Function at 0x1400331e0
Capabilities:
Read file on windows
Terminate process
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r13, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdi, [0x14006e775]
lea r12, str.Could_not_open_capture_file_to_append_frame_n
mov rsi, rcx
mov r14d, edx
jmp 0x140033251
call rbp
cmp dword [rax], 2
je 0x140033338
mov ecx, 2
call r13
mov rcx, r12
mov r8d, 0x2c
mov edx, 1
mov r9, rax
call sym.fwrite
mov rcx, rsi
call sym.perror
mov rdx, rdi
mov rcx, rsi
call sym.fopen
mov rbx, rax
test rax, rax
je 0x140033220
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, 0x18
mov edx, 1
call sym.fread
cmp rax, 0x18
je 0x1400332e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x22
mov edx, 1
lea rcx, str.Error_reading_capture_file_header_n
mov r9, rax
call sym.fwrite
mov rcx, rsi
call sym.perror
mov rcx, rbx
call sym.fclose
mov edx, r14d
mov rcx, rsi
call dbg.pcapfile_openappend
mov rdi, rax
mov rax, rdi
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov r8d, 2
mov rcx, rbx
call sym.fseek
test eax, eax
jne 0x140033554
mov eax, dword [rsp + 0x30]
mov edx, eax
bswap edx
cmp eax, 0xd4c3b2a1
je 0x140033356
cmp edx, 0xd4c3b2a1
je 0x1400334c4
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rsi
lea rdx, str._s:_unknown_byte_order_in_cap_file_n
mov rcx, rax
call sym.fprintf_1
jmp 0x1400332af
mov edx, r14d
mov rcx, rsi
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp dbg.pcapfile_openwrite
movzx edi, byte [rsp + 0x34]
movzx eax, byte [rsp + 0x35]
movzx edx, byte [rsp + 0x37]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x36]
shl eax, 8
lea ebp, [rax + rdx]
cmp edi, 2
jne 0x140033590
cmp ebp, 4
jne 0x140033590
mov ebp, dword [rsp + 0x44]
mov r12d, 1
bswap ebp
cmp r14d, ebp
je 0x140033504
mov rcx, rbx
lea rdi, [rsp + 0x50]
call sym.fclose
mov edx, 0x20
mov rcx, rdi
mov r9d, r14d
lea r8, str._linktype_d
call sym.snprintf
mov rdx, rdi
mov rcx, rsi
mov ebx, eax
call sym.strstr
test rax, rax
jne 0x14003349d
mov rcx, rsi
movsxd r12, ebx
call sym.strlen
mov r13, rax
lea rax, [rax + r12 + 1]
cmp rax, 0x100
ja 0x14003349d
mov edx, 0x2e
mov rcx, rsi
call sym.strchr
mov r15, rax
test rax, rax
je 0x1400335e2
mov r13, rax
sub r13, rsi
lea rbp, [rsp + 0x70]
mov rdx, rsi
mov r8, r13
mov rcx, rbp
call sym.memcpy
mov rdx, qword [rsp + 0x50]
lea rax, [rbp + r13]
mov qword [rax], rdx
mov edx, ebx
mov rcx, qword [rdi + rdx - 8]
mov qword [rax + rdx - 8], rcx
lea rdx, [rax + 8]
and rdx, 0xfffffffffffffff8
sub rax, rdx
add ebx, eax
sub rdi, rax
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x14003346e
and ebx, 0xfffffff8
xor eax, eax
mov ecx, eax
add eax, 8
mov r8, qword [rdi + rcx]
mov qword [rdx + rcx], r8
cmp eax, ebx
jb 0x14003345d
mov rcx, r15
call sym.strlen
lea rcx, [r13 + r12]
mov rdx, r15
add rcx, rbp
lea r8, [rax + 1]
call sym.memcpy
mov edx, r14d
mov rcx, rbp
call dbg.pcapfile_openappend
mov rdi, rax
jmp 0x1400332c5
mov ecx, 2
xor edi, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebp
mov r8d, r14d
lea rdx, str.Giving_up_on_appending__u_type_frames_onto_a__u_type_file_n
mov rcx, rax
call sym.fprintf_1
jmp 0x1400332c5
movzx eax, byte [rsp + 0x35]
movzx edx, byte [rsp + 0x34]
movzx edi, byte [rsp + 0x37]
shl eax, 8
lea ebp, [rax + rdx]
movzx eax, byte [rsp + 0x36]
shl edi, 8
add edi, eax
cmp edi, 4
jne 0x1400335b9
cmp ebp, 2
jne 0x1400335b9
mov ebp, dword [rsp + 0x44]
mov r12d, 2
jmp 0x140033393
mov edx, 1
mov ecx, 0x150
call sym.calloc
mov rdi, rax
test rax, rax
je 0x1400335eb
mov dword [rax + 0x11c], r12d
lea rcx, [rax + 0x1c]
mov r9, rsi
lea r8, [0x14006e727]
mov edx, 0x100
call sym.snprintf
mov qword [rdi], rbx
mov dword [rdi + 0x11c], r12d
mov dword [rdi + 0x120], r14d
jmp 0x1400332c5
mov ecx, 2
xor edi, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x26
mov edx, 1
lea rcx, str.Could_not_seek_to_end_of_capture_file_n
mov r9, rax
call sym.fwrite
mov rcx, rsi
call sym.perror
mov rcx, rbx
call sym.fclose
jmp 0x1400332c5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], ebp
mov r9d, edi
mov r8, rsi
mov rcx, rax
lea rdx, str._s:_unknown_version__u._u_n
call sym.fprintf_1
jmp 0x140033387
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], edi
mov r9d, ebp
mov r8, rsi
mov rcx, rax
lea rdx, str._s:_unknown_version__u._u_n
call sym.fprintf_1
jmp 0x1400334f5
lea r15, [rsi + r13]
jmp 0x140033414
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]