Function at 0x402058
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x12c]
mov dword [0x406018], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [0x4063a8]
test eax, eax
movzx ecx, word [ebp - 0x124]
cmovne edx, ecx
mov dword [ebp - 0x13c], 0
xor eax, eax
mov word [0x4063a8], dx
mov dword [ebp - 0x134], eax
xor ebx, ebx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x114], str.debug
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], 0x64
mov dword [ebp - 0x104], str.help
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], 0x68
mov dword [ebp - 0xf4], str.udid
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], 0x75
mov dword [ebp - 0xe4], str.network
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], 0x6e
mov dword [ebp - 0xd4], 0x404cb0
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], 0x78
mov dword [ebp - 0xc4], str.trigger
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], 0x74
mov dword [ebp - 0xb4], str.untrigger
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], 0x54
mov dword [ebp - 0xa4], str.match
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0x6d
mov dword [ebp - 0x94], str.process
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0x70
mov dword [ebp - 0x84], str.exclude
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], 0x65
mov dword [ebp - 0x74], str.quiet
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 0x71
mov dword [ebp - 0x64], str.kernel
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0x6b
mov dword [ebp - 0x54], str.no_kernel
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0x4b
mov dword [ebp - 0x44], str.quiet_list
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], str.no_colors
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
movaps xmm0, xmmword [0x404f50]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
push 0x401bd0
push 2
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], str.version
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call esi
push 0x401bd0
push 0xf
call esi
push ebx
lea eax, [ebp - 0x114]
push eax
push str.dhu:nxt:T:m:e:p:qkKv
push edi
push dword [ebp + 8]
call dword [sym.imp.getopt.dll_getopt_long_a]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, eax
add esp, 0x24
cmp ecx, 0xffffffff
je 0x40221a
mov edx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
lea eax, [ecx - 1]
cmp eax, 0x77
ja case.0x401e88.3
movzx eax, byte [eax + 0x4025ac]
jmp dword [eax*4 + 0x40256c]
push 1
call dword [sym.imp.imobiledevice.dll_idevice_set_debug_level]
add esp, 4
jmp 0x402062
mov eax, dword [sym.imp.getopt.dll_optarg_a]
mov eax, dword [eax]
cmp byte [eax], 0
je 0x4020a5
push dword [0x4063d8]
call esi
mov eax, dword [sym.imp.getopt.dll_optarg_a]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 8
mov dword [0x4063d8], eax
jmp 0x402062
mov dword [0x4063cc], 1
jmp 0x402062
inc dword [ebp - 0x130]
mov ecx, str.CircleJoinRequestedCommCenterHeuristicInterpreterMobileMailPowerUIAgentProtectedCloudKeySyncingSpringBoardUserEventAgentWirelessRadioManagerdaccessorydaccountsdaggregatedanalyticsdappstoredapsdassetsdassistant_servicebackboarddbiometrickitdbluetoothdcalaccessdcallservicesdclouddcom.apple.Safari.SafeBrowsing.ServicecontextstoredcorecapturedcoreduetdcorespeechdcdpddasddataaccessddistnoteddprivacydduetexpertdfindmydevicedfmfdfmflocatordgpsdhealthdhomedidentityservicesdimagentitunescloudditunesstoredkernellocationdmaildmDNSRespondermediaremotedmediaserverdmobileassetdnanoregistrydnanotimekitcompaniondnavdnsurlsessiondpassdpastedphotoanalysisdpowerdpowerlogHelperdptpdrapportdreminddroutinedrunningboarddsearchdsharingdsuggestdsymptomsdtimedthermalmonitorduseractivitydvmdwifidwirelessproxd
call fcn.00401070
jmp 0x402062
cmp ecx, 0x70
jne 0x401f02
inc dword [ebp - 0x134]
jmp 0x401f0d
cmp ecx, 0x65
jne 0x401f0d
inc dword [ebp - 0x130]
mov eax, dword [sym.imp.getopt.dll_optarg_a]
