Function at 0x4049cc
Capabilities:
Execute command
Schedule task via at
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x300
call sym.___main
call sym.SetupColorWindow__
mov dword [esp + 0x2e8], 0
mov dword [esp + 8], str.17:36:02
mov dword [esp + 4], str.Mar_15_2024
mov dword [esp], str.Ver.__s__s_n
call sym._printf
call sym.CheckUpdate__
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.143552766
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x404a4c
mov dword [esp], str._n_n_t_t
call sym._puts
mov dword [esp], str.pause
call sym._system
mov eax, 0
jmp 0x405561
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.noscan
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x404a7b
mov dword [0x40b088], 0
mov dword [esp], str.noscan_in_the_file_name._Dont_scan_the_server
call sym._puts
mov dword [esp + 8], 0x4000000
mov dword [esp + 4], 0
mov dword [esp], 0x41e080
call sym._memset
lea eax, [esp + 0x4d]
mov ebx, str.udp_and_not_port_137_and_not_port_5521_and_not_port_53_and_not_port_5353_and_not_port_1234_and_not_port_5735_and_not_port_12345_and_not_port_12346__and_not_host_47.242.237.220__and_not_host_1.116.12.70
mov edx, 0xcb
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
call sym.LoadNpcapDlls__
test eax, eax
sete al
test al, al
je 0x404b0d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], str.Couldnt_load_Npcap_n
call sym._fwrite
mov dword [esp], 1
call sym._exit
lea eax, [esp + 0x118]
mov dword [esp + 4], eax
lea eax, [esp + 0x2e0]
mov dword [esp], eax
call sym._pcap_findalldevs
cmp eax, 0xffffffff
sete al
test al, al
je 0x404b60
lea eax, [esp + 0x118]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Error_in_pcap_findalldevs:__s_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov dword [esp + 0x2f0], 0
mov eax, dword [esp + 0x2e0]
mov dword [esp + 0x2fc], eax
cmp dword [esp + 0x2fc], 0
je 0x404d13
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x404cfe
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x2f8], eax
cmp dword [esp + 0x2f8], 0
je 0x404cfe
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax + 4]
movzx eax, word [eax]
cmp ax, 2
jne 0x404ce8
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 4]
lea edx, [esp + 0x118]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x3e8
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10000
mov dword [esp], eax
call sym._pcap_open_live
mov dword [esp + 0x2e4], eax
cmp dword [esp + 0x2e4], 0
setne al
test al, al
je 0x404cfd
mov eax, dword [esp + 0x2e4]
mov dword [esp], eax
call sym._pcap_datalink
cmp eax, 1
je 0x404c46
mov eax, dword [esp + 0x2e4]
mov dword [esp], eax
call sym._pcap_datalink
cmp eax, 0xc
jne 0x404c4d
mov eax, 1
jmp 0x404c52
mov eax, 0
test al, al
je 0x404cfd
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.iptos_unsigned_long_
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym._strcpy
mov dword [esp + 4], str.169.254.
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym._strstr
mov edx, eax
lea eax, [esp + 0x28]
cmp edx, eax
je 0x404cfd
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 8]
mov dword [esp + 4], str.TAP_Windows
mov dword [esp], eax
call sym._strstr
mov edx, eax
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 8]
cmp edx, eax
je 0x404cfd
mov eax, dword [esp + 0x2f0]
lea edx, [eax + 1]
mov dword [esp + 0x2f0], edx
mov edx, dword [esp + 0x2fc]
mov dword [esp + eax*4 + 0x218], edx
jmp 0x404cfd
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax]
mov dword [esp + 0x2f8], eax
jmp 0x404baa
nop
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax]
mov dword [esp + 0x2fc], eax
jmp 0x404b79
mov dword [esp + 0x40], 0
cmp dword [esp + 0x2f0], 0
jne 0x404d47
mov dword [esp], 0x419188
call sym._puts
mov dword [esp], str.pause
call sym._system
mov eax, 0
jmp 0x405561
call sym.IsChineseSystem__
test eax, eax
setne al
test al, al
je 0x404d61
mov dword [esp], 0x4191a4
call sym._puts
mov dword [esp + 0x2ec], 0
mov eax, dword [esp + 0x2ec]
cmp eax, dword [esp + 0x2f0]
jge 0x404e57
mov eax, dword [esp + 0x2ec]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], str.__d:
call sym._printf
mov eax, dword [esp + 0x2ec]
mov eax, dword [esp + eax*4 + 0x218]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x2f8], eax
cmp dword [esp + 0x2f8], 0
je 0x404e06
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax + 4]
movzx eax, word [eax]
cmp ax, 2
jne 0x404df4
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.iptos_unsigned_long_
mov dword [esp + 4], eax
mov dword [esp], str.IP:_s_t
call sym._printf
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax]
mov dword [esp + 0x2f8], eax
jmp 0x404db2
mov eax, dword [esp + 0x2ec]
mov eax, dword [esp + eax*4 + 0x218]
mov eax, dword [eax + 8]
test eax, eax
je 0x404e3e
mov eax, dword [esp + 0x2ec]
mov eax, dword [esp + eax*4 + 0x218]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov dword [esp], str._t__s__n
call sym._printf
jmp 0x404e4a
mov dword [esp], str._t_tNo_Description
call sym._puts
add dword [esp + 0x2ec], 1
jmp 0x404d6c
cmp dword [esp + 0x2f0], 1
jne 0x404e6e
mov dword [esp + 0x40], 1
jmp 0x404f01
cmp dword [ebp + 8], 1
jne 0x404ea1
mov eax, dword [esp + 0x2f0]
mov dword [esp + 4], eax
mov dword [esp], str.Please_enter_the_number_to_select_adapter_1__d_:
call sym._printf
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], 0x4192e1
call sym._scanf
jmp 0x404f01
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._strlen
cmp eax, 1
jbe 0x404ed8
mov dword [esp], str.too_many_cards
call sym._puts
mov dword [esp], str.pause
call sym._system
mov eax, 0
jmp 0x405561
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
movzx eax, byte [eax]
movsx eax, al
sub eax, 0x30
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], str.Select__No.__d_adapter__by_parameter__n
call sym._printf
mov eax, dword [esp + 0x40]
test eax, eax
jle 0x404f16
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x2f0]
jle 0x404f47
mov dword [esp], 0x41931b
call sym._puts
mov eax, dword [esp + 0x2e0]
mov dword [esp], eax
call sym._pcap_freealldevs
mov dword [esp], str.pause
call sym._system
mov eax, 0xffffffff
jmp 0x405561
mov eax, dword [esp + 0x40]
sub eax, 1
mov eax, dword [esp + eax*4 + 0x218]
mov dword [esp + 0x2fc], eax
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x2f8], eax
cmp dword [esp + 0x2f8], 0
je 0x405028
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax + 4]
movzx eax, word [eax]
cmp ax, 2
jne 0x404fc7
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.iptosv6_sockaddr_
mov ecx, eax
mov eax, dword [0x4423ac4]
lea edx, [eax + 1]
mov dword [0x4423ac4], edx
imul eax, eax, 0x96
add eax, 0x441e2e0
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._strcpy
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax + 4]
movzx eax, word [eax]
cmp ax, 0x17
jne 0x405013
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.iptosv6_sockaddr_
mov ecx, eax
mov eax, dword [0x4423ac4]
lea edx, [eax + 1]
mov dword [0x4423ac4], edx
imul eax, eax, 0x96
add eax, 0x441e2e0
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._strcpy
mov eax, dword [esp + 0x2f8]
mov eax, dword [eax]
mov dword [esp + 0x2f8], eax
jmp 0x404f6d
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 4]
lea edx, [esp + 0x118]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x3e8
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10000
mov dword [esp], eax
call sym._pcap_open_live
mov dword [esp + 0x2e4], eax
cmp dword [esp + 0x2e4], 0
sete al
test al, al
je 0x4050bb
lea eax, [esp + 0x118]
mov dword [esp + 8], eax
mov dword [esp + 4], str._nUnable_to_open_the_adapter:__s_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [esp + 0x2e0]
mov dword [esp], eax
call sym._pcap_freealldevs
mov dword [esp], str.pause
call sym._system
mov eax, 0xffffffff
jmp 0x405561
mov eax, dword [esp + 0x2e4]
mov dword [esp], eax
call sym._pcap_datalink
mov dword [0x40b084], eax
mov eax, dword [0x40b084]
cmp eax, 1
je 0x405130
mov eax, dword [0x40b084]
cmp eax, 0xc
je 0x405130
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2a
mov dword [esp + 4], 1
mov dword [esp], str._nonly_support_Ethernet_and_viture_adapter_n
call sym._fwrite
mov eax, dword [esp + 0x2e0]
mov dword [esp], eax
call sym._pcap_freealldevs
mov dword [esp], str.pause
call sym._system
mov eax, 0xffffffff
jmp 0x405561
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x405157
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [esp + 0x2f4], eax
jmp 0x405162
mov dword [esp + 0x2f4], 0xffffff
mov eax, dword [esp + 0x2f4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
lea eax, [esp + 0x4d]
mov dword [esp + 8], eax
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2e4]
mov dword [esp], eax
call sym._pcap_compile
shr eax, 0x1f
test al, al
je 0x4051e8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x38
mov dword [esp + 4], 1
mov dword [esp], str._nUnable_to_compile_the_packet_filter._Check_the_syntax._n
call sym._fwrite
mov eax, dword [esp + 0x2e0]
mov dword [esp], eax
call sym._pcap_freealldevs
mov dword [esp], str.pause
call sym._system
mov eax, 0xffffffff
jmp 0x405561
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2e4]
mov dword [esp], eax
call sym._pcap_setfilter
shr eax, 0x1f
test al, al
je 0x405253
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str._nError_setting_the_filter._n
call sym._fwrite
mov eax, dword [esp + 0x2e0]
mov dword [esp], eax
call sym._pcap_freealldevs
mov dword [esp], str.pause
call sym._system
mov eax, 0xffffffff
jmp 0x405561
call sym.IsChineseSystem__
test eax, eax
setne al
test al, al
je 0x40537e
mov dword [esp], str._tQ_143552766
call sym._puts
mov dword [esp], 0x4193dc
call sym._puts
mov dword [esp], 0x41942c
call sym._puts
mov dword [esp], 0x419468
call sym._puts
mov dword [esp], 0x4194ac
call sym._puts
mov dword [esp], 0x419514
call sym._printf
mov dword [esp], 0x419554
call sym._puts
mov dword [esp], 0x4195b0
call sym._puts
mov dword [esp], 0x4195fc
call sym._puts
mov dword [esp], 0x419628
call sym._puts
mov dword [esp], 0x41966c
call sym._puts
mov dword [esp], 0x4196bc
call sym._puts
mov dword [esp], 0x41970c
call sym._printf
mov dword [esp], 0x14
call sym.printcolordot_int_
mov dword [esp], 0x28
call sym.printcolordot_int_
mov dword [esp], 0x46
call sym.printcolordot_int_
mov dword [esp], 0x5a
call sym.printcolordot_int_
mov dword [esp], 0x78
call sym.printcolordot_int_
mov dword [esp], 0xaa
call sym.printcolordot_int_
mov dword [esp], 0xd2
call sym.printcolordot_int_
mov dword [esp], 0x136
call sym.printcolordot_int_
mov dword [esp], 0x19a
call sym.printcolordot_int_
mov dword [esp], 0x419764
call sym._printf
jmp 0x40546e
mov dword [esp], str._n_t_Authors_QQ:_105314994__QQ_group:143552766
call sym._printf
mov dword [esp], str._n_n__tTelegram_channel:__thttps:__t.me_efootballCheaterReport
call sym._printf
mov dword [esp], str._n__tTelegram__group:__thttps:__t.me_eFootballxjbt
call sym._printf
mov dword [esp], str._n__t______Donation_:__thttps:__www.paypal.com_paypalme_tacbin
call sym._printf
mov dword [esp], str._n_nYou_must_block_TCP_matches_for_better_experience._Check__https:__t.me_efootballCheaterReport_159
call sym._printf
mov dword [esp], str._nThis_method_can_be_used_to_skip_some__regional_servers._https:__t.me_efootballCheaterReport_169
call sym._printf
mov dword [esp], str._nOnly_sniff_UDP_traffic__if_the_game_gets_match_but_here_is_no_display__that_means_its_a_TCP_match._Dont_accept
call sym._printf
mov dword [esp], str._nAntenna_bar_appears_but_here_is_no__Confirming__for_a_PSP_match__that_means_its_changed_to_TCP_match
call sym._printf
mov dword [esp], str._nColorful_dot_means_different_latency___25ms_50ms_75ms_100ms_150ms_200ms_300ms_400ms__400ms
call sym._printf
mov dword [esp], 0x14
call sym.printcolordot_int_
mov dword [esp], 0x28
call sym.printcolordot_int_
mov dword [esp], 0x46
call sym.printcolordot_int_
mov dword [esp], 0x5a
call sym.printcolordot_int_
mov dword [esp], 0x78
call sym.printcolordot_int_
mov dword [esp], 0xaa
call sym.printcolordot_int_
mov dword [esp], 0xd2
call sym.printcolordot_int_
mov dword [esp], 0x136
call sym.printcolordot_int_
mov dword [esp], 0x19a
call sym.printcolordot_int_
mov dword [esp], str._nPress_hh_to_show_featurelist
call sym._printf
mov dword [esp], 0xa
call sym._putchar
cmp dword [esp + 0x2f0], 1
jne 0x405484
mov dword [esp], str._n_There_is_only_one_active_adapter._Automatically_selected
call sym._printf
mov eax, dword [esp + 0x2fc]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov dword [esp], str._n_Listening_on___s_______
call sym._printf
mov eax, dword [esp + 0x2e0]
mov dword [esp], eax
call sym._pcap_freealldevs
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.threadgetinput_void_
mov dword [esp + 4], 0
lea eax, [esp + 0x38]
mov dword [esp], eax
call sym._pthread_create
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.threadtimer_void_
mov dword [esp + 4], 0
lea eax, [esp + 0x38]
mov dword [esp], eax
call sym._pthread_create
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.threadDetectPort_void_
mov dword [esp + 4], 0
mov dword [esp], 0x41e054
call sym._pthread_create
mov eax, dword [esp + 0x2e4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym.threadpcap_void_
mov dword [esp + 4], 0
lea eax, [esp + 0x38]
mov dword [esp], eax
call sym._pthread_create
mov dword [esp + 8], 0
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._pthread_join
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret