Function at 0x41fbac
Capabilities:
Get common file path
Persist via run registry key
Query environment variable

Disassembly:
push 0x314
mov eax, 0x524731
call fcn.005066d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x27c], eax
call fcn.0040dbda
mov al, byte [eax]
test al, al
jne 0x41fc96
lea eax, [ebp - 0x320]
push eax
call fcn.0040d9e1
and dword [ebp - 4], 0
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv____bool____start
push eax
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x320]
call fcn.0040bf31
lea edi, [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x320]
call fcn.0040c22b
push 0x54323c
push dword [ebp - 0x27c]
mov ebx, 0x2710
call fcn.0040b7ed
cmp dword [ebp - 0x264], 0
je 0x420755
mov eax, dword [ebp - 0x264]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fc65
sub eax, edx
je 0x420755
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jle 0x41fdcf
xor eax, eax
jmp 0x41fdea
lea eax, [ebp - 0x318]
push eax
mov dword [ebp - 4], 2
call fcn.0040b935
mov byte [ebp - 4], 3
call fcn.0040dbda
lea ecx, [ebp - 0x298]
call fcn.0040b84b
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x41fccc
mov esi, dword [eax + 4]
jmp 0x41fccf
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv____bool____start
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x298]
mov byte [ebp - 4], 3
call fcn.0040dac5
lea eax, [ebp - 0x278]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 5
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x41fd7a
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x318]
call fcn.0040b831
push 0x50a
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x298]
call fcn.0040dac5
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 3
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 2
call fcn.0040b8a0
or dword [ebp - 4], 0xffffffff
jmp 0x41fc3a
lea eax, [edi + edi]
call fcn.00506130
mov dword [ebp - 0x10], esp
mov esi, esp
push 3
push edi
push dword [ebp - 0x264]
call fcn.00412f14
push eax
lea esi, [ebp - 0x258]
call fcn.0040b812
push 0x12
pop edi
mov dword [ebp - 4], edi
call fcn.0040dbda
cmp byte [eax], 0
jne 0x41febc
lea eax, [ebp - 0x320]
push eax
call fcn.0040d9e1
mov eax, esi
push eax
push ecx
push 0x543368
push ecx
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv__varName
push eax
mov byte [ebp - 4], 0x13
call fcn.0040c0a0
add esp, 0xc
push eax
call fcn.0040c0a0
add esp, 0xc
push eax
call fcn.0040b612
pop ecx
pop ecx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x320]
call fcn.0040bf31
lea edi, [ebp - 0x23c]
mov byte [ebp - 4], 0x14
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x12
call fcn.0040c22b
mov esi, 0x104
push esi
call fcn.004ff331
xor edi, edi
pop ecx
mov dword [ebp - 0x26c], eax
cmp eax, edi
jne 0x42000b
push edi
push 1
lea esi, [ebp - 0x258]
call fcn.0040dac5
xor al, al
lea esp, [ebp - 0x330]
call fcn.0050672c
ret
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x15
call fcn.0040b935
mov byte [ebp - 4], 0x16
call fcn.0040dbda
lea ecx, [ebp - 0x298]
call fcn.0040b84b
mov byte [ebp - 4], 0x17
cmp dword [eax + 0x18], 8
jb 0x41feef
mov esi, dword [eax + 4]
jmp 0x41fef2
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv__varName
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
lea ecx, [ebp - 0x258]
push ecx
push eax
call fcn.0040b612
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x298]
mov byte [ebp - 4], 0x16
call fcn.0040dac5
lea eax, [ebp - 0x278]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
push ebx
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x18
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x41ffb4
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x318]
call fcn.0040b831
push 0x516
push str..SystemCommands.cpp
push eax
push ebx
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x19
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x298]
call fcn.0040dac5
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x16
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x15
call fcn.0040b8a0
mov dword [ebp - 4], edi
jmp 0x41fe84
push esi
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
mov dword [ebp - 0x274], ebx
cmp ebx, esi
jbe 0x420244
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4200ae
lea eax, [ebp - 0x320]
push eax
call fcn.0040d9e1
push ebx
push ecx
push 0x543368
push ecx
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv__need_to_re_allocate_string_to
push eax
mov byte [ebp - 4], 0x1c
call fcn.0040c0a0
add esp, 0xc
push eax
call fcn.0040c0a0
add esp, 0xc
push eax
call fcn.00408e51
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x320]
call fcn.0040bf31
lea edi, [ebp - 0x23c]
mov byte [ebp - 4], 0x1d
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x12
call fcn.0040c22b
jmp 0x4201ff
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x1e
call fcn.0040b935
mov byte [ebp - 4], 0x1f
call fcn.0040dbda
lea ecx, [ebp - 0x298]
call fcn.0040b84b
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x18], 8
jb 0x4200e1
mov esi, dword [eax + 4]
jmp 0x4200e4
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv__need_to_re_allocate_string_to
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push eax
call fcn.00408e51
push edi
push 1
lea esi, [ebp - 0x298]
mov byte [ebp - 4], 0x1f
call fcn.0040dac5
lea eax, [ebp - 0x260]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x21
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4201a1
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x318]
call fcn.0040b831
push 0x51e
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x22
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push edi
push 1
lea esi, [ebp - 0x298]
call fcn.0040dac5
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x1f
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x1e
call fcn.0040b8a0
mov dword [ebp - 4], 0x12
jmp 0x4201ff
push dword [ebp - 0x26c]
call fcn.004ffb17
pop ecx
push ebx
call fcn.004ff331
pop ecx
mov dword [ebp - 0x26c], eax
test eax, eax
jne 0x420234
xor bl, bl
push 0
push 1
lea esi, [ebp - 0x258]
call fcn.0040dac5
mov al, bl
jmp 0x41feb0
push ebx
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
push dword [ebp - 0x26c]
test ebx, ebx
je 0x42029a
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jle 0x420263
xor eax, eax
jmp 0x42027e
lea eax, [edi + edi]
call fcn.00506130
mov dword [ebp - 0x10], esp
mov esi, esp
push 3
push edi
push dword [ebp - 0x26c]
call fcn.00412f14
push eax
push dword [ebp - 0x27c]
call fcn.0040b7ed
push dword [ebp - 0x26c]
call fcn.004ffb17
pop ecx
mov bl, 1
jmp 0x42021e
call fcn.004ffb17
pop ecx
call fcn.0040dbda
cmp byte [eax], 0
jne 0x420345
lea eax, [ebp - 0x320]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv__GetEnvironmentVariableA_fails
push eax
mov byte [ebp - 4], 0x25
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x320]
call fcn.0040bf31
lea edi, [ebp - 0x23c]
mov byte [ebp - 4], 0x26
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x12
call fcn.0040c22b
push dword [ebp - 0x264]
lea eax, [ebp - 0x268]
push eax
xor ebx, ebx
call fcn.0042408e
push str.APPDATA
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 0x2e
call fcn.004240d3
test eax, eax
jne 0x420481
push ebx
push 0x1c
jmp 0x4204b3
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x27
call fcn.0040b935
mov byte [ebp - 4], 0x28
call fcn.0040dbda
lea ecx, [ebp - 0x298]
call fcn.0040b84b
mov byte [ebp - 4], 0x29
cmp dword [eax + 0x18], 8
jb 0x420378
mov esi, dword [eax + 4]
jmp 0x42037b
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv__GetEnvironmentVariableA_fails
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x298]
mov byte [ebp - 4], 0x28
call fcn.0040dac5
lea eax, [ebp - 0x260]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x2a
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x420426
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x318]
call fcn.0040b831
push 0x532
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x2b
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x298]
call fcn.0040dac5
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x28
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x27
call fcn.0040b8a0
mov dword [ebp - 4], 0x12
jmp 0x42030c
push str.COMMONAPPDATA
lea eax, [ebp - 0x268]
push eax
call fcn.004240d3
test eax, eax
jne 0x42049b
push ebx
push 0x23
jmp 0x4204b3
push str.ProgramFiles
lea eax, [ebp - 0x268]
push eax
call fcn.004240d3
test eax, eax
jne 0x4204c5
push ebx
push 0x26
lea eax, [ebp - 0x220]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, eax
jmp 0x420542
push str.LOCALAPPDATA
lea eax, [ebp - 0x268]
push eax
call fcn.004240d3
test eax, eax
jne 0x420741
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
mov eax, 0x20019
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
call fcn.0040e49d
cmp eax, ebx
jne 0x420535
push str.Local_AppData
lea eax, [ebp - 0x270]
push eax
lea esi, [ebp - 0x274]
lea edi, [ebp - 0x220]
call fcn.0040e58f
lea esi, [ebp - 0x270]
call fcn.0040e486
xor edi, edi
inc edi
jmp 0x420537
xor edi, edi
lea esi, [ebp - 0x270]
call fcn.0040e486
cmp edi, 1
jne 0x420741
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x27c]
call fcn.0040b7ed
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4205fa
lea eax, [ebp - 0x320]
push eax
call fcn.0040d9e1
push dword [ebp - 0x27c]
lea eax, [ebp - 0x318]
push ecx
push 0x543368
push ecx
push str.CSystemCommands::GetSafeEnv__using_SHGetSpecialFolderPath__returns:
push eax
mov byte [ebp - 4], 0x2f
call fcn.0040c0a0
add esp, 0xc
push eax
call fcn.0040c0a0
add esp, 0xc
push eax
call fcn.0040b612
pop ecx
pop ecx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x320]
call fcn.0040bf31
lea edi, [ebp - 0x23c]
mov byte [ebp - 4], 0x30
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x2e
call fcn.0040c22b
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.0040b78a
jmp 0x420296
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x31
call fcn.0040b935
mov byte [ebp - 4], 0x32
call fcn.0040dbda
lea ecx, [ebp - 0x298]
call fcn.0040b84b
mov byte [ebp - 4], 0x33
cmp dword [eax + 0x18], 8
jb 0x42062d
mov esi, dword [eax + 4]
jmp 0x420630
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv__using_SHGetSpecialFolderPath__returns:
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x27c]
push eax
call fcn.0040b612
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x298]
mov byte [ebp - 4], 0x32
call fcn.0040dac5
lea eax, [ebp - 0x260]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x34
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4206f4
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x318]
call fcn.0040b831
push 0x55c
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x35
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x298]
call fcn.0040dac5
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x32
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x31
call fcn.0040b8a0
jmp 0x4205e7
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.0040b78a
push ebx
jmp 0x41fea1
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4207c5
lea eax, [ebp - 0x320]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv____varName__NULL__quits
push eax
mov dword [ebp - 4], 9
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x320]
call fcn.0040bf31
lea edi, [ebp - 0x23c]
mov byte [ebp - 4], 0xa
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x320]
call fcn.0040c22b
jmp 0x41feae
lea eax, [ebp - 0x318]
push eax
mov dword [ebp - 4], 0xb
call fcn.0040b935
mov byte [ebp - 4], 0xc
call fcn.0040dbda
lea ecx, [ebp - 0x298]
call fcn.0040b84b
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x18], 8
jb 0x4207fb
mov esi, dword [eax + 4]
jmp 0x4207fe
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv____varName__NULL__quits
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x298]
mov byte [ebp - 4], 0xc
call fcn.0040dac5
lea eax, [ebp - 0x260]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
push ebx
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xe
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4208a4
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x318]
call fcn.0040b831
push 0x50f
push str..SystemCommands.cpp
push eax
push ebx
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xf
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x298]
call fcn.0040dac5
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xc
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0xb
call fcn.0040b8a0
jmp 0x41feae