Function at 0x401220
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4061d9
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x40a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push 0x4072fc
lea ecx, [ebp - 0xac]
movq qword [ebp - 0x1c], xmm0
call fcn.00403b70
push str.x32dbg
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0
call fcn.00403b70
push str.x32dbg
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 1
call fcn.00403b70
push str.wireshark
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.00403b70
lea edi, [ebp - 0xac]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1c], 0
sub ecx, edi
mov dword [ebp - 0x18], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x14], 0
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x401359
cmp eax, 0xaaaaaaa
ja 0x40153f
lea esi, [eax + eax*2]
shl esi, 3
test esi, esi
jne 0x4012f8
xor eax, eax
jmp 0x401332
cmp esi, 0x1000
jb 0x401329
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x401544
push eax
call fcn.004051da
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x401524
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x401332
push esi
call fcn.004051da
add esp, 4
add esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], esi
push esi
push eax
lea edx, [ebp - 0x4c]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00404d70
add esp, 8
mov dword [ebp - 0x18], eax
push 0x403b20
push 4
push 0x18
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 6
push eax
call fcn.0040520a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], eax
cmp ecx, eax
je 0x4014d7
mov edx, dword [ecx + 0x10]
mov eax, closesocket
sub eax, edx
mov dword [ebp - 0x3c], edx
cmp eax, 0x13
jb 0x40153a
cmp dword [ecx + 0x14], 0xf
mov dword [ebp - 0x48], ecx
jbe 0x4013aa
mov eax, dword [ecx]
mov dword [ebp - 0x48], eax
lea ecx, [edx + 0x13]
mov dword [ebp - 0x24], 0
mov esi, 0xf
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x44], ecx
xorps xmm0, xmm0
lea edi, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
cmp ecx, esi
jbe 0x401445
mov esi, ecx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4013ed
mov ecx, connect
mov esi, closesocket
add ecx, 0x23
jmp 0x401415
cmp esi, 0x16
mov eax, 0x16
cmovb esi, eax
lea eax, [esi + 1]
test eax, eax
jne 0x401403
xor edi, edi
jmp 0x401442
cmp eax, 0x1000
jb 0x401431
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x401544
push ecx
call fcn.004051da
add esp, 4
test eax, eax
je 0x401524
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x40143c
push eax
call fcn.004051da
add esp, 4
mov edi, eax
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x34], edi
movups xmm0, xmmword [str.tasklist__findstr]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], esi
movups xmmword [edi], xmm0
mov ax, word [0x407324]
mov word [edi + 0x10], ax
mov al, byte [0x407326]
push edx
push dword [ebp - 0x48]
mov byte [edi + 0x12], al
lea eax, [edi + 0x13]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x3c]
mov byte [edi + eax + 0x13], 0
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 0xf
cmova eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x20]
add esp, 0x10
test eax, eax
je 0x401501
cmp ecx, 0xf
jbe 0x4014c5
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4014bb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401524
push ecx
push edx
call fcn.0040531f
add esp, 8
mov ecx, dword [ebp - 0x4c]
add ecx, 0x18
mov dword [ebp - 0x4c], ecx
cmp ecx, dword [ebp - 0x40]
jne 0x401386
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x1c]
call fcn.00403e70
mov al, byte [ebp - 0x35]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004051cc
mov esp, ebp
pop ebp
ret
cmp ecx, 0xf
jbe 0x401534
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40152a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40152a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040531f
add esp, 8
mov byte [ebp - 0x35], 1
jmp 0x4014db
call fcn.00401170
call fcn.004048a0
call fcn.004010d0
int3