Function at 0x140040980
Capabilities:
Link many functions at runtime
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
movzx eax, byte [0x140055320]
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.NPcapPacket.dll
and eax, 0xfffffff9
or eax, 4
mov byte [0x140055320], al
call rsi
test rax, rax
je 0x140040d70
lea rcx, str.Npcapwpcap.dll
call rsi
mov rbx, rax
test rax, rax
je 0x140040dd0
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.pcap_close
mov rcx, rbx
call rsi
mov qword [sym.null_PCAP_CLOSE], rax
test rax, rax
je 0x140040fe0
lea rdx, str.pcap_datalink
mov rcx, rbx
call rsi
mov qword [0x140055338], rax
test rax, rax
je 0x140041020
lea rdx, str.pcap_dispatch
mov rcx, rbx
call rsi
mov qword [0x140055340], rax
test rax, rax
je 0x140041000
lea rdx, str.pcap_findalldevs
mov rcx, rbx
call rsi
mov qword [0x140055348], rax
test rax, rax
je 0x1400410a0
lea rdx, str.pcap_freealldevs
mov rcx, rbx
call rsi
mov qword [0x140055350], rax
test rax, rax
je 0x140041080
lea rdx, str.pcap_lib_version
mov rcx, rbx
call rsi
mov qword [0x140055360], rax
test rax, rax
je 0x140041060
lea rdx, str.pcap_lookupdev
mov rcx, rbx
call rsi
mov qword [0x140055358], rax
test rax, rax
je 0x140041040
lea rdx, str.pcap_major_version
mov rcx, rbx
call rsi
mov qword [0x140055368], rax
test rax, rax
je 0x1400411a0
lea rdx, str.pcap_minor_version
mov rcx, rbx
call rsi
mov qword [0x140055370], rax
test rax, rax
je 0x140041180
lea rdx, str.pcap_open_live
mov rcx, rbx
call rsi
mov qword [0x140055378], rax
test rax, rax
je 0x140041160
lea rdx, str.pcap_open_offline
mov rcx, rbx
call rsi
mov qword [0x140055380], rax
test rax, rax
je 0x140041140
lea rdx, str.pcap_sendpacket
mov rcx, rbx
call rsi
mov qword [0x140055388], rax
test rax, rax
je 0x140041120
lea rdx, str.pcap_next
mov rcx, rbx
call rsi
mov qword [0x140055390], rax
test rax, rax
je 0x140041100
lea rdx, str.pcap_setdirection
mov rcx, rbx
call rsi
mov qword [0x140055398], rax
test rax, rax
je 0x1400410e0
lea rdx, str.pcap_datalink_val_to_name
mov rcx, rbx
call rsi
mov qword [0x1400553a0], rax
test rax, rax
je 0x1400410c0
lea rdx, str.pcap_perror
mov rcx, rbx
call rsi
mov qword [0x1400553a8], rax
test rax, rax
je 0x140040fa0
lea rdx, str.pcap_geterr
mov rcx, rbx
call rsi
mov qword [0x1400553b0], rax
test rax, rax
je 0x140040f80
movq xmm0, qword [dbg.null_PCAP_DEV_NAME]
lea rax, [dbg.null_PCAP_DEV_DESCRIPTION]
lea rdx, str.pcap_sendqueue_alloc
mov rcx, rbx
movq xmm1, rax
lea rax, [dbg.null_PCAP_DEV_NEXT]
punpcklqdq xmm0, xmm1
mov qword [0x1400553c8], rax
movups xmmword [0x1400553b8], xmm0
call rsi
mov qword [0x1400553d0], rax
test rax, rax
je 0x140040f60
lea rdx, str.pcap_sendqueue_transmit
mov rcx, rbx
call rsi
mov qword [0x1400553d8], rax
test rax, rax
je 0x140040f40
lea rdx, str.pcap_sendqueue_destroy
mov rcx, rbx
call rsi
mov qword [0x1400553e0], rax
test rax, rax
je 0x140040f20
lea rdx, str.pcap_sendqueue_queue
mov rcx, rbx
call rsi
mov qword [0x1400553e8], rax
test rax, rax
je 0x140040f00
lea rdx, str.pcap_create
mov rcx, rbx
call rsi
mov qword [0x1400553f0], rax
test rax, rax
je 0x140040ee0
lea rdx, str.pcap_set_snaplen
mov rcx, rbx
call rsi
mov qword [0x1400553f8], rax
test rax, rax
je 0x140040ec0
lea rdx, str.pcap_set_promisc
mov rcx, rbx
call rsi
mov qword [0x140055400], rax
test rax, rax
je 0x140040ea0
lea rdx, str.pcap_set_timeout
mov rcx, rbx
call rsi
mov qword [0x140055408], rax
test rax, rax
je 0x140040e80
lea rdx, str.pcap_set_immediate_mode
mov rcx, rbx
call rsi
mov qword [0x140055410], rax
test rax, rax
je 0x140040e60
lea rdx, str.pcap_set_buffer_size
mov rcx, rbx
call rsi
mov qword [0x140055418], rax
test rax, rax
je 0x140040e40
lea rdx, str.pcap_set_rfmon
mov rcx, rbx
call rsi
mov qword [0x140055420], rax
test rax, rax
je 0x140040e20
lea rdx, str.pcap_can_set_rfmon
mov rcx, rbx
call rsi
mov qword [0x140055428], rax
test rax, rax
je 0x140040e00
lea rdx, str.pcap_activate
mov rcx, rbx
call rsi
mov qword [0x140055430], rax
test rax, rax
je 0x140040fc0
movzx edx, byte [0x140055320]
mov ecx, edx
mov eax, edx
and ecx, 0xfffffffd
or eax, 2
and edx, 1
cmovne eax, ecx
mov byte [0x140055320], al
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rbx, str.Packet.dll
mov rcx, rbx
call rsi
test rax, rax
jne 0x1400409b3
test byte [0x140055320], 4
je 0x1400409b3
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x7e
je 0x1400411e7
call rsi
mov ecx, 2
mov esi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, esi
mov r8, rbx
lea rdx, str._s:_couldnt_load__d_n
mov rcx, rax
call sym.fprintf_1
jmp 0x140040df5
lea rdi, str.wpcap.dll
mov rcx, rdi
call rsi
mov rbx, rax
test rax, rax
jne 0x1400409c8
test byte [0x140055320], 4
jne 0x1400411ba
mov eax, 0xffffffff
jmp 0x140040d63
lea rax, [sym.null_PCAP_CAN_SET_RFMON]
or byte [0x140055320], 1
mov qword [0x140055428], rax
jmp 0x140040d28
lea rax, [sym.null_PCAP_SET_RFMON]
or byte [0x140055320], 1
mov qword [0x140055420], rax
jmp 0x140040d0c
lea rax, [sym.null_PCAP_SET_BUFFER_SIZE]
or byte [0x140055320], 1
mov qword [0x140055418], rax
jmp 0x140040cf0
lea rax, [sym.null_PCAP_SET_IMMEDIATE_MODE]
or byte [0x140055320], 1
mov qword [0x140055410], rax
jmp 0x140040cd4
lea rax, [sym.null_PCAP_SET_TIMEOUT]
or byte [0x140055320], 1
mov qword [0x140055408], rax
jmp 0x140040cb8
lea rax, [sym.null_PCAP_SET_PROMISC]
or byte [0x140055320], 1
mov qword [0x140055400], rax
jmp 0x140040c9c
lea rax, [sym.null_PCAP_SET_SNAPLEN]
or byte [0x140055320], 1
mov qword [0x1400553f8], rax
jmp 0x140040c80
lea rax, [dbg.null_PCAP_CREATE]
or byte [0x140055320], 1
mov qword [0x1400553f0], rax
jmp 0x140040c64
