Function at 0x1001c050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003367c
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x1005c830]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x1005c830]
xor eax, esp
push eax
lea eax, [esp + 0x1b4]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push str.Stop_at_the_fisrt_IP_header
lea ecx, [esp + 0x144]
mov byte [esp + 0x1c0], 1
call dword [0x100350ac]
push 0x10037664
lea ecx, [esp + 0x160]
mov byte [esp + 0x1c0], 2
call dword [0x100350ac]
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x17c]
push ecx
lea edx, [esp + 0x148]
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c8], 3
call fcn.1001bc00
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Parse_until_the_last_IP_header
call dword [0x100350ac]
mov edi, dword [0x100352b4]
lea eax, [esp + 0x38]
push eax
push 5
sub esp, 0x84
mov ecx, esp
mov dword [esp + 0xd4], esp
push str.Protocol_Parsing
mov byte [esp + 0x26c], 4
call edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf4], esp
push str.Determines_the_behavior_with_packets_that_contain_protocol_encapsulations__like_IP_over_IP_or_PPP_over_IP.
mov byte [esp + 0x288], 5
call dword [0x100350ac]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf4], esp
push str.Tunneling_Parsing_Behavior
mov byte [esp + 0x2a4], 6
call dword [0x100350ac]
lea ecx, [esp + 0x118]
mov byte [esp + 0x2a0], 3
call fcn.1001be80
push eax
mov ecx, esi
mov byte [esp + 0x1c0], 7
call fcn.1001cae0
lea ecx, [esp + 0x34]
mov byte [esp + 0x1bc], 3
call fcn.1001c340
push 0x10037744
lea ecx, [esp + 0x17c]
call dword [0x100350ac]
push str.Lossy___Faster
lea ecx, [esp + 0x198]
mov byte [esp + 0x1c0], 8
call dword [0x100350ac]
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x17c]
push edx
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c8], 9
call fcn.1001bc00
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Lossles___Slower
call dword [0x100350ac]
lea ecx, [esp + 0x38]
push ecx
push 5
sub esp, 0x84
mov ecx, esp
mov dword [esp + 0xd8], esp
push str.Probe_Performance
mov byte [esp + 0x26c], 0xa
call edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf0], esp
push str.Sets_the_way_data_collection_for_top_N_views_is_done_in_the_probe_Lossles___Slower_means_that_all_the_data_samples_are_stored_and_trasfered_to_the_Pilot_console._This_guarantees_that_no_sample_is_lost__but_it_also_mean_higher_network_occupation_and_CPU_memory_requirements_in_the_console._Lossy___Faster_means_that_some_samples_containing_small_values_are_not_transfered_to_the_console._This_is_more_efficient__but_could_couse_missing_some_data_points_with_small_values.
mov byte [esp + 0x288], 0xb
call dword [0x100350ac]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x114], esp
push str.Data_Collection_Method
mov byte [esp + 0x2a4], 0xc
call dword [0x100350ac]
lea ecx, [esp + 0x118]
mov byte [esp + 0x2a0], 9
call fcn.1001be80
push eax
mov ecx, esi
mov byte [esp + 0x1c0], 0xd
call fcn.1001cae0
lea ecx, [esp + 0x34]
mov byte [esp + 0x1bc], 9
call fcn.1001c340
mov edx, dword [0x100350a0]
push edx
push 2
push 0x1c
lea eax, [esp + 0x184]
push eax
mov byte [esp + 0x1cc], 3
call fcn.1002d8c2
mov ecx, dword [0x100350a0]
push ecx
push 2
push 0x1c
lea edx, [esp + 0x14c]
push edx
mov byte [esp + 0x1cc], 1
call fcn.1002d8c2
lea ecx, [esp + 0x18]
mov byte [esp + 0x1bc], bl
call fcn.10006cb0
mov eax, esi
mov ecx, dword [esp + 0x1b4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.1002de3b
add esp, 0x1b0
ret