mov ecx, dword [eax]
cmp byte [ecx], 0
je 0x40210d
call fcn.00401070
jmp 0x402062
mov eax, dword [sym.imp.getopt.dll_optarg_a]
mov eax, dword [eax]
cmp byte [eax], 0
je 0x402135
mov eax, dword [0x40638c]
lea eax, [eax*4 + 4]
push eax
push dword [0x4063a4]
call edx
add esp, 8
test eax, eax
je 0x402114
mov dword [0x4063a4], eax
mov eax, dword [sym.imp.getopt.dll_optarg_a]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edx, dword [0x40638c]
add esp, 4
mov ecx, dword [0x4063a4]
mov dword [ecx + edx*4], eax
inc edx
mov dword [0x40638c], edx
jmp 0x402062
mov eax, dword [sym.imp.getopt.dll_optarg_a]
mov eax, dword [eax]
cmp byte [eax], 0
je 0x40213f
mov eax, dword [0x406394]
lea eax, [eax*4 + 4]
push eax
push dword [0x406390]
call edx
add esp, 8
test eax, eax
je 0x402114
mov dword [0x406390], eax
mov eax, dword [sym.imp.getopt.dll_optarg_a]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edx, dword [0x406394]
add esp, 4
mov ecx, dword [0x406390]
mov dword [ecx + edx*4], eax
inc edx
mov dword [0x406394], edx
jmp 0x402062
mov eax, dword [sym.imp.getopt.dll_optarg_a]
mov eax, dword [eax]
cmp byte [eax], 0
je 0x402149
mov eax, dword [0x4063dc]
lea eax, [eax*4 + 4]
push eax
push dword [0x4063b8]
call edx
add esp, 8
test eax, eax
je 0x402114
mov dword [0x4063b8], eax
mov eax, dword [sym.imp.getopt.dll_optarg_a]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edx, dword [0x4063dc]
add esp, 4
mov ecx, dword [0x4063b8]
mov dword [ecx + edx*4], eax
inc edx
mov dword [0x4063dc], edx
jmp 0x402062
inc dword [ebp - 0x138]
jmp 0x402062
inc ebx
jmp 0x402062
mov dword [0x4063c4], 1
jmp 0x402062
mov dword [ebp - 0x13c], 1
push 0
lea eax, [ebp - 0x114]
push eax
push str.dhu:nxt:T:m:e:p:qkKv
push edi
push dword [ebp + 8]
call dword [sym.imp.getopt.dll_getopt_long_a]
mov ecx, eax
add esp, 0x14
cmp ecx, 0xffffffff
jne 0x401e6f
mov ecx, dword [ebp - 0x138]
test ecx, ecx
jle 0x402153
test ebx, ebx
jle 0x402153
push str.ERROR:__k_and__K_cannot_be_used_together._n
jmp 0x4020aa
push str.ERROR:_UDID_must_not_be_empty__n
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push eax
call fcn.00401010
push 0x2f
push dword [edi]
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 0x10
test eax, eax
je 0x4020d3
lea edi, [eax + 1]
jmp 0x4020d5
mov edi, dword [edi]
push 2
call esi
push edi
push str.Usage:__s__OPTIONS__n
push eax
call fcn.00401010
push 2
call esi
push str._nRelay_syslog_of_a_connected_device._n_nOPTIONS:_n___u____udid_UDID__target_specific_device_by_UDID_n___n____network____connect_to_network_device_n___x____exit_______exit_when_device_disconnects_n___h____help_______prints_usage_information_n___d____debug______enable_communication_debugging_n___v____version____prints_version_information_n___no_colors_______disable_colored_output_n_nFILTER_OPTIONS:_n___m____match_STRING______only_print_messages_that_contain_STRING_n___t____trigger_STRING____start_logging_when_matching_STRING_n___T____untrigger_STRING__stop_logging_when_matching_STRING_n___p____process_PROCESS___only_print_messages_from_matching_process_es__n___e____exclude_PROCESS___print_all_messages_except_matching_process_es__n__________________________PROCESS_is_a_process_name_or_multiple_process_names_n__________________________separated_by___._n___q____quiet_____________set_a_filter_to_exclude_common_noisy_processes_n____quiet_list____________prints_the_list_of_processes_for___quiet_and_exits_n___k____kernel____________only_print_kernel_messages_n___K____no_kernel_________suppress_kernel_messages_n_nFor_filter_examples_consult_idevicesyslog_1__man_page._n_nHomepage:_____https:__github.com_libimobiledevice_win32_libimobiledevice_vs___nBug_Reports:__https:__github.com_libimobiledevice_win32_libimobiledevice_vs___n
push eax
call fcn.00401010
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402624
mov esp, ebp
pop ebp
ret
push str.ERROR:_filter_string_must_not_be_empty__n
jmp 0x4020aa
push str.ERROR:_realloc___failed_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push str.ERROR:_message_filter_string_must_not_be_empty__n
jmp 0x4020aa
push str.ERROR:_trigger_filter_string_must_not_be_empty__n
jmp 0x4020aa
push str.ERROR:_untrigger_filter_string_must_not_be_empty__n
jmp 0x4020aa
mov eax, dword [ebp - 0x134]
test eax, eax
mov eax, dword [ebp - 0x130]
jle 0x402183
test eax, eax
jle 0x402171
push str.ERROR:__p_and__e__q_cannot_be_used_together._n
jmp 0x4020aa
test ebx, ebx
jle 0x4022e0
push str.ERROR:__p_and__K_cannot_be_used_together._n
jmp 0x4020aa
test eax, eax
jle 0x4022e0
mov dword [0x4063c8], 1
test ecx, ecx
je 0x40220c
xor edi, edi
cmp dword [0x4063bc], edi
jle 0x40221a
mov ebx, dword [0x4063b0]
nop dword [eax]
mov eax, dword [ebx + edi*4]
mov ecx, str.kernel
mov dword [ebp - 0x134], eax
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4021e0
test dl, dl
je 0x4021dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4021e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4021c0
xor eax, eax
jmp 0x4021e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402201
push dword [ebp - 0x134]
call esi
mov ebx, dword [0x4063b0]
add esp, 4
mov dword [ebx + edi*4], 0
inc edi
cmp edi, dword [0x4063bc]
jl 0x4021b0
jmp 0x40221a
test ebx, ebx
je 0x40221a
mov ecx, str.kernel
call fcn.00401070
cmp dword [0x4063dc], 0
mov edi, 1
jle 0x40223c
mov eax, dword [0x406384]
cmp dword [0x406394], 0
cmove eax, edi
mov dword [0x406384], eax
cmp dword [ebp - 0x13c], 0
jne 0x402260
push 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll__isatty
mov ecx, dword [0x406388]
add esp, 4
test eax, eax
cmovne ecx, edi
mov dword [0x406388], ecx
lea eax, [ebp - 0x144]
mov dword [ebp - 0x144], 0
push eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0
push eax
call dword [sym.imp.imobiledevice.dll_idevice_get_device_list_extended]
push dword [ebp - 0x140]
call dword [sym.imp.imobiledevice.dll_idevice_device_list_extended_free]
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 0xc
cmp dword [ebp - 0x144], 0
jne 0x4023d2
mov eax, dword [0x4063d8]
test eax, eax
jne 0x4023bc
push str.No_device_found._Plug_in_a_device_or_pass_UDID_with__u_to_wait_for_device_to_be_available._n
push 2
call ebx
add esp, 4
push eax
call fcn.00401010
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402624
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x402210
test ebx, ebx
je 0x40221a
mov dword [0x4063c8], 1
jmp 0x402210
push 0x2f
push dword [edi]
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 8
test eax, eax
je 0x402315
lea edi, [eax + 1]
jmp 0x402317
mov edi, dword [edi]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 1
call esi
push edi
push str.Usage:__s__OPTIONS__n
push eax
call fcn.00401010
push 1
call esi
push str._nRelay_syslog_of_a_connected_device._n_nOPTIONS:_n___u____udid_UDID__target_specific_device_by_UDID_n___n____network____connect_to_network_device_n___x____exit_______exit_when_device_disconnects_n___h____help_______prints_usage_information_n___d____debug______enable_communication_debugging_n___v____version____prints_version_information_n___no_colors_______disable_colored_output_n_nFILTER_OPTIONS:_n___m____match_STRING______only_print_messages_that_contain_STRING_n___t____trigger_STRING____start_logging_when_matching_STRING_n___T____untrigger_STRING__stop_logging_when_matching_STRING_n___p____process_PROCESS___only_print_messages_from_matching_process_es__n___e____exclude_PROCESS___print_all_messages_except_matching_process_es__n__________________________PROCESS_is_a_process_name_or_multiple_process_names_n__________________________separated_by___._n___q____quiet_____________set_a_filter_to_exclude_common_noisy_processes_n____quiet_list____________prints_the_list_of_processes_for___quiet_and_exits_n___k____kernel____________only_print_kernel_messages_n___K____no_kernel_________suppress_kernel_messages_n_nFor_filter_examples_consult_idevicesyslog_1__man_page._n_nHomepage:_____https:__github.com_libimobiledevice_win32_libimobiledevice_vs___nBug_Reports:__https:__github.com_libimobiledevice_win32_libimobiledevice_vs___n
push eax
call fcn.00401010
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402624
mov esp, ebp
pop ebp
ret
push str.CircleJoinRequestedCommCenterHeuristicInterpreterMobileMailPowerUIAgentProtectedCloudKeySyncingSpringBoardUserEventAgentWirelessRadioManagerdaccessorydaccountsdaggregatedanalyticsdappstoredapsdassetsdassistant_servicebackboarddbiometrickitdbluetoothdcalaccessdcallservicesdclouddcom.apple.Safari.SafeBrowsing.ServicecontextstoredcorecapturedcoreduetdcorespeechdcdpddasddataaccessddistnoteddprivacydduetexpertdfindmydevicedfmfdfmflocatordgpsdhealthdhomedidentityservicesdimagentitunescloudditunesstoredkernellocationdmaildmDNSRespondermediaremotedmediaserverdmobileassetdnanoregistrydnanotimekitcompaniondnavdnsurlsessiondpassdpastedphotoanalysisdpowerdpowerlogHelperdptpdrapportdreminddroutinedrunningboarddsearchdsharingdsuggestdsymptomsdtimedthermalmonitorduseractivitydvmdwifidwirelessproxd
push 0x404198
call fcn.00401040
jmp 0x402555
push str.1.0.0
push str.idevicesyslog
push str._s__s_n
call fcn.00401040
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402624
mov esp, ebp
pop ebp
ret
push 0x2f
push dword [edi]
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 8
test eax, eax
je 0x4023af
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea edi, [eax + 1]
jmp 0x4020d5
mov edi, dword [edi]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
jmp 0x4020d5
push eax
push str.Waiting_for_device_with_UDID__s_to_become_available..._n
push 2
call ebx
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push 0x400
mov dword [0x4063b4], 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0
push 0x401a50
mov dword [0x4063c0], eax
call dword [sym.imp.imobiledevice.dll_idevice_event_subscribe]
add esp, 0xc
cmp dword [0x4063ac], 0
jne 0x402420
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
push 0x3e8
call edi
cmp dword [0x4063ac], 0
je 0x402410
call dword [sym.imp.imobiledevice.dll_idevice_event_unsubscribe]
push 1
call ebx
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [0x4063d0]
add esp, 8
test eax, eax
je 0x402451
push eax
call dword [sym.imp.imobiledevice.dll_syslog_relay_client_free]
add esp, 4
mov dword [0x4063d0], 0
mov eax, dword [0x40639c]
test eax, eax
je 0x40246e
push eax
call dword [sym.imp.imobiledevice.dll_idevice_free]
add esp, 4
mov dword [0x40639c], 0
mov eax, dword [0x4063bc]
test eax, eax
jle 0x4024a1
xor edi, edi
test eax, eax
jle 0x402496
nop dword [eax]
mov eax, dword [0x4063b0]
push dword [eax + edi*4]
call esi
inc edi
add esp, 4
cmp edi, dword [0x4063bc]
jl 0x402480
push dword [0x4063b0]
call esi
add esp, 4
cmp dword [0x4063a0], 0
jle 0x4024b5
push dword [0x4063d4]
call esi
add esp, 4
mov eax, dword [0x40638c]
test eax, eax
jle 0x4024e5
xor edi, edi
test eax, eax
jle 0x4024da
mov eax, dword [0x4063a4]
push dword [eax + edi*4]
call esi
inc edi
add esp, 4
cmp edi, dword [0x40638c]
jl 0x4024c4
push dword [0x4063a4]
call esi
add esp, 4
mov eax, dword [0x406394]
test eax, eax
jle 0x402515
xor edi, edi
test eax, eax
jle 0x40250a
mov eax, dword [0x406390]
push dword [eax + edi*4]
call esi
inc edi
add esp, 4
cmp edi, dword [0x406394]
jl 0x4024f4
push dword [0x406390]
call esi
add esp, 4
mov eax, dword [0x4063dc]
test eax, eax
jle 0x402545
xor edi, edi
test eax, eax
jle 0x40253a
mov eax, dword [0x4063b8]
push dword [eax + edi*4]
call esi
inc edi
add esp, 4
cmp edi, dword [0x4063dc]
jl 0x402524
push dword [0x4063b8]
call esi
add esp, 4
push dword [0x4063c0]
call esi
push dword [0x4063d8]
call esi
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00402624
mov esp, ebp
pop ebp
ret