Function at 0x100461880
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xa0
mov rax, qword [0x100499010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdx, qword [0x1004a9368]
mov rdi, rcx
mov eax, dword [0x1004a9184]
mov ecx, dword [0x1004a9180]
test rdx, rdx
jne 0x10046195f
test ecx, ecx
jne 0x10046195f
test eax, eax
jne 0x10046195f
cmp qword [rdi + 8], rdx
je 0x100461b52
xor eax, eax
lea r9d, [rcx + 0x57]
mov qword [rbp + 0xf], rax
lea edx, [rcx + 0x10]
mov qword [rbp + 0x17], rax
lea r8, [0x100471ea8]
mov qword [rbp + 0x1f], rax
lea rcx, [rbp + 0xf]
mov qword [rbp + 0x27], rax
xor ebx, ebx
lea rax, str.hEventLog__cannot_be_null
mov qword [rbp - 9], rbx
mov qword [rbp - 0x11], rax
call fcn.10040b460
mov qword [rsp + 0x40], rbx
lea rcx, [rbp + 0xf]
test eax, eax
lea edx, [rbx + 1]
lea eax, [rbx + 2]
mov r9d, 0xc0000144
cmovs rcx, qword [rbp - 9]
lea r8d, [rbx + 5]
mov qword [rbp - 9], rcx
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
jmp 0x100461b52
mov dword [rdi + 0x10], ecx
mov rcx, rdi
mov qword [rdi + 8], rdx
mov dword [rdi + 0x14], eax
movups xmm0, xmmword [0x1004711d8]
movups xmmword [rbp - 1], xmm0
call fcn.1004615f0
test eax, eax
je 0x100461b52
lea rdx, str.ntlanman.dll
mov qword [rsp + 0xc8], r14
mov ecx, 3
call fcn.10042b4a0
mov r14, rax
test rax, rax
jne 0x1004619bb
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x100461b4a
lea rax, str.RegisterAppInstance::Could_not_load_ntlanman.dll
jmp 0x1004619f0
lea rdx, [0x100480da8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x100461a2f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x100461b4a
lea rax, str.RegisterAppInstance::RegisterAppInstance_API_not_available_in_ntlanman.dll
xor ebx, ebx
mov qword [rbp - 0x11], rax
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
mov esi, 1
mov dword [rsp + 0x30], ebx
mov r9d, 0x40000145
mov word [rsp + 0x28], si
mov qword [rsp + 0x20], rbx
lea edx, [rsi + 3]
lea r8d, [rsi + 4]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
jmp 0x100461b4a
lea r8, [rbp - 1]
mov rcx, rdi
call fcn.100461e80
cmp eax, 1
jne 0x100461b41
mov rax, qword [0x1004711d8]
cmp rax, qword [rbp - 1]
jne 0x100461a62
mov rax, qword [0x1004711e0]
cmp rax, qword [rbp + 7]
je 0x100461b41
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, 1
lea rdx, [rbp - 1]
mov rcx, rax
mov r8d, esi
mov rax, rbx
call qword [case.0x10044bd0b.0]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x100461b41
xor ebx, ebx
test eax, eax
jne 0x100461ac0
mov qword [rsp + 0x40], rbx
lea rax, str.RegisterAppInstance::RegisterAppInstance_returned_ok
mov qword [rbp - 0x11], rax
lea edx, [rsi + 3]
lea rax, [rbp - 0x11]
mov r9d, 0x40000145
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], si
jmp 0x100461b30
xor ecx, ecx
mov qword [rbp - 9], rbx
mov qword [rbp + 0xf], rcx
lea r8, [0x100471ea8]
mov qword [rbp + 0x17], rcx
mov r9d, eax
mov qword [rbp + 0x1f], rcx
mov edx, reloc.ODBC32.dll_SQLFreeStmt
mov qword [rbp + 0x27], rcx
lea rcx, str.RegisterAppInstance
mov qword [rbp - 0x11], rcx
lea rcx, [rbp + 0xf]
call fcn.10040b460
mov qword [rsp + 0x40], rbx
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x38], rcx
lea rdx, [rbp + 0xf]
mov rcx, qword [rdi + 8]
test eax, eax
mov eax, 2
mov dword [rsp + 0x30], ebx
cmovs rdx, qword [rbp - 9]
mov r9d, 0xc0000144
mov qword [rbp - 9], rdx
mov edx, esi
mov word [rsp + 0x28], ax
mov r8d, 5
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.100469360
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret