Function at 0x10023b80
Capabilities:
Print debug messages
Query environment variable
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x308
mov rax, qword [0x10058650]
mov qword [rsp + 0x2c0], rax
test rcx, rcx
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov r12, qword [rsp + 0x330]
mov rbp, r9
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
je 0x10023bd4
mov rcx, qword [rcx]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x2d8], r13
lea r13, [0x1005ba90]
xor edx, edx
mov rcx, r13
mov r8d, 0x1388
call sub.msvcrt.dll_memset
mov r8, r12
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.msvcrt.dll_vsprintf]
lea rcx, [rsi + 0x34c]
xor edx, edx
mov r8d, 0x1400
call sub.msvcrt.dll_memset
xor r11d, r11d
lea rcx, [0x1005ba80]
mov qword [0x1005ba80], r11
mov qword [0x1005ba88], r11
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [0x1005ba8a]
movzx r8d, word [0x1005ba86]
movzx r9d, word [0x1005ba82]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rbx
lea rax, [rdi + rdi*2]
movzx edi, word [0x1005ba88]
lea rcx, [0x100489e8]
lea rcx, [rcx + rax*2]
movzx eax, word [0x1005ba8c]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r8d
lea rcx, [rsi + 0x34c]
lea r8, str.__02u__02u__02u:_02u:_02u___s___s__s_r_n
mov edx, 0x1388
call fcn.1001fe60
lea rcx, [rsi + 0x34c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x1b0]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xa0], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0xa0]
lea rcx, [0x10048a48]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rcx, [0x10048a38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x10048a20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, qword [rsp + 0x2d8]
test rax, rax
je 0x10023d63
lea rcx, [rsp + 0x68]
call rax
cmp word [rsp + 0x68], 9
jne 0x10023d63
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0xa0]
lea rcx, [0x10048a58]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea r9, [rsp + 0xa0]
lea r8, [0x10048a70]
lea rcx, [rsp + 0x1b0]
mov edx, 0x104
call fcn.1001fe60
lea r9, [rsp + 0x1b0]
lea r8, str._s_vpn.log
lea rcx, [rsp + 0x1b0]
mov edx, 0x104
call fcn.1001fe60
xor r12d, r12d
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x10023e54
lea r9d, [r12 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x500000
jbe 0x10023e18
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
lea rdi, [rsi + 0x34c]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea r9, [rsp + 0x60]
lea rdx, [rsi + 0x34c]
not rcx
mov qword [rsp + 0x20], r12
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
mov r12, qword [rsp + 0x2e0]
mov rdi, qword [rsp + 0x2e8]
mov rbp, qword [rsp + 0x2f8]
mov rbx, qword [rsp + 0x300]
je 0x10023e82
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x2c0]
call fcn.10042170
add rsp, 0x308
ret