Function at 0x1008f9d4
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101516ea
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1e0], esi
mov edi, ecx
lea eax, [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x1b8], eax
lea eax, [esi + 0x18]
mov dword [ebp - 0x1c4], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x1cc], eax
mov eax, dword [esi + 0x24]
mov ebx, dword [esi]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x1dc], eax
mov ax, word [esi + 0x28]
mov word [ebp - 0x1d8], ax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x1ec], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x1e8], eax
mov ax, word [esi + 0x38]
mov word [ebp - 0x1b4], ax
mov eax, dword [esi + 0x3a]
mov dword [ebp - 0x1c0], eax
mov ax, word [esi + 0x3e]
mov word [ebp - 0x1bc], ax
mov eax, dword [esi + 8]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1bc]
shr eax, 8
mov dword [ebp - 0x1a4], ecx
test al, al
jne 0x1008fab9
lea edx, [ebp - 0x1a8]
lea ecx, [ebp - 0x1d4]
call fcn.1008f8aa
mov ecx, eax
mov eax, dword [ecx]
mov dword [ebp - 0x1c0], eax
mov ax, word [ecx + 4]
mov word [ebp - 0x1bc], ax
cmp byte [esi + 0xe], 0xa
jne 0x1008fc46
mov al, byte [0x10204678]
nop
test al, al
je 0x1008fadc
mov ecx, dword [0x102047a0]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x1008fae1
mov ecx, 0x10204780
mov al, byte [ecx]
mov byte [ebp - 0x80], al
lea eax, [ecx + 4]
push eax
lea ecx, [ebp - 0x7c]
call fcn.10010dc7
cmp dword [0x102047a8], 0
je 0x1008fc36
mov ecx, ebx
call fcn.10090a8c
test al, al
jne 0x1008fc36
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.1008e5e1
push eax
push 0x1018ef80
lea ecx, [ebp - 0x64]
call fcn.1008f793
push 0
push 0xf
mov edx, 0x65e
mov ecx, 0x2752091
mov esi, eax
call fcn.1002c770
test al, al
je 0x1008fb87
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x1d4], esi
mov dword [ebp - 0x200], eax
mov edx, 0x65e
lea eax, [ebp - 0x1d0]
mov dword [ebp - method.Mso::Logging::CompositeStructuredTrace.virtual_0], vtable.Mso::Logging::CompositeStructuredTrace.0
mov dword [ebp - 0x1fc], eax
mov ecx, 0x2752091
lea eax, [ebp - 0x204]
push eax
push str.Event_is_marked_as_Basic_but_doesnt_appear_in_the_Basic_Event_Allow_List
push 0
push 0xf
call fcn.10129b4d
lea ecx, [ebp - 0x5c]
call fcn.10029b11
lea ecx, [ebp - 0x28]
call fcn.10029b11
cmp byte [ebp - 0x80], 0
je 0x1008fc36
xor eax, eax
mov word [ebp - 0x1aa], 0x100
mov word [ebp - 0x19c], ax
lea ecx, [ebp - 0x1f8]
lea eax, [ebp - 0x1aa]
mov byte [ebp - 0x19a], 1
push eax
lea eax, [ebp - 0x19c]
mov word [ebp - 0x1ac], 0x100
push eax
lea eax, [ebp - 0x1ac]
mov word [ebp - 0x1ae], 0x100
push eax
lea eax, [ebp - 0x1ae]
mov word [ebp - 0x1b0], 0x100
push eax
lea eax, [ebp - 0x1b0]
xor edx, edx
push eax
call fcn.1002fd95
lea eax, [ebp - 0x1a8]
mov byte [ebp - 0x1f8], dl
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 0x1f2], 0x64
push eax
call fcn.1008b97c
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x1a4], eax
lea ecx, [ebp - 0x7c]
call fcn.100093c1
mov esi, dword [ebp - 0x1dc]
jmp 0x1008fc4c
mov esi, dword [ebp - 0x19c]
call fcn.10090ade
cmp byte [eax], 0
je 0x1008fc67
lea edx, [ebp - 0x1c0]
lea ecx, [ebp - 0x1a8]
call fcn.1008f90d
push ebx
lea edx, [ebp - 0x1c0]
lea ecx, [ebp - 0x1a8]
call fcn.1009001d
push ebx
mov ecx, 0x10204664
call fcn.1008e730
test al, al
je 0x1008fc9b
push ebx
mov ecx, 0x10204664
call fcn.1008e698
movzx esi, ax
jmp 0x1008fd7e
mov edx, dword [ebp - 0x1b8]
lea eax, [ebp - 0x1a8]
push esi
push dword [ebp - 0x1cc]
mov ecx, ebx
push eax
call fcn.10092040
movzx esi, ax
test si, si
jne 0x1008fcd5
push ebx
mov ecx, 0x10204680
call fcn.10092a64
movzx esi, ax
test si, si
je 0x1008ff07
push esi
push ebx
mov ecx, 0x10204664
