Function at 0x42164b
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439b2a
mov eax, dword fs:[0]
push eax
sub esp, 0x204
mov eax, dword [0x468080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c0], edx
mov esi, ecx
mov edi, dword [edx + 0x24]
lea eax, [edx + 0x10]
mov dword [ebp - 0x1d0], eax
lea eax, [edx + 0x18]
mov dword [ebp - 0x1d4], eax
mov eax, dword [edx + 0x20]
mov ecx, dword [edx + 8]
mov ebx, dword [edx]
mov dword [ebp - 0x1c4], eax
mov ax, word [edx + 0x28]
mov word [ebp - 0x1c8], ax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1e0], eax
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x1dc], eax
mov ax, word [edx + 0x38]
mov word [ebp - 0x1b4], ax
mov eax, dword [edx + 0x3a]
mov dword [ebp - 0x1bc], eax
mov ax, word [edx + 0x3e]
mov word [ebp - 0x1b8], ax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1b8]
shr eax, 8
mov dword [ebp - 0x1cc], edi
mov dword [ebp - 0x1b0], ecx
test al, al
jne 0x42176c
shr ecx, 8
cmp cl, 3
je 0x421b9a
cmp cl, 0xbf
jb 0x421731
mov byte [ebp - 0x1a5], cl
mov byte [ebp - 0x1a3], 0
mov eax, dword [ebp - 0x1a5]
mov word [ebp - 0x1a2], 0x100
jmp 0x421758
cmp cl, 1
jne 0x42173e
mov byte [ebp - 0x1a5], cl
jmp 0x421719
cmp cl, 2
jne 0x42174b
mov byte [ebp - 0x1a5], cl
jmp 0x421719
mov eax, dword [ebp - 0x1a6]
mov byte [ebp - 0x1a1], 0
mov dword [ebp - 0x1bc], eax
mov ax, word [ebp - 0x1a2]
mov word [ebp - 0x1b8], ax
cmp byte [edx + 0xe], 0xa
jne 0x421864
mov al, byte [0x469cf0]
nop
test al, al
je 0x42178f
mov ecx, dword [0x469e18]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x421794
mov ecx, 0x469df8
mov al, byte [ecx]
mov byte [ebp - 0x8c], al
lea eax, [ecx + 4]
push eax
lea ecx, [ebp - 0x88]
call fcn.0040e042
cmp dword [0x469e20], 0
je 0x421853
mov ecx, ebx
call fcn.00422bb5
test al, al
jne 0x421853
lea eax, [ebp - 0x70]
mov ecx, ebx
push eax
call fcn.0042025c
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], 0x4403cc
mov dword [ebp - 0x30], 0x4403b8
call fcn.004131df
xor eax, eax
mov ecx, 0x2752091
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x34]
push eax
push str.Event_is_marked_as_Basic_but_doesnt_appear_in_the_Basic_Event_Allow_List
push 0xf
call fcn.004161d4
lea ecx, [ebp - 0x2c]
call fcn.0041228d
lea ecx, [ebp - 0x70]
call fcn.0041228d
cmp byte [ebp - 0x8c], 0
je 0x421853
lea ecx, [ebp - 0x1e8]
call fcn.0041dbb5
lea eax, [ebp - 0x1b0]
mov byte [ebp - 0x1e2], 0x64
push eax
lea eax, [ebp - 0x1f0]
push eax
call fcn.0041dbfe
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1b0], ecx
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x88]
call fcn.0040a63a
mov edi, dword [ebp - 0x1cc]
call fcn.00422b9a
cmp byte [eax], 0
je 0x42187f
lea edx, [ebp - 0x1bc]
lea ecx, [ebp - 0x1b0]
call fcn.004214da
push ebx
lea edx, [ebp - 0x1bc]
lea ecx, [ebp - 0x1b0]
call fcn.00421563
push ebx
mov ecx, 0x469cdc
call fcn.0042059a
test al, al
je 0x4218b3
push ebx
mov ecx, 0x469cdc
call fcn.00420657
movzx edi, ax
jmp 0x42194c
mov edx, dword [ebp - 0x1d0]
lea eax, [ebp - 0x1b0]
push edi
push dword [ebp - 0x1c4]
mov ecx, ebx
push eax
call fcn.00423e5a
movzx edi, ax
test di, di
jne 0x4218ed
push ebx
mov ecx, 0x469cf8
call fcn.0042443d
movzx edi, ax
test di, di
je 0x421a63
push edi
push ebx
mov ecx, 0x469cdc
call fcn.004202ea
cmp di, 7
jne 0x42194c
lea eax, [ebp - 0x70]
mov ecx, ebx
push eax
call fcn.0042025c
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], 0x4403cc
mov dword [ebp - 0x30], 0x4403b8
call fcn.004131df
xor eax, eax
mov ecx, 0x3050357
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x34]
push eax
push str.Event_validation_error:_event_volume_too_high
push 0xa
call fcn.004161d4
lea ecx, [ebp - 0x2c]
call fcn.0041228d
lea ecx, [ebp - 0x70]
call fcn.0041228d
test di, di
je 0x421a63
cmp byte [ebp - 0x1b0], 3
jne 0x421a1d
push ecx
lea ecx, [ebp - 0x128]
call fcn.004154eb
push edi
lea ecx, [ebp - 0x128]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int_]
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x124]
call fcn.004146cf
lea eax, [ebp - 0x70]
mov dword [ebp - 0x54], str.Error
mov edi, 0x4403cc
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x58], edi
call fcn.004131df
xor eax, eax
mov ecx, ebx
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x88]
push eax
call fcn.0042025c
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x4403b8
call fcn.004131df
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x34]
push eax
push ecx
push ecx
call fcn.00421c3b
lea ecx, [ebp - 0x2c]
call fcn.0041228d
lea ecx, [ebp - 0x88]
call fcn.0041228d
lea ecx, [ebp - 0x50]
call fcn.0041228d
lea ecx, [ebp - 0x70]
call fcn.0041228d
lea ecx, [ebp - 0xd8]
call fcn.00415980
lea ecx, [ebp - 0xd8]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x421a63
movzx eax, di
sub eax, 1
je 0x421bc5
sub eax, 1
je 0x421bbe
sub eax, 5
je 0x421a54
sub eax, 1
je 0x421a54
dec eax
sub eax, 1
je 0x421a54
sub eax, 1
je 0x421baf
sub eax, 1
jne 0x421ba6
mov byte [esi + 0x78], 0
jmp 0x421b7e
xor al, al
test al, al
je 0x421a54
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x1a8]
call fcn.004182ac
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1ac]
cmp edx, dword [ecx + 8]
jne 0x421a98
cmp eax, dword [ecx + 0xc]
jne 0x421a98
mov edi, dword [ebp - 0x1a4]
jmp 0x421b0b
push eax
push edx
lea ecx, [ebp - 0x1a0]
call fcn.004213cb
mov edx, ecx
mov ecx, dword [ebp - 0x1a8]
call fcn.00420e91
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0041f22b
mov ecx, dword [eax]
mov edi, dword [eax + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [ebp - 0x1a8], ecx
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a4], edi
test ecx, ecx
je 0x421aeb
call fcn.00419903
mov ecx, dword [ebp - 0x1d4]
test ecx, ecx
je 0x421afa
call fcn.00419903
lea ecx, [ebp - 0x1a0]
call fcn.0042147d
mov ecx, dword [ebp - 0x1c0]
lea eax, [ecx + 0x48]
mov byte [ebp - 0x1f4], 0
push eax
push dword [ecx + 0x40]
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x1b4]
push eax
push dword [ebp - 0x1dc]
lea eax, [ebp - 0x1cc]
push dword [ebp - 0x1e0]
push ecx
push eax
push dword [ebp - 0x1c4]
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ecx + 0x10]
mov ecx, esi
push eax
lea eax, [ebp - 0x1a8]
push eax
push ebx
call fcn.0041992b
cmp byte [ebp - 0x1f4], 0
je 0x421b6f
lea ecx, [ebp - 0x20c]
call fcn.0041228d
mov byte [esi + 0x78], 1
test edi, edi
je 0x421b7e
mov ecx, edi
call fcn.00419903
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004370bb
leave
ret
push 0
push 0x1e4ce503
call fcn.0040e5ee
push 0
push 0x14a118c
jmp 0x421ba1
mov ecx, 0x218d2486
call fcn.0040ec14
jmp 0x421a54
mov ecx, 0x218d2487
jmp 0x421bb4
lea eax, [ebp - 0x88]
mov ecx, ebx
push eax
call fcn.0042025c
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x58], 0x4403cc
mov dword [ebp - 0x54], 0x4403b8
call fcn.004131df
xor eax, eax
mov ecx, 0x24d7654
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x58]
push eax
push str.Event_validation_error:_invalid_name
push 0xa
call fcn.004161d4
lea ecx, [ebp - 0x50]
call fcn.0041228d
lea ecx, [ebp - 0x88]
call fcn.0041228d
mov ecx, 0x218d2488
call fcn.0040ec14
mov eax, dword [ebx + 4]
cmp byte [eax + 0x10], 0
je 0x421a5d
cmp dword [eax + 0xc], 0xfffffffe
sete al
jmp 0x421a5f