Function at 0x1400093f0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
test rdx, rdx
je 0x140009a09
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
mov qword [rbp - 0x61], 0xfffffffffffffffe
mov rax, qword [0x1402bb8e8]
xor rax, rsp
mov qword [rbp + 7], rax
mov rdi, r9
mov qword [rbp - 0x71], r9
mov r12, r8
mov rbx, rdx
mov qword [rsp + 0x40], rdx
mov r15, rcx
xor r13d, r13d
mov rcx, rdx
call fcn.14000e14c
mov rcx, rax
call fcn.1401c9048
test rax, rax
jne 0x140009461
cmp qword [r15 + 0x360], r13
je 0x1400099ea
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14000946f
mov ecx, dword [rax + 0x28]
jmp 0x140009472
mov ecx, r13d
movzx esi, word [rbx + 0x10]
shl esi, 0xa
test esi, esi
je 0x140009485
cmp ecx, esi
jae 0x1400099ea
mov rcx, rbx
call fcn.14000e14c
mov rdx, rax
call fcn.140009208
mov r14, rax
mov rax, qword [r15 + 0x90]
test rax, rax
je 0x1400094b3
mov rax, qword [rax + 0x18]
test rax, rax
je 0x1400094b3
lea rbx, [rax + 0x30]
jmp 0x1400094be
mov rbx, qword [r15 + 0xe0]
add rbx, 0x28
mov qword [rsp + 0x38], rbx
test r12, r12
je 0x1400094d3
mov rcx, r12
call fcn.1401c9048
mov r13, rax
mov rcx, rbx
call fcn.140004420
xor ecx, ecx
cmp qword [rax], rcx
mov ebx, ecx
jbe 0x1400094e6
mov ebx, dword [rax]
mov dword [rsp + 0x34], ebx
test rdi, rdi
jne 0x1400094f3
mov eax, ecx
jmp 0x1400094fb
mov rcx, rdi
call fcn.1401c9048
mov qword [rbp - 0x79], rax
lea ecx, [rax + rbx]
lea eax, [r13 + 3]
add eax, ecx
mov dword [rsp + 0x48], eax
mov rbx, qword [r15 + 0x360]
test rbx, rbx
je 0x14000953d
mov rcx, qword [rsp + 0x38]
call fcn.1400044e0
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x14000952f
mov r8, qword [rax]
mov rax, qword [rbx]
mov r9, rdi
mov rdx, r12
mov rcx, rbx
call qword [rax]
or rdi, 0xffffffffffffffff
cmp r14, rdi
je 0x140009747
lea r9d, [rdi + 3]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
test esi, esi
je 0x14000956a
cmp eax, esi
jae 0x140009739
mov rdx, r14
mov rcx, r15
call fcn.1400092a8
add ebx, eax
test r13d, r13d
je 0x1400095a7
lea r8d, [r13*2]
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400095aa
add ebx, dword [rsp + 0x30]
jmp 0x1400095aa
xor r13d, r13d
mov r12d, dword [rsp + 0x34]
test r12d, r12d
je 0x1400095ea
mov rcx, qword [rsp + 0x38]
call fcn.1400044e0
cmp qword [rax + 0x18], 8
jb 0x1400095c8
mov rax, qword [rax]
lea r8d, [r12 + r12]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400095ea
add ebx, dword [rsp + 0x30]
mov rax, qword [rbp - 0x79]
test eax, eax
je 0x14000963d
lea r8d, [rax + rax]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov rdx, qword [rbp - 0x71]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140009615
add ebx, dword [rsp + 0x30]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov r8d, 4
lea rdx, [0x140270d40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000963d
add ebx, dword [rsp + 0x30]
test esi, esi
je 0x140009728
cmp ebx, esi
jb 0x140009728
xor r8d, r8d
mov edx, 0x80
lea rcx, [rbp - 0x39]
call fcn.14000b99c
nop
lea rcx, [r15 + 8]
call fcn.1400044e0
cmp qword [rax + 0x18], 8
jb 0x140009672
mov rax, qword [rax]
lea rsi, [r15 + 0x110]
mov r9, rax
lea r8, str._FILE_SIZE_LIMIT_REACHED__LOGGING_DISABLED_FOR__s_MODULE_
mov edx, 0x104
mov rcx, rsi
call fcn.14000512c
cmp word [rsi], r13w
jne 0x14000969b
mov rdi, r13
jmp 0x1400096a5
inc rdi
cmp word [rsi + rdi*2], r13w
jne 0x14000969b
mov r8, rdi
mov rdx, rsi
lea rcx, [rbp - 0x39]
call fcn.140004880
lea rcx, [rbp - 0x39]
call fcn.140004420
mov rcx, qword [rax]
lea edi, [rcx + rcx]
mov dword [rsp + 0x30], edi
lea rcx, [rbp - 0x39]
call fcn.1400044e0
cmp qword [rax + 0x18], 8
jb 0x1400096da
mov rax, qword [rax]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov r8d, edi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400096fb
add ebx, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov eax, dword [rdi + 0x10]
mov ecx, 0x30000
and eax, ecx
cmp eax, ecx
jne 0x14000971d
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x14000971d
mov byte [rax], 1
mov ebx, r13d
lea rcx, [rbp - 0x39]
call fcn.140004af0
jmp 0x14000972d
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x140009739
mov dword [rax + 0x28], ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400099ea
lea rcx, [rbp - 0x59]
call fcn.1400049d0
lea rcx, [rbp - 0x59]
call fcn.140004a50
mov qword [rbp - 0x69], rax
mov qword [rax], 7
lea rcx, [rbp - 0x59]
call fcn.1400044e0
mov rbx, rax
xor eax, eax
mov word [rsp + 0x30], ax
mov qword [rbx + 0x10], rax
cmp qword [rbx + 0x18], 8
jb 0x140009787
mov rcx, qword [rbx]
jmp 0x14000978a
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.140004a60
nop
mov esi, dword [rsp + 0x48]
lea rcx, [rbp - 0x59]
call fcn.140004420
mov r14, qword [rax]
cmp r14, rsi
ja 0x1400097ea
mov rax, qword [rbp - 0x69]
cmp qword [rax], rsi
je 0x1400097ea
mov r8b, 1
mov edx, esi
lea rcx, [rbp - 0x59]
call fcn.1400047f0
xor esi, esi
test al, al
je 0x1400097ec
mov word [rsp + 0x30], si
mov qword [rbx + 0x10], r14
cmp qword [rbx + 0x18], 8
jb 0x1400097da
mov rbx, qword [rbx]
lea rcx, [rbx + r14*2]
lea rdx, [rsp + 0x30]
call fcn.140004a60
jmp 0x1400097ec
xor esi, esi
cmp qword [r15 + 0x358], rsi
jne 0x14000981f
lea rdx, str.____Queued_Lines_Start_____r_n
lea rcx, [rbp - 0x19]
call fcn.1400043a0
nop
lea rcx, [r15 + 0x338]
mov rdx, rax
call fcn.14000b5e0
nop
lea rcx, [rbp - 0x19]
call fcn.140004af0
test r13d, r13d
je 0x140009849
cmp word [r12], si
jne 0x140009830
mov r8, rsi
jmp 0x14000983d
mov r8, rdi
inc r8
cmp word [r12 + r8*2], si
jne 0x140009833
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.140005e00
mov r12d, dword [rsp + 0x34]
test r12d, r12d
je 0x140009867
mov r9, rdi
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x59]
call fcn.140006034
mov rax, qword [rbp - 0x79]
test eax, eax
je 0x140009892
mov rdx, qword [rbp - 0x71]
cmp word [rdx], si
jne 0x14000987d
mov rdi, rsi
jmp 0x140009886
inc rdi
cmp word [rdx + rdi*2], si
jne 0x14000987d
mov r8, rdi
lea rcx, [rbp - 0x59]
call fcn.140005e00
mov r8d, 2
lea rdx, [0x140270d40]
lea rcx, [rbp - 0x59]
call fcn.140005e00
lea rbx, [r15 + 0x338]
mov rax, qword [rbx + 0x20]
inc rax
cmp qword [rbx + 0x10], rax
ja 0x1400098c4
mov rcx, rbx
call fcn.14000c280
mov rax, qword [rbx + 0x10]
dec rax
and qword [rbx + 0x18], rax
mov rdx, qword [rbx + 0x18]
add rdx, qword [rbx + 0x20]
mov rdi, qword [rbx + 0x10]
dec rdi
and rdi, rdx
mov rax, qword [rbx + 8]
cmp qword [rax + rdi*8], rsi
jne 0x140009903
mov r8b, 1
mov edx, 0x20
lea ecx, [rdx - 0x1f]
call fcn.140004080
mov rcx, qword [rbx + 8]
mov qword [rcx + rdi*8], rax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + rdi*8]
mov qword [rbp - 0x69], rcx
mov qword [rbp - 0x71], rcx
test rcx, rcx
je 0x140009922
lea rdx, [rbp - 0x59]
call fcn.14000ba18
nop
inc qword [rbx + 0x20]
lea rcx, [rbp - 0x39]
call fcn.1400049d0
lea rcx, [rbp - 0x39]
call fcn.140004a50
mov qword [rax], 7
lea rcx, [rbp - 0x39]
call fcn.1400044e0
mov word [rsp + 0x30], si
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 8
jb 0x14000995b
mov rax, qword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140004a60
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rcx, r15
call fcn.14000abec
lea rcx, str.Unable_to_open_log_file:_r_n_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
call fcn.14000e14c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x140270dc0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rbp - 0x39]
call fcn.1400044e0
cmp qword [rax + 0x18], 8
jb 0x1400099c0
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x140270d40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rbp - 0x39]
call fcn.140004af0
nop
lea rcx, [rbp - 0x59]
call fcn.140004af0
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1401c44c0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret