rev

IDA x64로 열어준다.

main 함수는 아래와 같다.

; Attributes: noreturn bp-based frame

; int __cdecl main(int argc, const char **argv, const char **envp)
public main
main proc near

var_80= qword ptr -80h
var_74= dword ptr -74h
var_70= qword ptr -70h
var_68= qword ptr -68h
var_60= qword ptr -60h
var_58= qword ptr -58h
var_50= qword ptr -50h
var_48= qword ptr -48h
var_40= qword ptr -40h
var_38= qword ptr -38h
var_30= qword ptr -30h
var_28= qword ptr -28h
var_20= qword ptr -20h
var_18= qword ptr -18h
var_10= qword ptr -10h
var_8= qword ptr -8

; __unwind {
endbr64
push    rbp
mov     rbp, rsp
add     rsp, 0FFFFFFFFFFFFFF80h
mov     [rbp+var_74], edi
mov     [rbp+var_80], rsi
mov     rax, cs:defaultRtsConfig
mov     rdx, cs:qword_4AA1A8
mov     [rbp+var_70], rax
mov     [rbp+var_68], rdx
mov     rax, cs:qword_4AA1B0
mov     rdx, cs:qword_4AA1B8
mov     [rbp+var_60], rax
mov     [rbp+var_58], rdx
mov     rax, cs:qword_4AA1C0
mov     rdx, cs:off_4AA1C8
mov     [rbp+var_50], rax
mov     [rbp+var_48], rdx
mov     rax, cs:off_4AA1D0
mov     rdx, cs:off_4AA1D8
mov     [rbp+var_40], rax
mov     [rbp+var_38], rdx
mov     rax, cs:off_4AA1E0
mov     rdx, cs:off_4AA1E8
mov     [rbp+var_30], rax
mov     [rbp+var_28], rdx
mov     rax, cs:off_4AA1F0
mov     rdx, cs:qword_4AA1F8
mov     [rbp+var_20], rax
mov     [rbp+var_18], rdx
mov     rax, cs:off_4AA200
mov     rdx, cs:off_4AA208
mov     [rbp+var_10], rax
mov     [rbp+var_8], rdx
mov     dword ptr [rbp+var_70], 3
mov     [rbp+var_68], 1
mov     [rbp+var_50], 0
mov     [rbp+var_58], 1
mov     rcx, [rbp+var_80]
mov     eax, [rbp+var_74]
push    [rbp+var_8]
push    [rbp+var_10]
push    [rbp+var_18]
push    [rbp+var_20]
push    [rbp+var_28]
push    [rbp+var_30]
push    [rbp+var_38]
push    [rbp+var_40]
push    [rbp+var_48]
push    [rbp+var_50]
push    [rbp+var_58]
push    [rbp+var_60]
push    [rbp+var_68]
push    [rbp+var_70]
mov     edx, offset ZCMain_main_closure
mov     rsi, rcx
mov     edi, eax
call    hs_main
; } // starts at 40A10C
main endp