.10013330
mov byte [esp + 0x100], 0x67
sub esp, 0x1c
mov edx, str.Fiddler
mov eax, esp
mov dword [esp + 0x6c], esp
call fcn.10013330
mov byte [esp + 0x11c], 0x68
sub esp, 0x1c
mov edx, str.Fiddler.exe
mov eax, esp
mov dword [esp + 0x90], esp
call fcn.10013330
mov byte [esp + 0x138], 0x69
sub esp, 0x1c
mov edx, str.Fiddler.exe
mov eax, esp
mov dword [esp + 0xb4], esp
call fcn.10013330
mov byte [esp + 0x154], 0x6a
push 1
mov dword [esp + 0x158], edi
lea esi, [esp + 0xbc]
call fcn.10014150
mov dword [esp + 0xc8], 0x6b
push eax
call fcn.10016410
mov dword [esp + 0xc8], edi
mov ecx, esi
push ecx
call fcn.10015360
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb8
ret