Function at 0x424820
Capabilities:
Create directory
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542395
mov eax, dword fs:[0]
push eax
sub esp, 0x51c
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x58b4bc], 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x504], ebx
mov dword [ebp - 0x4f8], eax
jne 0x42487f
push str.Logging_Diagnostic_system_not_ready_or_was_shutdown
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ead
cmp edi, dword [0x587300]
jg 0x424ead
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x58b4a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x38
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00516d20
push 0x80
lea eax, [ebp - 0xc8]
push 0
push eax
call fcn.00516d20
movzx eax, word [ebp - 0x4da]
push eax
movzx eax, word [ebp - 0x4dc]
push eax
movzx eax, word [ebp - 0x4de]
push eax
movzx eax, word [ebp - 0x4e0]
push eax
movzx eax, word [ebp - 0x4e8]
push eax
movzx eax, word [ebp - 0x4e2]
push eax
movzx eax, word [ebp - 0x4e6]
push eax
lea eax, [ebp - 0x48]
push str._02d__02d__04d__d:_02d:_02d._04d
push eax
call fcn.0042b210
add esp, 0x3c
test eax, eax
jg 0x424927
push str.Date_Time_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ea2
mov ecx, edi
call fcn.00424370
mov ecx, dword [ebp - 0x4f8]
mov edi, str.Unknown:
mov dword [ebp - 0x4ec], eax
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x500]
mov dword [ebp - 0x4fc], ecx
push eax
call fcn.00428610
mov ecx, dword [ebp - 0x500]
cmp ecx, dword [0x58b930]
je 0x42496b
mov edi, dword [ecx + 0x14]
jmp 0x424976
push str.Failed_to_get_module_prefix_from_module_map
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
push dword [ebp - 0x4ec]
lea eax, [ebp - 0xc8]
push ebx
push dword [esi + 0x10]
push str.__lX___s_:__s:__s:
push eax
call fcn.0042b230
add esp, 0x18
test eax, eax
jg 0x4249a9
push str.Suffix_Log_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ea2
lea eax, [ebp - 0xc8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 0x48]
push dword [esi + 4]
push eax
push dword [esi + 8]
push dword [esi]
push str._S__d__:__s__S__lX____s
call fcn.00430ce0
mov edi, eax
add esp, 0x1c
test edi, edi
jg 0x4249e2
push str.Debug_Prefix_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ea2
mov ecx, dword [ebp + 0x18]
lea eax, [ebp + 0x1c]
push eax
call fcn.00430ca0
add esp, 4
test eax, eax
jns 0x424a05
push str.Trace_Msg_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ea2
add eax, 2
add eax, edi
push eax
call fcn.00424200
test al, al
jne 0x424a24
push str.Persist_Buffer_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ea2
mov eax, dword [0x58b93c]
lea ecx, [ebp + 0x1c]
mov ebx, dword [0x58b940]
mov edx, ebx
mov edi, dword [0x58b938]
push ecx
push dword [ebp + 0x18]
mov ecx, eax
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x4f0], edi
call fcn.00430c30
test eax, eax
jns 0x424a65
push str.Format_Trace_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ea2
cmp byte [esi + 0x14], 0
je 0x424a8e
push dword [ebp - 0x4f4]
push dword [ebp - 0x504]
push dword [esi + 0x10]
call fcn.00430b20
mov ecx, eax
call fcn.00426fe0
test al, al
je 0x424ea2
push dword [ebp - 0x4f4]
lea eax, [ebp - 0xc8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 0x48]
push dword [esi + 4]
push eax
push dword [esi + 8]
lea eax, [ebp - 0x4ec]
push dword [esi]
push str._S__d__:__s__S__lX____s_s_r_n
push 0x800
push eax
lea eax, [ebp - 0x508]
push eax
push ebx
push edi
call fcn.00430710
add esp, 0x34
test eax, eax
jns 0x424ae0
push str.Format_Full_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ea2
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x4f4]
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x4ec], 0
push eax
lea eax, [ebp - 0x48]
push eax
push 0x569f78
push 0x800
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x508]
push eax
push ebx
push edi
call fcn.00430710
add esp, 0x24
test eax, eax
jns 0x424b38
push str.Format_Log_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424ea2
mov eax, dword [0x587304]
test eax, eax
jne 0x424b6b
cmp dword [ebp - 0x4f8], eax
je 0x424d38
lea eax, [ebp - 0x4f8]
push eax
lea eax, [ebp - 0x520]
push eax
call fcn.0042d680
mov esi, dword [ebp - 0x520]
jmp 0x424d06
cmp eax, 2
jne 0x424d38
sub esp, 8
mov edx, 0x40000000
push 4
push ecx
push 7
mov ecx, 0x58b6d8
call fcn.00430d00
mov esi, eax
cmp esi, 0xffffffff
jne 0x424c4a
mov ecx, 0xd
lea edi, [ebp - 0x2d0]
mov esi, str._windir_LogsQualysAgent_
lea eax, [ebp - 0x29a]
rep movsd dword es:[edi], dword [esi]
push 0x1d2
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00516d20
add esp, 0xc
lea ecx, [ebp - 0x2d0]
call fcn.004314d0
test eax, eax
jne 0x424ce0
push eax
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x50c]
mov esi, 0x104
push eax
mov edx, esi
lea ecx, [ebp - 0x2d0]
call fcn.00408320
test eax, eax
js 0x424c21
mov eax, dword [ebp - 0x50c]
sub esi, eax
push 0x7fffffff
push str.Log.txt
push ecx
lea ecx, [ebp - 0x2d0]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.00408260
sub esp, 8
mov edx, 0x40000000
push 4
push ecx
push 7
lea ecx, [ebp - 0x2d0]
call fcn.00430d00
mov esi, eax
cmp esi, 0xffffffff
je 0x424ce0
mov edi, dword [ebp - 0x4f0]
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, eax
call fcn.004243d0
test eax, eax
je 0x424c8d
test esi, esi
je 0x424c6d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00425160
sub esp, 8
mov edx, 0x40000000
push 2
push ecx
push 7
mov ecx, 0x58b6d8
call fcn.00430d00
mov esi, eax
xor ecx, ecx
cmp esi, 0xffffffff
je 0x424ce0
test ecx, ecx
jne 0x424cb9
mov eax, 0xfeff
lea edx, [ebp - 0x4f4]
push ecx
mov word [ebp - 0x4f4], ax
mov ecx, esi
lea eax, [ebp - 0x510]
push eax
push 2
call fcn.00430e20
push ecx
lea eax, [ebp - 0x510]
mov edx, edi
push eax
mov eax, ebx
mov ecx, esi
sub eax, dword [ebp - 0x4ec]
add eax, eax
push eax
call fcn.00430e20
test esi, esi
je 0x424ce0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4f8], 0
je 0x424ea2
lea eax, [ebp - 0x4f8]
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.0042d680
mov esi, dword [ebp - 0x528]
sub ebx, dword [ebp - 0x4ec]
sub esp, 0x41c
add esi, 0x14
mov ecx, 0x107
mov edi, esp
add ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x4f0]
mov edx, ebx
call fcn.00424ed0
add esp, 0x41c
jmp 0x424ea2
sub esp, 8
mov edx, 0x40000000
push 4
push ecx
push 7
mov ecx, 0x58b6d8
call fcn.00430d00
mov esi, eax
cmp esi, 0xffffffff
jne 0x424e0e
mov ecx, 0xd
lea edi, [ebp - 0x4d8]
mov esi, str._windir_LogsQualysAgent_
lea eax, [ebp - 0x4a2]
rep movsd dword es:[edi], dword [esi]
push 0x1d2
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00516d20
add esp, 0xc
lea ecx, [ebp - 0x4d8]
call fcn.004314d0
test eax, eax
jne 0x424ea2
push eax
lea eax, [ebp - 0x4d8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x514]
mov esi, 0x104
push eax
mov edx, esi
lea ecx, [ebp - 0x4d8]
call fcn.00408320
test eax, eax
js 0x424de5
mov eax, dword [ebp - 0x514]
sub esi, eax
push 0x7fffffff
push str.Log.txt
push ecx
lea ecx, [ebp - 0x4d8]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.00408260
sub esp, 8
mov edx, 0x40000000
push 4
push ecx
push 7
lea ecx, [ebp - 0x4d8]
call fcn.00430d00
mov esi, eax
cmp esi, 0xffffffff
je 0x424ea2
mov edi, dword [ebp - 0x4f0]
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, eax
call fcn.004243d0
test eax, eax
je 0x424e51
test esi, esi
je 0x424e31
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00425160
sub esp, 8
mov edx, 0x40000000
push 2
push ecx
push 7
mov ecx, 0x58b6d8
call fcn.00430d00
mov esi, eax
xor ecx, ecx
cmp esi, 0xffffffff
je 0x424ea2
test ecx, ecx
jne 0x424e7d
mov eax, 0xfeff
lea edx, [ebp - 0x4f0]
push ecx
mov word [ebp - 0x4f0], ax
mov ecx, esi
lea eax, [ebp - 0x518]
push eax
push 2
call fcn.00430e20
sub ebx, dword [ebp - 0x4ec]
lea eax, [ebp - 0x518]
push ecx
push eax
add ebx, ebx
mov edx, edi
push ebx
mov ecx, esi
call fcn.00430e20
test esi, esi
je 0x424ea2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x58b4a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret