Function at 0x14002c93e
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
cmp dword [rbp + 0x20], 0
jle 0x14002c9d6
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x20]
cdqe
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp - 0x18], rax
cmp dword [rbp + 0x10], 2
jne 0x14002c99a
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x10], 0
jle 0x14002c9d9
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
add qword [rbp - 8], rax
mov rax, qword [rbp - 0x20]
sub qword [rbp - 0x10], rax
jmp 0x14002c99a
nop
jmp 0x14002c9da
nop
add rsp, 0x40
pop rbp
ret

Function at 0x140048f24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xa0]
mov qword [rbp + 0x20], rcx
mov rbx, rdx
mov byte [rbp - 1], 0
mov byte [rbp - 0x40], 0x30
mov byte [rbp - 0x3f], 0x30
mov byte [rbp - 0x3e], 0x30
mov byte [rbp - 0x3d], 0x30
mov byte [rbp - 0x3c], 0x2d
mov byte [rbp - 0x3b], 0x30
mov byte [rbp - 0x3a], 0x30
mov byte [rbp - 0x39], 0x2d
mov byte [rbp - 0x38], 0x30
mov byte [rbp - 0x37], 0x30
mov byte [rbp - 0x36], 0x20
mov byte [rbp - 0x35], 0x30
mov byte [rbp - 0x34], 0x30
mov byte [rbp - 0x33], 0x3a
mov byte [rbp - 0x32], 0x30
mov byte [rbp - 0x31], 0x30
lea rax, [rbp - 0x70]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0x10
mov edx, 0x10
mov rcx, rax
call sym.new_array_from_c_array_noscan
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov byte [rbp - 1], 1
mov eax, dword [rbx + 8]
lea rdx, [rbp - 0x30]
mov r8d, 4
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0xc]
lea rdx, [rbp - 0x30]
mov r8d, 7
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x10]
lea rdx, [rbp - 0x30]
mov r8d, 0xa
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x14]
lea rdx, [rbp - 0x30]
mov r8d, 0xd
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x18]
lea rdx, [rbp - 0x30]
mov r8d, 0x10
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea rax, [rbp - 0x70]
mov rdx, rax
call sym.Array_u8_bytestr
cmp byte [rbp - 1], 0
je 0x140049070
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.array_free
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp + 0x20]
add rsp, 0xa8
pop rbx
pop rbp
ret