Function at 0x140031990
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x170
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov r13, qword [dbg.__acrt_iob_func]
lea rdi, [0x140065115]
lea r12, str.Could_not_open_capture_file_to_append_frame_n
mov rsi, rcx
mov r14d, edx
jmp 0x1400319ee
call rbp
cmp dword [rax], 2
je 0x140031ac8
mov ecx, 2
call r13
mov rdx, r12
mov rcx, rax
call sym.fprintf_27
mov rcx, rsi
call sym.perror
mov rdx, rdi
mov rcx, rsi
call sym.fopen
mov rbx, rax
test rax, rax
je 0x1400319c8
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, 0x18
mov edx, 1
call sym.fread
cmp rax, 0x18
je 0x140031a70
mov ecx, 2
call qword [dbg.__acrt_iob_func]
lea rdx, str.Error_reading_capture_file_header_n
mov rcx, rax
call sym.fprintf_27
mov rcx, rsi
call sym.perror
mov rcx, rbx
call sym.fclose
mov edx, r14d
mov rcx, rsi
call dbg.pcapfile_openappend
mov rdi, rax
mov rax, rdi
add rsp, 0x170
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor edx, edx
mov r8d, 2
mov rcx, rbx
call sym.fseek
test eax, eax
jne 0x140031cbd
mov eax, dword [rsp + 0x30]
mov edx, eax
bswap edx
cmp eax, 0xd4c3b2a1
je 0x140031ae4
cmp edx, 0xd4c3b2a1
je 0x140031c1b
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8, rsi
lea rdx, str._s:_unknown_byte_order_in_cap_file_n
mov rcx, rax
call sym.fprintf_27
jmp 0x140031a41
mov edx, r14d
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp dbg.pcapfile_openwrite
movzx edi, byte [rsp + 0x34]
movzx eax, byte [rsp + 0x35]
mov r12d, 1
movzx ebp, byte [rsp + 0x36]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x37]
shl ebp, 8
add ebp, eax
cmp edi, 2
jne 0x140031c94
cmp ebp, 4
jne 0x140031c94
lea rdx, [rsp + 0x44]
mov ecx, r12d
call sym.PCAP32
mov edi, eax
cmp r14d, eax
je 0x140031c44
mov rcx, rbx
lea r12, [rsp + 0x50]
call sym.fclose
mov edx, 0x20
mov rcx, r12
mov r9d, r14d
lea r8, str._linktype_d
call sym.snprintf_6
mov rdx, r12
mov rcx, rsi
movsxd rbp, eax
call sym.strstr
test rax, rax
jne 0x140031bf4
mov rcx, rsi
call sym.strlen
mov rbx, rax
lea rax, [rax + rbp + 1]
cmp rax, 0x100
ja 0x140031bf4
mov edx, 0x2e
mov rcx, rsi
call sym.strchr
mov r13, rax
test rax, rax
je 0x140031cee
mov rbx, rax
sub rbx, rsi
lea rdi, [rsp + 0x70]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sym.memcpy
lea rcx, [rdi + rbx]
mov r8, rbp
mov rdx, r12
call sym.memcpy
mov rcx, r13
call sym.strlen
lea rcx, [rbx + rbp]
mov rdx, r13
add rcx, rdi
lea r8, [rax + 1]
call sym.memcpy
mov rcx, rdi
mov edx, r14d
call dbg.pcapfile_openappend
mov rdi, rax
jmp 0x140031a57
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r9d, edi
mov r8d, r14d
xor edi, edi
mov rcx, rax
lea rdx, str.Giving_up_on_appending__u_type_frames_onto_a__u_type_file_n
call sym.fprintf_27
jmp 0x140031a57
movzx edi, byte [rsp + 0x35]
movzx eax, byte [rsp + 0x34]
mov r12d, 2
movzx ebp, byte [rsp + 0x37]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x36]
shl ebp, 8
add ebp, eax
jmp 0x140031b08
mov edx, 1
mov ecx, 0x150
call sym.calloc
mov rdi, rax
test rax, rax
je 0x140031cf7
mov dword [rax + 0x11c], r12d
lea rcx, [rax + 0x1c]
mov r9, rsi
lea r8, [0x1400650c7]
mov edx, 0x100
call sym.snprintf_6
mov qword [rdi], rbx
mov dword [rdi + 0x11c], r12d
mov dword [rdi + 0x120], r14d
jmp 0x140031a57
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov dword [rsp + 0x20], ebp
mov r9d, edi
mov r8, rsi
mov rcx, rax
lea rdx, str._s:_unknown_version__u._u_n
call sym.fprintf_27
jmp 0x140031b1a
mov ecx, 2
xor edi, edi
call qword [dbg.__acrt_iob_func]
lea rdx, str.Could_not_seek_to_end_of_capture_file_n
mov rcx, rax
call sym.fprintf_27
mov rcx, rsi
call sym.perror
mov rcx, rbx
call sym.fclose
jmp 0x140031a57
lea r13, [rsi + rbx]
jmp 0x140031ba4
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]