Function at 0x49e0e0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x87c]
mov ecx, dword [eax]
mov ecx, dword [ecx]
call fcn.0044aaa0
mov edx, dword [ebx + 0x87c]
mov byte [ebp - 1], al
mov edx, dword [edx]
mov ecx, dword [edx]
cmp ecx, 0xc0000005
jne 0x49e168
cmp dword [edx + 0x10], 2
jne 0x49e168
cmp word [0x7cc8d0], 0
lea edi, [ebx + 0x416]
mov eax, 0x792920
mov ecx, 0x7cc8d0
cmove ecx, eax
mov esi, str.read
cmp dword [edx + 0x14], 0
mov eax, str.write
cmove eax, esi
push eax
push dword [edx + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [ebx + 0x87c]
push dword [ebx + 0x880]
mov eax, dword [eax]
push dword [eax + 0xc]
push str.Exception_access_violation_occurred_at_address_0x_08X_on_thread_0x_08X_in_process__u___ls__while_accessing_address_0x_08X_for__hs
jmp 0x49e290
cmp word [0x7cc8d0], 0
mov edx, 0x7cc8d0
mov eax, 0x792920
mov edi, 0x78c68c
cmove edx, eax
cmp ecx, 0xc0000005
ja 0x49e1d4
je 0x49e1ca
add ecx, 0x7fffffff
cmp ecx, 3
ja case.0x49e1ed.1073741817
jmp dword [ecx*4 + 0x49e390]
mov edi, str.EXCEPTION_DATATYPE_MISALIGNMENT
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_BREAKPOINT
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_SINGLE_STEP
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_GUARD_PAGE
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_ACCESS_VIOLATION
jmp case.0x49e1ed.1073741817
add ecx, 0x3ffffffa
cmp ecx, 0xf7
ja case.0x49e1ed.1073741817
movzx eax, byte [ecx + 0x49e3e8]
jmp dword [eax*4 + 0x49e3a0]
mov edi, str.EXCEPTION_ARRAY_BOUNDS_EXCEEDED
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_FLT_DENORMAL_OPERAND
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_FLT_DIVIDE_BY_ZERO
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_FLT_INEXACT_RESULT
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_FLT_INVALID_OPERATION
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_FLT_OVERFLOW
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_FLT_STACK_CHECK
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_FLT_UNDERFLOW
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_INT_DIVIDE_BY_ZERO
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_INT_OVERFLOW
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_PRIV_INSTRUCTION
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_IN_PAGE_ERROR
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_ILLEGAL_INSTRUCTION
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_NONCONTINUABLE_EXCEPTION
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_STACK_OVERFLOW
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_INVALID_DISPOSITION
jmp case.0x49e1ed.1073741817
mov edi, str.EXCEPTION_INVALID_HANDLE
mov eax, dword [ebx + 0x87c]
push edx
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebx + 0x880]
push dword [esi + 0xc]
push edi
push dword [esi]
lea edi, [ebx + 0x416]
push 0x7838f0
push 0x209
push edi
call fcn.00449380
xor eax, eax
add esp, 0x24
mov word [ebx + 0x826], ax
cmp byte [0x7c14d5], al
je 0x49e2df
cmp byte [0x7c14d6], al
jne 0x49e2df
mov eax, dword [ebx]
or eax, 0x11
push eax
push str.Unhandled_exception
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov bl, byte [ebp - 1]
mov ecx, 5
test bl, bl
cmovne eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x7ccad4]
test eax, eax
je 0x49e35c
cmp dword [0x7ccad0], 0
je 0x49e375
cmp byte [0x7ccc10], 5
push eax
push 0
jb 0x49e309
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
jmp 0x49e30f
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x49e375
mov bl, byte [ebp - 1]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 1
push 0
push dword [0x7ccad0]
xor eax, eax
mov dword [ebp - 8], edi
test bl, bl
push 0
setne al
inc eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
test bl, bl
mov eax, 1
mov ecx, 5
cmovne eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp - 1]
mov eax, 1
test bl, bl
mov ecx, 5
cmovne eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp - 1]
mov eax, 1
pop edi
test bl, bl
mov ecx, 5
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret