Function at 0x411280
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x417dc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x814
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0x824], 1
call sub.MFC42u.DLL_CString::CString_1
push 0x400
push 0x400
lea ecx, [esp + 0x10]
mov byte [esp + 0x82c], 2
call sub.MFC42u.DLL_CString::GetBuffer
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::ReleaseBuffer
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x828], 3
call fcn.00416290
lea ecx, [esp + 0x10]
mov byte [esp + 0x824], 2
call sub.MFC42u.DLL_CString::CString
push str.log.xml
lea ecx, [esp + 0xc]
call fcn.00416332
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], si
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 8]
push esi
push 0x80
push 4
push esi
push 1
push 0x40000000
push ecx
stosw word es:[edi], ax
mov word [esp + 0x30], 0xd
mov word [esp + 0x32], 0xa
mov word [esp + 0x34], si
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41158c
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
cmp eax, 0xb7
jne 0x4113c8
push 0
push 0
push 0x1a
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x14]
push 0
push edx
push 1
push 0x41eda0
push esi
call edi
push 2
push 0
push 0xffffffffffffffee
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x411439
push 0xfe
push 0xff
lea eax, [esp + 0x2c]
push str._C_C
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x14]
lea edi, [esp + 0x24]
xor eax, eax
push 0
push ecx
or ecx, 0xffffffff
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
not ecx
dec ecx
push ecx
push edx
push esi
call edi
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x24]
push eax
push str._logs_sync_1___s
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push 0
push edx
push eax
call ebx
add esp, 4
lea ecx, [esp + 0x2c]
shl eax, 1
push eax
push ecx
push esi
call edi
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0
push edx
call dword [sym.imp.MSVCRT.dll_time]
mov eax, dword [esp + 0x844]
add esp, 4
cmp eax, 0xffffffff
jne 0x4114ad
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x83c]
push eax
push 0
call sub.MFC42u.DLL_CString::GetBuffer
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x83c]
xor ecx, ecx
test eax, eax
setne cl
push ecx
push edx
lea eax, [esp + 0x34]
push str._log_time__d__status__d____s___log__s
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push 0
push ecx
push edx
call ebx
add esp, 4
shl eax, 1
push eax
lea eax, [esp + 0x30]
push eax
jmp 0x411514
lea ecx, [esp + 0x1c]
push ecx
push 0
lea ecx, [esp + 0x844]
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0
lea ecx, [esp + 0x850]
call sub.MFC42u.DLL_CString::GetBuffer
mov edx, dword [esp + 0x848]
mov ecx, dword [esp + 0x20]
push eax
push edx
mov edx, dword [esp + 0x844]
xor eax, eax
test edx, edx
setne al
push eax
push ecx
lea edx, [esp + 0x3c]
push str._log_time__d__status__d__type__d__name__s____s___log__s
push edx
call ebp
add esp, 0x20
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push 0
push eax
push ecx
call ebx
add esp, 4
lea edx, [esp + 0x2c]
shl eax, 1
push eax
push edx
push esi
call edi
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x24]
push eax
push 0x41eca0
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push 0
push edx
push eax
call ebx
add esp, 4
lea ecx, [esp + 0x2c]
shl eax, 1
push eax
push ecx
push esi
call edi
push 0
push 0
push 0x1a
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x14]
push 0
push edx
push 1
push 0x41ec9c
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x838]
push 0
push 0
push eax
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
pop ebx
lea ecx, [esp + 8]
mov byte [esp + 0x824], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x834]
mov byte [esp + 0x824], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x83c]
mov dword [esp + 0x824], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x820
ret