Function at 0x4a3790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e3bee
mov eax, dword fs:[0]
push eax
sub esp, 0x360
mov eax, dword [0x50c7c4]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push esi
push edi
mov eax, dword [0x50c7c4]
xor eax, esp
push eax
lea eax, [esp + 0x370]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebx + 0x1c], 0
lea edi, [ebx + 4]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
je 0x4a37f0
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x378], 0
cmp byte [ebx + 0x20], 0
je 0x4a380b
cmp dword [ebx + 0x34], 0
je 0x4a44a0
mov eax, dword [0x513bec]
mov ecx, 1
test eax, eax
cmovg ecx, eax
mov eax, dword [ebx + 0x78]
shr eax, 0x14
cmp eax, ecx
jge 0x4a3836
call sub.KERNEL32.dll_GetCurrentProcessId
cmp dword [0x513e28], eax
je 0x4a3862
mov dword [0x513e28], eax
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4a3846
push eax
call fcn.004a9dc6
add esp, 4
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0x1f
cmp dword [ebx + 0x6c], 0
jne 0x4a4405
inc dword [ebx + 0x7c]
cmp dword [ebx + 0x7c], 0x20
jne 0x4a44a0
lea eax, [ebp + 0xc]
mov dword [ebx + 0x7c], 0
push eax
lea eax, [esp + 0x1f8]
push eax
call fcn.004a884c
lea ecx, [esp + 0x2c]
call fcn.0049d950
mov byte [esp + 0x378], 1
mov eax, dword [esp + 0x24]
push 0
push 2
mov eax, dword [eax + 4]
mov byte [esp + eax + 0x6c], 0x30
mov eax, dword [0x513e28]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x144]
push eax
call fcn.004a6b27
mov ecx, dword [esp + 0x214]
add esp, 0xc
add ecx, 0x76c
mov dword [esp + 0x18], eax
push ecx
lea ecx, [esp + 0x28]
call fcn.0040f380
mov esi, eax
test esi, esi
jne 0x4a38f0
xor ecx, ecx
jmp 0x4a38f7
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0x14c]
push 0
push 2
push eax
call fcn.004a6b27
mov ecx, dword [esp + 0x210]
add esp, 0xc
inc ecx
mov dword [esp + 0x18], eax
push ecx
mov ecx, esi
call fcn.0040f380
mov esi, eax
test esi, esi
jne 0x4a393b
xor ecx, ecx
jmp 0x4a3942
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0x12c]
push 0
push 2
push eax
call fcn.004a6b27
add esp, 0xc
mov dword [esp + 0x18], eax
mov ecx, esi
push dword [esp + 0x200]
call fcn.0040f380
mov dl, 0x2d
mov ecx, eax
call fcn.0049db70
mov esi, eax
test esi, esi
jne 0x4a398d
xor ecx, ecx
jmp 0x4a3994
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0xec]
push 0
push 2
push eax
call fcn.004a6b27
add esp, 0xc
mov dword [esp + 0x18], eax
mov ecx, esi
push dword [esp + 0x1fc]
call fcn.0040f380
mov esi, eax
test esi, esi
jne 0x4a39d6
xor ecx, ecx
jmp 0x4a39dd
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0xbc]
push 0
push 2
push eax
call fcn.004a6b27
add esp, 0xc
mov dword [esp + 0x18], eax
mov ecx, esi
push dword [esp + 0x1f8]
call fcn.0040f380
mov esi, eax
