Function at 0x4017d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x304
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x300], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 5
je 0x401822
cmp eax, 6
je 0x401822
push str.Vers._4.0.8_n
call fcn.00401010
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.00401a6d
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 4]
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
push 0x100
push ecx
push 0x4147b8
cmp eax, 6
jne 0x4018a1
call esi
push 0x100
push dword [edi + 8]
push 0x414ac8
call esi
mov ecx, dword [edi + 0xc]
add esp, 0x18
mov edx, 0x4148b8
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x401857
push dword [edi + 0x10]
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
call esi
push dword [edi + 0x14]
mov dword [0x4043c0], eax
call esi
add esp, 8
mov dword [0x4045c8], eax
call fcn.00401580
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.00401a6d
mov esp, ebp
pop ebp
ret
call esi
mov ecx, dword [edi + 8]
add esp, 0xc
mov edx, 0x4148b8
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4018b0
mov ecx, dword [edi + 0xc]
mov edx, 0x4043c8
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4018d0
push 0x10
push dword [edi + 0x10]
push 0x414ab8
call esi
lea eax, [esp + 0x214]
push eax
push 0x3e8
push 1
push 0x10000
push 0x4147b8
call dword [sym.imp.wpcap.dll_pcap_open_live]
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x401950
push 0x4147b8
lea eax, [esp + 0x7c]
push str._nUnable_to_open_the_adapter.__s_is_not_supported_by_WinPcap_n
push eax
call fcn.00401050
lea eax, [esp + 0x84]
push eax
call fcn.00401010
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.00401a6d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x40327c]
mov edx, 0x414ab8
movq xmm0, qword [str.udp_and_net]
mov esi, edx
mov dword [esp + 0x18], eax
mov al, byte [0x403280]
movq qword [esp + 0x10], xmm0
mov byte [esp + 0x1c], al
mov al, byte [edx]
inc edx
test al, al
jne 0x401977
lea edi, [esp + 0x10]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401985
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00401090
test eax, eax
js 0x401a56
call fcn.00401170
test eax, eax
js 0x401a56
push ebx
push 0
push 0x401210
mov byte [0x4043c4], 0
mov byte [0x404058], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push 0x64
call edi
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
xor esi, esi
nop dword [eax]
push 0xc8
call edi
inc esi
cmp esi, 4
jle 0x4019f0
push 0
push 0x4043c8
call ebx
add esp, 8
test eax, eax
je 0x4019ea
push 0x3e8
mov byte [0x404058], 1
call edi
xor esi, esi
nop dword [eax]
cmp byte [0x4043c4], 0
push 0x32
jne 0x401a35
call edi
inc esi
cmp esi, 0x1e
jl 0x401a20
jmp 0x401a37
call edi
mov eax, dword [0x4045e4]
test eax, eax
je 0x401a56
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
push dword [0x4045e4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 8
mov ecx, dword [esp + 0x30c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a6d
mov esp, ebp
pop ebp
ret