Function at 0x140051650
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [0x14009f088]
xor rax, rbp
mov qword [rbp + 0x298], rax
lea rcx, [0x1401a5341]
call fcn.14006b9e0
mov eax, 0xffffffff
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0x2c0], 0
jne 0x1400516b6
xor eax, eax
jmp 0x140051b48
lea rdx, [0x1400715d4]
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14005170a
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_could_not_open_capture_file_n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
xor eax, eax
jmp 0x140051b48
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0xd8]
call sub.VCRUNTIME140D.dll_memset
lea rdx, [rbp + 0xd8]
mov rcx, qword [rbp + 0x2c0]
call fcn.140052cd0
test eax, eax
jne 0x140051743
movsxd rax, dword [rbp + 0xec]
mov qword [rbp + 0xb8], rax
mov r9, qword [rbp + 8]
mov r8d, 0x18
mov edx, 1
lea rcx, [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0x18
jae 0x1400517d0
cmp qword [rbp + 0x28], 0
ja 0x14005179e
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_could_not_read_PCAP_header_n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
jmp 0x1400517bf
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_file_too_short_n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x140051b48
mov eax, 1
imul rax, rax, 0
movzx eax, byte [rbp + rax + 0x48]
shl eax, 0x18
mov ecx, 1
imul rcx, rcx, 1
movzx ecx, byte [rbp + rcx + 0x48]
shl ecx, 0x10
or eax, ecx
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rbp + rcx + 0x48]
shl ecx, 8
or eax, ecx
mov ecx, 1
imul rcx, rcx, 3
movzx ecx, byte [rbp + rcx + 0x48]
or eax, ecx
mov dword [rbp + 0x294], eax
cmp dword [rbp + 0x294], 0xa1b2c3d4
je 0x140051837
cmp dword [rbp + 0x294], 0xd4c3b2a1
je 0x140051840
jmp 0x140051849
mov dword [rbp + 0x74], 1
jmp 0x140051871
mov dword [rbp + 0x74], 2
jmp 0x140051871
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_unknown_byte_order_in_cap_file_n
mov rcx, rax
call fcn.140001b10
mov dword [rbp + 0x74], 3
lea rax, [rbp + 0x4c]
mov rdx, rax
mov ecx, dword [rbp + 0x74]
call fcn.140051180
mov dword [rbp + 0x124], eax
lea rax, [rbp + 0x4e]
mov rdx, rax
mov ecx, dword [rbp + 0x74]
call fcn.140051180
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x124], 2
jne 0x1400518ad
cmp dword [rbp + 0x144], 4
je 0x1400518df
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x144]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x124]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_unknown_version__d._d_n
mov rcx, rax
call fcn.140001b10
lea rax, [rbp + 0x5c]
mov rdx, rax
mov ecx, dword [rbp + 0x74]
call fcn.140051240
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 0
jne 0x140051907
mov dword [rbp + 0x94], 1
mov eax, dword [rbp + 0x94]
mov dword [rbp + 0x294], eax
cmp dword [rbp + 0x294], 1
je 0x140051939
cmp dword [rbp + 0x294], 0x69
je 0x140051939
cmp dword [rbp + 0x294], 0x77
je 0x140051939
cmp dword [rbp + 0x294], 0x7f
je 0x140051939
jmp 0x14005193b
jmp 0x140051974
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r9d, dword [rbp + 0x94]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_unknown_cap_file_linktype___d__expected_Ethernet_or_wifi__n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x140051b48
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_ftell]
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0xffffffff
jne 0x1400519cc
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_ftell_failed__file_system_error__seen_with_VMware_HGFS_bug__n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x140051b48
mov r9, qword [rbp + 8]
mov r8d, 8
mov edx, 1
lea rcx, [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 8
je 0x140051a17
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x140051b48
xor r8d, r8d
mov edx, dword [rbp + 0x164]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fseek]
test eax, eax
je 0x140051a6d
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, qword [rbp + 0x2c0]
lea rdx, str._s:_fseek_failed__file_system_error___n
mov rcx, rax
call fcn.140001b10
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ucrtbased.dll_perror]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x140051b48
mov qword [rbp + 0x1c8], 0
mov ecx, 0x150
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0
jne 0x140051a9f
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov r8d, 0x150
xor edx, edx
mov rcx, qword [rbp + 0x1c8]
call sub.VCRUNTIME140D.dll_memset
mov rax, qword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x74]
mov dword [rax + 0x11c], ecx
mov rax, qword [rbp + 0x1c8]
add rax, 0x1c
mov r9, qword [rbp + 0x2c0]
lea r8, [0x140071230]
mov edx, 0x100
mov rcx, rax
call fcn.140051360
mov rax, qword [rbp + 0x1c8]
mov rcx, qword [rbp + 8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x74]
mov dword [rax + 0x11c], ecx
mov rax, qword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x94]
mov dword [rax + 0x120], ecx
mov rax, qword [rbp + 0x1c8]
mov rcx, qword [rbp + 0xb8]
mov qword [rax + 0x130], rcx
mov rax, qword [rbp + 0x1c8]
mov qword [rax + 0x138], 0x18
mov rax, qword [rbp + 0x1c8]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14008d9e0]
call fcn.14006b950
mov rax, rdi
mov rcx, qword [rbp + 0x298]
xor rcx, rbp
call fcn.14006bb70
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret