Function at 0x1400344c0
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
mov rsi, rcx
mov edi, edx
mov ecx, 1
mov edx, 0x30
mov qword [rsp + 0x40], 0x70616370
mov r12d, r9d
mov ebp, r8d
mov qword [rsp + 0x48], 0
and r12d, 1
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
call dbg.CALLOC
movzx r9d, byte [rax + 0x18]
mov rbx, rax
and r9d, 0xfffffffe
or r9d, r12d
mov byte [rax + 0x18], r9b
call sym.pixie_gettime
test rax, rax
js 0x1400349c0
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
movzx edx, byte [rsp + 0x1b0]
movzx eax, byte [rbx + 0x18]
divsd xmm0, qword [0x14006f040]
movsd qword [rbx + 0x20], xmm0
and edx, 1
and eax, 0xfffffffd
add edx, edx
or eax, edx
mov byte [rbx + 0x18], al
mov eax, dword [rsp + 0x1b8]
mov dword [rbx + 0x1c], eax
mov eax, dword [rsp + 0x1a0]
test eax, eax
jne 0x14003486b
movzx eax, byte [rsi]
test al, al
je 0x140034701
lea rdx, [rsi + 1]
mov ecx, 1
nop word cs:[rax + rax]
nop dword [rax]
sub eax, 0x30
cmp al, 9
setbe al
add rdx, 1
movzx eax, al
and ecx, eax
movzx eax, byte [rdx - 1]
test al, al
jne 0x1400346e0
test ecx, ecx
jne 0x1400349e0
test edi, edi
je 0x140034715
mov rcx, rsi
call sym.is_pfring_dna
test eax, eax
je 0x140034c2a
mov rcx, rsi
call sym.is_pfring_dna
test eax, eax
jne 0x140034880
cmp dword [rsi], 0x656c6966
je 0x140034a10
mov rdi, qword [0x140073360]
lea r12, [rsp + 0x40]
call qword [rdi + 0x40]
mov r8, rsi
lea rdx, str.___if__s_:_pcap:__s_n
mov ecx, 1
mov r9, rax
call dbg.LOG
mov r8, rsi
mov ecx, 2
lea rdx, str.___if__s_:_opening..._n
call dbg.LOG
mov rcx, rsi
mov rdx, r12
call qword [rdi + 0xd0]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x140034a68
mov edx, 0x10000
call qword [rdi + 0xd8]
mov rcx, qword [rbx]
test eax, eax
jne 0x140034ba0
mov edx, 8
call qword [rdi + 0xe0]
mov rcx, qword [rbx]
test eax, eax
jne 0x140034bf0
mov edx, 0x3e8
call qword [rdi + 0xe8]
mov rcx, qword [rbx]
test eax, eax
jne 0x140034c91
mov edx, 1
call qword [rdi + 0xf0]
mov rcx, qword [rbx]
test eax, eax
jne 0x140034ca3
call qword [rdi + 0x110]
mov r12d, eax
cmp eax, 0xfffffff8
je 0x140034c70
test eax, eax
jne 0x140034bb8
mov r8, rsi
lea rdx, str.___if__s_:_successfully_opened_n
mov ecx, 1
call dbg.LOG
mov rcx, qword [rbx]
call qword [rdi + 0x18]
mov dword [rbx + 0x28], eax
test eax, eax
je 0x140034b80
jg 0x140034b20
cmp eax, 0xffffffff
jne 0x140034b58
mov rcx, qword [rbx]
lea rdx, str.if:_datalink
call qword [rdi + 0x88]
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140034852
call qword [rdi + 0x10]
mov qword [rbx], 0
lea rdx, str.vmnet1
mov rcx, rsi
call sym.strcmp
test eax, eax
je 0x140034c56
xor ebx, ebx
mov rax, rbx
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8, rsi
lea rdx, str.pfring:_s:_opening..._n
mov ecx, 2
call dbg.LOG
xor r8d, r8d
mov edx, 0x5dc
mov rcx, rsi
mov rdi, qword [0x140073370]
call qword [rdi]
mov dword [rbx + 0x28], 1
mov qword [rbx + 0x10], rax
mov qword [rbx], rax
test rax, rax
je 0x140034c02
mov r8, rsi
lea rdx, str.pfring:_s:_successfully_opened_n
mov ecx, 1
call dbg.LOG
mov rcx, qword [rbx + 0x10]
lea rdx, str.masscan
call qword [rdi + 0x40]
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x3c]
call qword [rdi + 0x30]
mov eax, dword [rsp + 0x3c]
movzx edx, al
movzx ecx, ah
shr eax, 0x10
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, eax
lea rdx, str.pfring:_version__d._d._d_n
mov ecx, 1
call dbg.LOG
mov r8, rsi
mov ecx, 2
lea rdx, str.pfring:_s:_setting_direction_n
call dbg.LOG
mov rcx, qword [rbx + 0x10]
mov edx, 1
call qword [rdi + 0x38]
mov ebp, eax
test eax, eax
je 0x140034b00
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebp
mov r8, rsi
lea rdx, str.pfring:_s:_setdirection___d_n
mov rcx, rax
call sym.fprintf_1
mov ecx, 2
mov r8, rsi
lea rdx, str.pfring:_s:_activating_n
call dbg.LOG
mov rcx, qword [rbx + 0x10]
call qword [rdi + 0x10]
test eax, eax
je 0x140034ae0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call sym.strerror
mov r8, rsi
lea rdx, str.pfring:__s:_ENABLE_ERROR:__s_n
xor ecx, ecx
mov r9, rax
call dbg.LOG
mov rcx, qword [rbx + 0x10]
call qword [rdi + 8]
mov qword [rbx + 0x10], 0
xor ebx, ebx
jmp 0x14003486b
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
jmp 0x14003467f
mov rcx, rsi
call sym.atoi
mov ecx, eax
call dbg.adapter_from_index
test rax, rax
je 0x140034cb5
mov rsi, rax
test edi, edi
je 0x140034715
jmp 0x140034705
cmp byte [rsi + 4], 0x3a
jne 0x140034731
lea r13, [rsi + 5]
mov ecx, 1
lea r12, [rsp + 0x40]
mov r8, r13
lea rdx, str.pcap:_file:__s_n
call dbg.LOG
mov rdi, qword [0x140073360]
mov rdx, r12
mov rcx, r13
mov dword [0x14017f0c8], 1
call qword [rdi + 0x60]
mov qword [rbx], rax
mov rcx, rax
call qword [rdi + 0x18]
mov dword [rbx + 0x28], eax
jmp 0x14003473d
mov qword [rsp + 0x20], r12
mov r9d, 0x3e8
mov edx, 0x10000
mov rcx, rsi
mov r8d, 8
call qword [rdi + 0x58]
mov qword [rbx], rax
test rax, rax
jne 0x1400347f8
xor ecx, ecx
lea rdx, str.FAIL:_s:_cant_open_adapter:__s_n
mov r9, r12
mov r8, rsi
call dbg.LOG
lea rdx, str.perm
mov rcx, r12
call sym.strstr
test rax, rax
je 0x140034869
lea rdx, str.FAIL:_permission_denied_n
xor ecx, ecx
xor ebx, ebx
call dbg.LOG
lea rdx, str.__hint__need_to_sudo_or_run_as_root_or_something_n
xor ecx, ecx
call dbg.LOG
jmp 0x14003486b
mov r8, rsi
lea rdx, str.pfring:_s:_successfully_enabled_n
mov ecx, 1
call dbg.LOG
jmp 0x14003486b
mov r8, rsi
lea rdx, str.pfring:_s:_direction_success_n
mov ecx, 2
call dbg.LOG
jmp 0x14003495f
cmp eax, 1
je 0x140034b30
cmp eax, 0xc
jne 0x140034b58
nop word [rax + rax]
mov qword [rbx + 8], 0
test ebp, ebp
je 0x14003486b
mov ecx, 0x80000
call qword [rdi + 0xb0]
mov qword [rbx + 8], rax
jmp 0x14003486b
mov ecx, eax
call qword [rdi + pe_nt_image_headers64]
mov r9d, dword [rbx + 0x28]
mov r8, rsi
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea rdx, str.____if__s_:_unknown_data_link_type:__u__s__n
call dbg.LOG
jmp 0x140034b30
mov r8, rsi
lea rdx, str.___if__s_:_VPN_tunnel_interface_found_n
mov ecx, 1
call dbg.LOG
jmp 0x140034b30
lea rdx, str.if:_set_snaplen
call qword [rdi + 0x88]
jmp 0x140034840
mov rcx, qword [rbx]
call qword [rdi + 0x90]
xor ecx, ecx
mov r9d, r12d
mov r8, rsi
mov qword [rsp + 0x20], rax
lea rdx, str.____if__s_:_activate:_d:__s_n
call dbg.LOG
test r12d, r12d
jns 0x1400347f8
jmp 0x140034840
lea rdx, str.if:_set_promisc
call qword [rdi + 0x88]
jmp 0x140034840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor ebx, ebx
mov ecx, dword [rax]
call sym.strerror
mov r8, rsi
lea rdx, str.pfring:_s:_OPEN_ERROR:__s_n
xor ecx, ecx
mov r9, rax
call dbg.LOG
jmp 0x14003486b
mov ecx, 2
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x5f
mov edx, 1
lea rcx, str.No_pfring_adapter_available._Please_install_pfring_or_run_masscan_without_the___pfring_option._n
mov r9, rax
call sym.fwrite
jmp 0x14003486b
lea rdx, str.__hint__VMware_on_Macintosh_doesnt_support_masscan_n
xor ecx, ecx
xor ebx, ebx
call dbg.LOG
jmp 0x14003486b
xor ecx, ecx
lea rdx, str.____FAIL:_permission_denied_n
call dbg.LOG
lea rdx, str._____hint__need_to_sudo_or_run_as_root_or_something_n
xor ecx, ecx
call dbg.LOG
jmp 0x140034840
lea rdx, str.if:_set_timeout
call qword [rdi + 0x88]
jmp 0x140034840
lea rdx, str.if:_set_immediate_mode
call qword [rdi + 0x88]
jmp 0x140034840
mov ecx, 2
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rsi
lea rdx, str.pcap_open_live__s__error:_bad_index_n
mov rcx, rax
call sym.fprintf_1
jmp 0x14003486b