test esi, esi
jne 0x4a3a1f
xor ecx, ecx
jmp 0x4a3a26
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
push dword [esp + 0x14]
push ecx
push dword [esp + 0x1fc]
mov ecx, esi
call fcn.0040f380
mov dl, 0x2e
mov ecx, eax
call fcn.0049db70
add esp, 4
mov ecx, eax
call fcn.0040f380
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x28]
call fcn.0049db10
mov byte [esp + 0x378], 2
cmp byte [ebx + 0x20], 0
je 0x4a3ad4
lea eax, [esp + 0x218]
mov ecx, ebx
push eax
call fcn.004a3590
test al, al
jne 0x4a4094
push str.Could_not_create_log_file
call fcn.004abafb
add esp, 4
lea eax, [esp + 0x218]
cmp dword [esp + 0x22c], 0x10
cmovae eax, dword [esp + 0x218]
push eax
push str.COULD_NOT_CREATE_LOGFILE__s__n
call fcn.004a9128
add eax, 0x40
push eax
call fcn.004ac28c
add esp, 0xc
jmp 0x4a3fa3
mov eax, dword [0x511f14]
mov ecx, str.UNKNOWN
test eax, eax
cmovne ecx, eax
push ecx
lea ecx, [esp + 0x264]
call fcn.00403030
mov dword [esp + 0x25c], 0xf
mov dword [esp + 0x258], 0
mov byte [esp + 0x248], 0
lea ecx, [esp + 0x248]
mov byte [esp + 0x378], 4
call fcn.004a2910
push 0xffffffffffffffff
push 0
push 0x50ee74
lea ecx, [esp + 0x23c]
mov dword [esp + 0x250], 0xf
mov dword [esp + 0x24c], 0
mov byte [esp + 0x23c], 0
call fcn.00403430
mov byte [esp + 0x378], 5
cmp dword [esp + 0x240], 0
jne 0x4a3b78
push str.invalid_user
lea ecx, [esp + 0x234]
call fcn.00419000
push ecx
lea edx, [esp + 0x264]
lea ecx, [esp + 0x33c]
call fcn.004a5650
add esp, 4
lea ecx, [esp + 0x248]
mov byte [esp + 0x378], 6
push ecx
mov edx, eax
lea ecx, [esp + 0x294]
call fcn.00419d80
mov edx, eax
mov byte [esp + 0x37c], 7
lea ecx, [esp + 0x2c4]
call fcn.004a5700
add esp, 4
lea ecx, [esp + 0x230]
mov byte [esp + 0x378], 8
push ecx
mov edx, eax
lea ecx, [esp + 0x30c]
call fcn.00419d80
add esp, 4
push str..log.
mov edx, eax
mov byte [esp + 0x37c], 9
lea ecx, [esp + 0x324]
call fcn.00403c80
add esp, 4
mov byte [esp + 0x378], 0xa
mov edx, eax
mov ecx, dword [ebx + 0x70]
push dword [ecx*4 + 0x4f3c10]
lea ecx, [esp + 0x2f4]
call fcn.00403c80
mov edx, eax
mov byte [esp + 0x37c], 0xb
lea ecx, [esp + 0x2dc]
call fcn.004a5700
add esp, 4
lea ecx, [esp + 0x260]
push eax
call fcn.00406f30
cmp dword [esp + 0x2ec], 0x10
jb 0x4a3c64
push dword [esp + 0x2d8]
call fcn.004a78e3
add esp, 4
cmp dword [esp + 0x304], 0x10
mov dword [esp + 0x2ec], 0xf
mov dword [esp + 0x2e8], 0
mov byte [esp + 0x2d8], 0
jb 0x4a3c9b
push dword [esp + 0x2f0]
call fcn.004a78e3
add esp, 4
cmp dword [esp + 0x334], 0x10
mov dword [esp + 0x304], 0xf
mov dword [esp + 0x300], 0
mov byte [esp + 0x2f0], 0
jb 0x4a3cd2
push dword [esp + 0x320]
call fcn.004a78e3
add esp, 4
cmp dword [esp + 0x31c], 0x10
mov dword [esp + 0x334], 0xf
mov dword [esp + 0x330], 0
mov byte [esp + 0x320], 0
jb 0x4a3d09
push dword [esp + 0x308]
call fcn.004a78e3
add esp, 4
cmp dword [esp + 0x2d4], 0x10
mov dword [esp + 0x31c], 0xf
mov dword [esp + 0x318], 0
mov byte [esp + 0x308], 0
jb 0x4a3d40
push dword [esp + 0x2c0]
call fcn.004a78e3
add esp, 4
cmp dword [esp + 0x2a4], 0x10
mov dword [esp + 0x2d4], 0xf
mov dword [esp + 0x2d0], 0
mov byte [esp + 0x2c0], 0
jb 0x4a3d77
push dword [esp + 0x290]
call fcn.004a78e3
add esp, 4
mov byte [esp + 0x378], 5
cmp dword [esp + 0x34c], 0x10
mov dword [esp + 0x2a4], 0xf
mov dword [esp + 0x2a0], 0
mov byte [esp + 0x290], 0
jb 0x4a3db6
push dword [esp + 0x338]
call fcn.004a78e3
add esp, 4
call fcn.004a5310
mov dword [esp + 0x18], eax
mov esi, dword [eax]
cmp esi, dword [eax + 4]
je 0x4a3ec3
lea ebx, [ebx]
push 0x4f4064
mov edx, esi
lea ecx, [esp + 0x354]
call fcn.0040a550
add esp, 4
lea ecx, [esp + 0x260]
mov byte [esp + 0x378], 0xc
push ecx
mov edx, eax
lea ecx, [esp + 0x2ac]
call fcn.00419d80
mov ecx, eax
add esp, 4
lea eax, [ebx + 0x24]
mov dword [esp + 0x14], ecx
cmp eax, ecx
je 0x4a3e44
cmp dword [eax + 0x14], 0x10
jb 0x4a3e2b
push dword [eax]
call fcn.004a78e3
mov ecx, dword [esp + 0x18]
lea eax, [ebx + 0x24]
add esp, 4
push ecx
mov dword [eax + 0x14], 0xf
mov ecx, eax
mov dword [eax + 0x10], 0
mov byte [eax], 0
call fcn.00403310
cmp dword [esp + 0x2bc], 0x10
jb 0x4a3e5d
push dword [esp + 0x2a8]
call fcn.004a78e3
add esp, 4
mov byte [esp + 0x378], 5
cmp dword [esp + 0x364], 0x10
mov dword [esp + 0x2bc], 0xf
mov dword [esp + 0x2b8], 0
mov byte [esp + 0x2a8], 0
jb 0x4a3e9c
push dword [esp + 0x350]
call fcn.004a78e3
add esp, 4
lea eax, [esp + 0x218]
mov ecx, ebx
push eax
call fcn.004a3590
test al, al
jne 0x4a4005
mov eax, dword [esp + 0x18]
add esi, 0x18
cmp esi, dword [eax + 4]
jne 0x4a3dd0
push str.Could_not_create_logging_file
call fcn.004abafb
add esp, 4
lea eax, [esp + 0x218]
cmp dword [esp + 0x22c], 0x10
cmovae eax, dword [esp + 0x218]
push eax
push str.COULD_NOT_CREATE_A_LOGGINGFILE__s_
call fcn.004a9128
add eax, 0x40
push eax
call fcn.004ac28c
add esp, 0xc
cmp dword [esp + 0x244], 0x10
jb 0x4a3f17
push dword [esp + 0x230]
call fcn.004a78e3
add esp, 4
cmp dword [esp + 0x25c], 0x10
mov dword [esp + 0x244], 0xf
mov dword [esp + 0x240], 0
mov byte [esp + 0x230], 0
jb 0x4a3f4e
push dword [esp + 0x248]
call fcn.004a78e3
add esp, 4
cmp dword [esp + 0x274], 0x10
mov dword [esp + 0x25c], 0xf
mov dword [esp + 0x258], 0
mov byte [esp + 0x248], 0
jb 0x4a3f85
push dword [esp + 0x260]
call fcn.004a78e3
add esp, 4
mov dword [esp + 0x274], 0xf
mov dword [esp + 0x270], 0
mov byte [esp + 0x260], 0
cmp dword [esp + 0x22c], 0x10
jb 0x4a3fbc
push dword [esp + 0x218]
call fcn.004a78e3
add esp, 4
lea ecx, [esp + 0x74]
mov dword [esp + 0x22c], 0xf
mov dword [esp + 0x228], 0
mov byte [esp + 0x218], 0
mov byte [esp + 0x378], 0
call fcn.0049da90
lea eax, [esp + 0x74]
mov dword [esp + 0x74], vtable.std::ios_base.0
push eax
call fcn.004a6211
add esp, 4
jmp 0x4a44a0
cmp dword [esp + 0x244], 0x10
jb 0x4a401e
push dword [esp + 0x230]
call fcn.004a78e3
add esp, 4
cmp dword [esp + 0x25c], 0x10
mov dword [esp + 0x244], 0xf
mov dword [esp + 0x240], 0
mov byte [esp + 0x230], 0
jb 0x4a4055
push dword [esp + 0x248]
call fcn.004a78e3
add esp, 4
mov byte [esp + 0x378], 2
cmp dword [esp + 0x274], 0x10
mov dword [esp + 0x25c], 0xf
mov dword [esp + 0x258], 0
mov byte [esp + 0x248], 0
jb 0x4a4094
push dword [esp + 0x260]
call fcn.004a78e3
add esp, 4
sub esp, 8
lea ecx, [esp + 0x164]
call fcn.0049d950
mov byte [esp + 0x378], 0xd
cmp dword [0x50ee68], 0
mov eax, dword [esp + 0x15c]
mov eax, dword [eax + 4]
mov byte [esp + eax + 0x19c], 0x30
jne 0x4a40ea
mov ecx, 0x50ee58
call fcn.004a2910
cmp dword [0x50ee68], 0
jne 0x4a40ea
push 9
push str._unknown_
mov ecx, 0x50ee58
call fcn.00403860
push 0
lea eax, [esp + 0x110]
push 2
push eax
call fcn.004a6b27
mov ecx, dword [esp + 0x214]
add esp, 0xc
add ecx, 0x76c
mov dword [esp + 0x14], eax
mov edx, str.Log_file_created_at:
push ecx
push ecx
lea ecx, [esp + 0x164]
call fcn.00403cd0
add esp, 4
mov ecx, eax
call fcn.0040f380
mov dl, 0x2f
mov ecx, eax
call fcn.0049db70
mov esi, eax
test esi, esi
jne 0x4a413f
xor ecx, ecx
jmp 0x4a4146
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x14]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0x11c]
push 0
push 2
push eax
call fcn.004a6b27
mov ecx, dword [esp + 0x210]
add esp, 0xc
inc ecx
mov dword [esp + 0x14], eax
push ecx
mov ecx, esi
call fcn.0040f380
mov dl, 0x2f
mov ecx, eax
call fcn.0049db70
mov esi, eax
test esi, esi
jne 0x4a4193
xor ecx, ecx
jmp 0x4a419a
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x14]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0xcc]
push 0
push 2
push eax
call fcn.004a6b27
add esp, 0xc
mov dword [esp + 0x14], eax
mov ecx, esi
push dword [esp + 0x200]
call fcn.0040f380
mov dl, 0x20
mov ecx, eax
call fcn.0049db70
mov esi, eax
test esi, esi
jne 0x4a41e5
xor ecx, ecx
jmp 0x4a41ec
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x14]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0xdc]
push 0
push 2
push eax
call fcn.004a6b27
add esp, 0xc
mov dword [esp + 0x14], eax
mov ecx, esi
push dword [esp + 0x1fc]
call fcn.0040f380
mov dl, 0x3a
mov ecx, eax
call fcn.0049db70
mov esi, eax
test esi, esi
jne 0x4a4237
xor ecx, ecx
jmp 0x4a423e
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x14]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0xfc]
push 0
push 2
push eax
call fcn.004a6b27
add esp, 0xc
mov dword [esp + 0x14], eax
mov ecx, esi
push dword [esp + 0x1f8]
call fcn.0040f380
mov dl, 0x3a
mov ecx, eax
call fcn.0049db70
mov esi, eax
test esi, esi
jne 0x4a4289
xor ecx, ecx
jmp 0x4a4290
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [esp + 0x14]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [eax]
push ecx
call eax
add esp, 0xc
mov ecx, esi
push dword [esp + 0x1f4]
call fcn.0040f380
mov dl, 0xa
mov ecx, eax
call fcn.0049db70
mov edx, str.Running_on_machine:
mov ecx, eax
call fcn.00403cd0
mov edx, 0x50ee58
mov ecx, eax
call fcn.0040a2f0
mov dl, 0xa
mov ecx, eax
call fcn.0049db70
mov edx, str.Log_line_format:__IWEF_mmdd_hh:mm:ss.uuuuuu
mov ecx, eax
call fcn.00403cd0
mov edx, str.threadid_file:line__msg
mov ecx, eax
call fcn.00403cd0
mov dl, 0xa
mov ecx, eax
call fcn.0049db70
lea eax, [esp + 0x278]
push eax
lea ecx, [esp + 0x160]
call fcn.0049db10
push dword [ebx + 0x6c]
mov esi, dword [esp + 0x28c]
lea eax, [esp + 0x27c]
cmp dword [esp + 0x290], 0x10
push esi
cmovae eax, dword [esp + 0x280]
push 1
push eax
call fcn.004a9cd8
add dword [ebx + 0x78], esi
add esp, 0x10
add dword [ebx + 0x74], esi
cmp dword [esp + 0x28c], 0x10
jb 0x4a435b
push dword [esp + 0x278]
call fcn.004a78e3
add esp, 4
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x28c], 0xf
mov dword [esp + 0x288], 0
mov byte [esp + 0x278], 0
mov byte [esp + 0x378], 2
call fcn.0049da90
lea eax, [esp + 0x1ac]
mov dword [esp + method.std::ios_base.virtual_0], vtable.std::ios_base.0
push eax
call fcn.004a6211
add esp, 4
cmp dword [esp + 0x22c], 0x10
jb 0x4a43c1
push dword [esp + 0x218]
call fcn.004a78e3
add esp, 4
lea ecx, [esp + 0x74]
mov dword [esp + 0x22c], 0xf
mov dword [esp + 0x228], 0
mov byte [esp + 0x218], 0
mov byte [esp + 0x378], 0
call fcn.0049da90
lea eax, [esp + 0x74]
mov dword [esp + 0x74], vtable.std::ios_base.0
push eax
call fcn.004a6211
add esp, 4
cmp byte [0x511d72], 0
jne 0x4a4482
call fcn.004ab03e
mov esi, dword [ebp + 0x18]
mov dword [eax], 0
push dword [ebx + 0x6c]
push esi
push 1
push dword [esp + 0x2c]
call fcn.004a9cd8
add esp, 0x10
cmp byte [0x513c0c], 0
je 0x4a444a
call fcn.004ab03e
cmp dword [eax], 0x1c
jne 0x4a444a
mov byte [0x511d72], 1
jmp 0x4a44a0
mov eax, dword [ebx + 0x74]
add dword [ebx + 0x78], esi
add eax, esi
cmp byte [ebp + 8], 0
mov dword [ebx + 0x74], eax
jne 0x4a4479
cmp eax, 0xf4240
jae 0x4a4479
call fcn.004a5730
cmp edx, dword [ebx + 0x84]
jl 0x4a44a0
jg 0x4a4479
cmp eax, dword [ebx + 0x80]
jb 0x4a44a0
mov ecx, ebx
call fcn.004a3530
jmp 0x4a44a0
call fcn.004a5730
cmp edx, dword [ebx + 0x84]
jl 0x4a44a0
jg 0x4a4499
cmp eax, dword [ebx + 0x80]
jb 0x4a44a0
mov byte [0x511d72], 0
cmp byte [edi + 0x18], 0
je 0x4a44b0
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x370]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret 0x14