Function at 0x436530
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x458004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x68], 0
test edi, edi
je 0x436759
push 0x44af34
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4365a7
push edi
push str._s:_could_not_open_capture_file_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
push 0x30
lea eax, [ebp - 0x58]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
jne 0x4365d3
mov eax, dword [ebp - 0x44]
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], edx
push ebx
push 0x18
lea eax, [ebp - 0x1c]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, 0x18
jae 0x436665
push edi
test eax, eax
jne 0x43662f
push str._s:_could_not_read_PCAP_header_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
push str._s:_file_too_short_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebp - 0x1c]
movzx eax, byte [ebp - 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0x19]
shl ecx, 8
or ecx, eax
cmp ecx, 0xa1b2c3d4
je 0x4366dd
cmp ecx, 0xd4c3b2a1
je 0x4366be
push edi
push str._s:_unknown_byte_order_in_cap_file_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
mov edx, 0xa3a3
mov dword [ebp - 0x5c], 3
add esp, 0xc
mov esi, edx
jmp 0x436709
mov ecx, dword [ebp - 0x17]
movzx eax, byte [ebp - 0x18]
movzx edx, byte [ebp - 0x15]
movzx esi, cl
shl esi, 8
add esi, eax
mov dword [ebp - 0x5c], 2
movzx eax, ch
jmp 0x4366fa
movzx esi, byte [ebp - 0x18]
mov ecx, dword [ebp - 0x17]
movzx eax, cl
shl esi, 8
add esi, eax
mov dword [ebp - 0x5c], 1
movzx eax, byte [ebp - 0x15]
movzx edx, ch
shl edx, 8
add edx, eax
cmp esi, 2
jne 0x436709
cmp edx, 4
je 0x436725
push edx
push esi
push edi
push str._s:_unknown_version__d._d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0x14
mov eax, dword [ebp - 0x5c]
sub eax, 1
je 0x436788
sub eax, 1
je 0x43676c
mov esi, 0xa3a3
push esi
push edi
push str._s:_unknown_cap_file_linktype___d__expected_Ethernet_or_wifi__n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
movzx esi, byte [ebp - 5]
movzx eax, byte [ebp - 6]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 7]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 8]
jmp 0x4367a2
movzx esi, byte [ebp - 8]
movzx eax, byte [ebp - 7]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 6]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 5]
shl esi, 8
or esi, eax
test esi, esi
jne 0x436803
mov esi, 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov dword [ebp - 0x60], eax
cmp eax, 0xffffffff
jne 0x43681d
push edi
push str._s:_ftell_failed__file_system_error__seen_with_VMware_HGFS_bug__n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
lea eax, [esi - 1]
cmp eax, 0x7e
ja case.0x436816.2
movzx eax, byte [eax + 0x43692c]
jmp dword [eax*4 + 0x436924]
push ebx
push 8
lea eax, [ebp - 0x24]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, 8
jne 0x4367dc
push 0
push dword [ebp - 0x60]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x436888
push edi
push str._s:_fseek_failed__file_system_error___n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00443732
mov esp, ebp
pop ebp
ret
push 0x140
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x60], eax
test eax, eax
jne 0x4368a5
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x140
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x60]
add esp, 0xc
mov ecx, dword [ebp - 0x5c]
push edi
mov edi, eax
mov dword [eax + 0x118], ecx
push 0x44af14
push 0x100
lea eax, [edi + 0x18]
push eax
call fcn.00435b30
mov eax, dword [ebp - 0x5c]
add esp, 0x10
mov ecx, dword [ebp - 4]
mov dword [edi + 0x118], eax
xor ecx, ebp
mov eax, dword [ebp - 0x64]
mov dword [edi + 0x128], eax
mov eax, dword [ebp - 0x68]
mov dword [edi + 0x12c], eax
mov eax, edi
mov dword [edi], ebx
mov dword [edi + 0x11c], esi
mov dword [edi + 0x130], 0x18
mov dword [edi + 0x134], 0
pop edi
pop esi
pop ebx
call fcn.00443732
mov esp, ebp
pop ebp
ret