Function at 0x14004ebf0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [0x14009ad80]
xor rax, rbp
mov qword [rbp + 0x298], rax
lea rcx, [0x1401a1305]
call fcn.140068b20
mov eax, 0xffffffff
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0x2c0], 0
jne 0x14004ec56
xor eax, eax
jmp 0x14004f0e8
lea rdx, [0x14006e5e4]
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14004ecaa
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_could_not_open_capture_file_n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
xor eax, eax
jmp 0x14004f0e8
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0xd8]
call sub.VCRUNTIME140D.dll_memset
lea rdx, [rbp + 0xd8]
mov rcx, qword [rbp + 0x2c0]
call fcn.140050270
test eax, eax
jne 0x14004ece3
movsxd rax, dword [rbp + 0xec]
mov qword [rbp + 0xb8], rax
mov r9, qword [rbp + 8]
mov r8d, 0x18
mov edx, 1
lea rcx, [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0x18
jae 0x14004ed70
cmp qword [rbp + 0x28], 0
ja 0x14004ed3e
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_could_not_read_PCAP_header_n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
jmp 0x14004ed5f
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_file_too_short_n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x14004f0e8
mov eax, 1
imul rax, rax, 0
movzx eax, byte [rbp + rax + 0x48]
shl eax, 0x18
mov ecx, 1
imul rcx, rcx, 1
movzx ecx, byte [rbp + rcx + 0x48]
shl ecx, 0x10
or eax, ecx
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rbp + rcx + 0x48]
shl ecx, 8
or eax, ecx
mov ecx, 1
imul rcx, rcx, 3
movzx ecx, byte [rbp + rcx + 0x48]
or eax, ecx
mov dword [rbp + 0x294], eax
cmp dword [rbp + 0x294], 0xa1b2c3d4
je 0x14004edd7
cmp dword [rbp + 0x294], 0xd4c3b2a1
je 0x14004ede0
jmp 0x14004ede9
mov dword [rbp + 0x74], 1
jmp 0x14004ee11
mov dword [rbp + 0x74], 2
jmp 0x14004ee11
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_unknown_byte_order_in_cap_file_n
mov rcx, rax
call fcn.140001b10
mov dword [rbp + 0x74], 3
lea rax, [rbp + 0x4c]
mov rdx, rax
mov ecx, dword [rbp + 0x74]
call fcn.14004e720
mov dword [rbp + 0x124], eax
lea rax, [rbp + 0x4e]
mov rdx, rax
mov ecx, dword [rbp + 0x74]
call fcn.14004e720
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x124], 2
jne 0x14004ee4d
cmp dword [rbp + 0x144], 4
je 0x14004ee7f
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x144]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x124]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_unknown_version__d._d_n
mov rcx, rax
call fcn.140001b10
lea rax, [rbp + 0x5c]
mov rdx, rax
mov ecx, dword [rbp + 0x74]
call fcn.14004e7e0
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 0
jne 0x14004eea7
mov dword [rbp + 0x94], 1
mov eax, dword [rbp + 0x94]
mov dword [rbp + 0x294], eax
cmp dword [rbp + 0x294], 1
je 0x14004eed9
cmp dword [rbp + 0x294], 0x69
je 0x14004eed9
cmp dword [rbp + 0x294], 0x77
je 0x14004eed9
cmp dword [rbp + 0x294], 0x7f
je 0x14004eed9
jmp 0x14004eedb
jmp 0x14004ef14
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r9d, dword [rbp + 0x94]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_unknown_cap_file_linktype___d__expected_Ethernet_or_wifi__n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x14004f0e8
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_ftell]
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0xffffffff
jne 0x14004ef6c
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_ftell_failed__file_system_error__seen_with_VMware_HGFS_bug__n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x14004f0e8
mov r9, qword [rbp + 8]
mov r8d, 8
mov edx, 1
lea rcx, [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 8
je 0x14004efb7
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x14004f0e8
xor r8d, r8d
mov edx, dword [rbp + 0x164]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fseek]
test eax, eax
je 0x14004f00d
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_fseek_failed__file_system_error___n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x14004f0e8
mov qword [rbp + 0x1c8], 0
mov ecx, 0x150
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0
jne 0x14004f03f
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov r8d, 0x150
xor edx, edx
mov rcx, qword [rbp + 0x1c8]
call sub.VCRUNTIME140D.dll_memset
mov rax, qword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x74]
mov dword [rax + 0x11c], ecx
mov rax, qword [rbp + 0x1c8]
add rax, 0x1c
mov r9, qword [rbp + 0x2c0]
lea r8, [0x14006e240]
mov edx, 0x100
mov rcx, rax
call fcn.14004e900
mov rax, qword [rbp + 0x1c8]
mov rcx, qword [rbp + 8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x74]
mov dword [rax + 0x11c], ecx
mov rax, qword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x94]
mov dword [rax + 0x120], ecx
mov rax, qword [rbp + 0x1c8]
mov rcx, qword [rbp + 0xb8]
mov qword [rax + 0x130], rcx
mov rax, qword [rbp + 0x1c8]
mov qword [rax + 0x138], 0x18
mov rax, qword [rbp + 0x1c8]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140089f90]
call fcn.140068a90
mov rax, rdi
mov rcx, qword [rbp + 0x298]
xor rcx, rbp
call fcn.140068cb0
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret