Function at 0x140032ea0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbx, rcx
test rcx, rcx
je 0x14003310d
lea rdx, [0x140068550]
call sym.fopen
mov rsi, rax
test rax, rax
je 0x1400331c0
pxor xmm0, xmm0
lea rdi, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x70], 0
movups xmmword [rsp + 0x40], xmm0
mov rdx, rdi
mov r12d, 0xffffffff
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.msvcrt.dll__stat64]
test eax, eax
je 0x140033090
mov r9, rsi
mov r8d, 0x18
mov edx, 1
mov rcx, rdi
call sym.fread
cmp rax, 0x17
jbe 0x140033158
mov eax, dword [rsp + 0x40]
mov edx, eax
bswap edx
cmp eax, 0xd4c3b2a1
je 0x1400330a0
cmp edx, 0xd4c3b2a1
je 0x140033118
mov ecx, 2
mov edi, 0xa3a3
mov ebp, 0xa3a3
mov r14, qword [dbg.__acrt_iob_func]
call r14
mov r8, rbx
lea rdx, str._s:_unknown_byte_order_in_cap_file_n
mov r13d, 3
mov rcx, rax
call sym.fprintf_28
mov ecx, 2
call r14
mov dword [rsp + 0x20], ebp
mov r9d, edi
mov r8, rbx
mov rcx, rax
lea rdx, str._s:_unknown_version__d._d_n
call sym.fprintf_28
lea rdx, [rsp + 0x54]
mov ecx, r13d
call sym.PCAP32
mov ebp, eax
test eax, eax
je 0x140033148
cmp eax, 1
je 0x140032fd5
lea eax, [rax - 0x69]
cmp eax, 0x16
ja 0x140033190
mov edx, 0x404001
bt rdx, rax
jae 0x140033190
mov rcx, rsi
call sym.ftell
mov edi, eax
cmp eax, 0xffffffff
je 0x140033210
lea rcx, [rsp + 0x38]
mov r9, rsi
mov r8d, 8
mov edx, 1
call sym.fread
cmp rax, 8
jne 0x1400330fd
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call sym.fseek
test eax, eax
jne 0x1400330e0
mov edx, 1
mov ecx, 0x150
call sym.calloc
mov rdi, rax
test rax, rax
je 0x14003322d
mov dword [rax + 0x11c], r13d
lea rcx, [rax + 0x1c]
mov r9, rbx
lea r8, [0x1400686a7]
mov edx, 0x100
call sym.snprintf_6
mov qword [rdi], rsi
mov dword [rdi + 0x11c], r13d
mov dword [rdi + 0x120], ebp
mov qword [rdi + 0x130], r12
mov qword [rdi + 0x138], 0x18
mov rax, rdi
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r12, qword [rsp + 0x58]
jmp 0x140032f0d
movzx edi, byte [rsp + 0x44]
movzx eax, byte [rsp + 0x45]
mov r13d, 1
movzx ebp, byte [rsp + 0x46]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x47]
shl ebp, 8
add ebp, eax
cmp edi, 2
jne 0x1400330d2
cmp ebp, 4
je 0x140032f9e
mov r14, qword [dbg.__acrt_iob_func]
jmp 0x140032f7d
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8, rbx
lea rdx, str._s:_fseek_failed__file_system_error___n
mov rcx, rax
call sym.fprintf_28
mov rcx, rbx
call sym.perror
mov rcx, rsi
call sym.fclose
xor edi, edi
jmp 0x14003307b
movzx edi, byte [rsp + 0x45]
movzx eax, byte [rsp + 0x44]
mov r13d, 2
movzx ebp, byte [rsp + 0x47]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x46]
shl ebp, 8
add ebp, eax
jmp 0x1400330c4
mov ebp, 1
jmp 0x140032fd5
mov ecx, 2
test rax, rax
jne 0x1400331f0
call qword [dbg.__acrt_iob_func]
mov r8, rbx
lea rdx, str._s:_could_not_read_PCAP_header_n
mov rcx, rax
call sym.fprintf_28
mov rcx, rbx
call sym.perror
jmp 0x140033105
mov ecx, 2
xor edi, edi
call qword [dbg.__acrt_iob_func]
mov r9d, ebp
mov r8, rbx
lea rdx, str._s:_unknown_cap_file_linktype___d__expected_Ethernet_or_wifi__n
mov rcx, rax
call sym.fprintf_28
mov rcx, rsi
call sym.fclose
jmp 0x14003307b
mov ecx, 2
xor edi, edi
call qword [dbg.__acrt_iob_func]
mov r8, rbx
lea rdx, str._s:_could_not_open_capture_file_n
mov rcx, rax
call sym.fprintf_28
mov rcx, rbx
call sym.perror
jmp 0x14003307b
call qword [dbg.__acrt_iob_func]
mov r8, rbx
lea rdx, str._s:_file_too_short_n
mov rcx, rax
call sym.fprintf_28
jmp 0x140033105
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8, rbx
lea rdx, str._s:_ftell_failed__file_system_error__seen_with_VMware_HGFS_bug__n
mov rcx, rax
jmp 0x1400330f8
mov ecx, 1
call sym.exit
nop
nop dword [rax + rax]