lea rax, [dbg.null_PCAP_SENDQUEUE_QUEUE]
or byte [0x140055320], 1
mov qword [0x1400553e8], rax
jmp 0x140040c48
lea rax, [dbg.null_PCAP_SENDQUEUE_DESTROY]
or byte [0x140055320], 1
mov qword [0x1400553e0], rax
jmp 0x140040c2c
lea rax, [dbg.null_PCAP_SENDQUEUE_TRANSMIT]
or byte [0x140055320], 1
mov qword [0x1400553d8], rax
jmp 0x140040c10
lea rax, [dbg.null_PCAP_SENDQUEUE_ALLOC]
or byte [0x140055320], 1
mov qword [0x1400553d0], rax
jmp 0x140040bf4
lea rax, [dbg.null_PCAP_GETERR]
or byte [0x140055320], 1
mov qword [0x1400553b0], rax
jmp 0x140040bab
lea rax, [dbg.null_PCAP_PERROR]
or byte [0x140055320], 1
mov qword [0x1400553a8], rax
jmp 0x140040b8f
lea rax, [sym.null_PCAP_ACTIVATE]
or byte [0x140055320], 1
mov qword [0x140055430], rax
jmp 0x140040d44
lea rax, [sym.null_PCAP_CLOSE]
or byte [0x140055320], 1
mov qword [sym.null_PCAP_CLOSE], rax
jmp 0x1400409eb
lea rax, [dbg.null_PCAP_DISPATCH]
or byte [0x140055320], 1
mov qword [0x140055340], rax
jmp 0x140040a23
lea rax, [dbg.null_PCAP_DATALINK]
or byte [0x140055320], 1
mov qword [0x140055338], rax
jmp 0x140040a07
lea rax, [dbg.null_PCAP_LOOKUPDEV]
or byte [0x140055320], 1
mov qword [0x140055358], rax
jmp 0x140040a93
lea rax, [dbg.null_PCAP_LIB_VERSION]
or byte [0x140055320], 1
mov qword [0x140055360], rax
jmp 0x140040a77
lea rax, [sym.null_PCAP_FREEALLDEVS]
or byte [0x140055320], 1
mov qword [0x140055350], rax
jmp 0x140040a5b
lea rax, [dbg.null_PCAP_FINDALLDEVS]
or byte [0x140055320], 1
mov qword [0x140055348], rax
jmp 0x140040a3f
lea rax, [dbg.null_PCAP_DATALINK_VAL_TO_NAME]
or byte [0x140055320], 1
mov qword [0x1400553a0], rax
jmp 0x140040b73
lea rax, [dbg.null_PCAP_SETDIRECTION]
or byte [0x140055320], 1
mov qword [0x140055398], rax
jmp 0x140040b57
lea rax, [sym.null_PCAP_NEXT]
or byte [0x140055320], 1
mov qword [0x140055390], rax
jmp 0x140040b3b
lea rax, [dbg.null_PCAP_SENDPACKET]
or byte [0x140055320], 1
mov qword [0x140055388], rax
jmp 0x140040b1f
lea rax, [sym.null_PCAP_OPEN_OFFLINE]
or byte [0x140055320], 1
mov qword [0x140055380], rax
jmp 0x140040b03
lea rax, [dbg.null_PCAP_OPEN_LIVE]
or byte [0x140055320], 1
mov qword [0x140055378], rax
jmp 0x140040ae7
lea rax, [sym.null_PCAP_MINOR_VERSION]
or byte [0x140055320], 1
mov qword [0x140055370], rax
jmp 0x140040acb
lea rax, [sym.null_PCAP_MAJOR_VERSION]
or byte [0x140055320], 1
mov qword [0x140055368], rax
jmp 0x140040aaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
mov r8, rdi
lea rdx, str._s:_couldnt_load__d_n
mov rcx, rax
call sym.fprintf_1
jmp 0x140040df5
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov r8, rbx
lea rdx, str._s:_not_found_n
mov rcx, rax
call sym.fprintf_1
mov ecx, 2
call rsi
mov r8d, 0x31
mov edx, 1
lea rcx, str.__HINT:_you_must_install_either_WinPcap_or_Npcap_n
mov r9, rax
call sym.fwrite
jmp 0x140040df5