Function at 0x10008c90
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10026bb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x814
push esi
push edi
xor esi, esi
mov dword [esp + 0x824], esi
mov eax, dword [0x10030f6c]
mov dword [esp + 8], eax
push 0x400
push 0x400
lea ecx, [esp + 0x10]
mov byte [esp + 0x82c], 2
call fcn.1001f508
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.1001f558
push 0x5c
lea ecx, [esp + 0xc]
call fcn.1001e450
inc eax
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.1001e3d8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x828], 3
call fcn.1001f270
lea ecx, [esp + 0x10]
mov byte [esp + 0x824], 2
call fcn.1001f129
push 0x10030c88
lea ecx, [esp + 0xc]
call fcn.1001f4b4
mov edx, dword [esp + 8]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], si
push esi
rep stosd dword es:[edi], eax
push 0x80
push 4
push esi
push 1
push 0x40000000
push edx
stosw word es:[edi], ax
mov word [esp + 0x30], 0xd
mov word [esp + 0x32], 0xa
mov word [esp + 0x34], si
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10008f7f
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xb7
jne 0x10008dcc
push 0
push 0
push 0x1a
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x14]
push 0
push eax
push 1
push 0x10030c84
push esi
call edi
push 2
push 0
push 0xffffffffffffffee
push esi
call ebx
jmp 0x10008e3f
push 0xfe
push 0xff
lea ecx, [esp + 0x2c]
push str._C_C
push ecx
call fcn.1000cd6c
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x14]
not ecx
push 0
dec ecx
push edx
lea eax, [esp + 0x2c]
push ecx
push eax
push esi
call edi
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push str._logs_sync_1___s
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push 0
push eax
push ecx
call fcn.1000d3a2
add esp, 4
lea edx, [esp + 0x2c]
shl eax, 1
push eax
push edx
push esi
call edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
call fcn.1000e03c
mov eax, dword [esp + 0x840]
add esp, 4
cmp eax, 0xffffffff
jne 0x10008eb5
lea ecx, [esp + 0x1c]
push ecx
push 0
lea ecx, [esp + 0x840]
call fcn.1001f508
mov ecx, dword [esp + 0x838]
xor edx, edx
test ecx, ecx
push eax
mov eax, dword [esp + 0x20]
setne dl
push edx
push eax
lea ecx, [esp + 0x34]
push str._log_time__d__status__d____s___log__s
push ecx
call ebp
add esp, 0x18
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push 0
push edx
push eax
call fcn.1000d3a2
add esp, 4
lea ecx, [esp + 0x2c]
shl eax, 1
push eax
push ecx
jmp 0x10008f1f
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x838]
push edx
push 0
call fcn.1001f508
push eax
push 0
lea ecx, [esp + 0x84c]
call fcn.1001f508
push eax
mov eax, dword [esp + 0x848]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x844]
xor ecx, ecx
test eax, eax
setne cl
push ecx
push edx
lea eax, [esp + 0x3c]
push str._log_time__d__status__d__type__d__name__s____s___log__s
push eax
call ebp
add esp, 0x20
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push 0
push ecx
push edx
call fcn.1000d3a2
add esp, 4
shl eax, 1
push eax
lea eax, [esp + 0x30]
push eax
push esi
call edi
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push 0x10030b7c
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push 0
push eax
push ecx
call fcn.1000d3a2
add esp, 4
lea edx, [esp + 0x2c]
shl eax, 1
push eax
push edx
push esi
call edi
push 0
push 0
push 0x1a
push esi
call ebx
lea eax, [esp + 0x14]
push 0
push eax
push 1
push 0x10030b78
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
lea ecx, [esp + 8]
mov byte [esp + 0x824], 1
call fcn.1001f129
lea ecx, [esp + 0x830]
mov byte [esp + 0x824], 0
call fcn.1001f129
lea ecx, [esp + 0x838]
mov dword [esp + 0x824], 0xffffffff
call fcn.1001f129
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x820
ret