call fcn.1008e9c9
cmp si, 7
jne 0x1008fd7e
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.1008e5e1
push eax
push 0x1018ef80
lea ecx, [ebp - 0x64]
call fcn.1008f793
push 0
push 0xa
mov edx, 0x65e
mov dword [ebp - 0x1b8], eax
mov ecx, 0x3050357
call fcn.1002c770
test al, al
je 0x1008fd6e
mov eax, dword [ebp - 0x1b8]
mov edx, 0x65e
mov dword [ebp - 0x19c], eax
mov ecx, 0x3050357
lea eax, [ebp - 0x19c]
mov dword [ebp - method.Mso::Logging::CompositeStructuredTrace.virtual_0], vtable.Mso::Logging::CompositeStructuredTrace.0
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x198]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x210]
push eax
push str.Event_validation_error:_event_volume_too_high
push 0
push 0xa
call fcn.10129b4d
lea ecx, [ebp - 0x5c]
call fcn.10029b11
lea ecx, [ebp - 0x28]
call fcn.10029b11
test si, si
je 0x1008ff07
cmp byte [ebp - 0x1a8], 3
je 0x1008fe7c
movzx eax, si
sub eax, 1
je 0x1008fde1
sub eax, 1
je 0x1008fdda
sub eax, 5
je 0x1008fdd1
sub eax, 1
je 0x1008fdd1
dec eax
sub eax, 1
je 0x1008fdd1
sub eax, 1
je 0x1008fdc7
sub eax, 1
je 0x1008fdd1
push 0
push 0x14a118c
call fcn.1002a3d0
mov ecx, 0x218d2486
call fcn.1006fff3
mov byte [edi + 0x78], 0
jmp 0x10090001
mov ecx, 0x218d2487
jmp 0x1008fdcc
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.1008e5e1
push eax
push 0x1018ef80
lea ecx, [ebp - 0x64]
call fcn.1008f793
push 0
push 0xa
mov edx, 0x65e
mov ecx, 0x24d7654
mov esi, eax
call fcn.1002c770
test al, al
je 0x1008fe4e
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x19c], esi
mov dword [ebp - 0x30], eax
mov edx, 0x65e
lea eax, [ebp - 0x198]
mov dword [ebp - 0x34], vtable.Mso::Logging::CompositeStructuredTrace.0
mov dword [ebp - 0x2c], eax
mov ecx, 0x24d7654
lea eax, [ebp - 0x34]
push eax
push str.Event_validation_error:_invalid_name
push 0
push 0xa
call fcn.10129b4d
lea ecx, [ebp - 0x5c]
call fcn.10029b11
lea ecx, [ebp - 0x28]
call fcn.10029b11
mov ecx, 0x218d2488
call fcn.1006fff3
mov ecx, ebx
call fcn.10091f6e
test al, al
jne 0x1008ff07
jmp 0x1008fdd1
push ecx
lea ecx, [ebp - 0x120]
call fcn.1008e27c
push esi
lea ecx, [ebp - 0x120]
call fcn.1008e3b7
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x11c]
call fcn.10083f7f
lea eax, [ebp - 0x40]
push eax
push 0x10187544
lea ecx, [ebp - 0x88]
call fcn.1008f793
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x28]
push eax
call fcn.1008e5e1
push eax
push 0x1018ef80
lea ecx, [ebp - 0x64]
call fcn.1008f793
push esi
push eax
sub esp, 0xc
call fcn.1008f742
lea ecx, [ebp - 0x5c]
call fcn.10029b11
lea ecx, [ebp - 0x28]
call fcn.10029b11
lea ecx, [ebp - 0x80]
call fcn.10029b11
lea ecx, [ebp - 0x40]
call fcn.10029b11
lea ecx, [ebp - 0x120]
call fcn.1008e508
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1c8]
call fcn.1006b06a
mov esi, dword [ebp - 0x1e0]
mov ecx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1a4]
cmp ecx, dword [esi + 8]
jne 0x1008ff34
cmp eax, dword [esi + 0xc]
je 0x1008ff8a
push eax
push ecx
lea ecx, [ebp - 0x198]
call fcn.1008f7bd
mov ecx, dword [ebp - 0x1c8]
lea edx, [ebp - 0x198]
call fcn.1008f305
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x198]
call fcn.1008ced3
push eax
lea ecx, [ebp - 0x1c8]
call fcn.1002e572
mov ecx, dword [ebp - 0x1e0]
test ecx, ecx
je 0x1008ff7f
call fcn.10024d5e
lea ecx, [ebp - 0x198]
call fcn.1008f828
lea eax, [esi + 0x48]
mov byte [ebp - 0x21c], 0
push eax
push dword [esi + 0x40]
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x1b4]
push eax
push dword [ebp - 0x1e8]
lea eax, [ebp - 0x1dc]
push dword [ebp - 0x1ec]
push ecx
push eax
push dword [ebp - 0x1cc]
lea eax, [ebp - 0x1a8]
mov ecx, edi
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x1c8]
push eax
push ebx
call fcn.10087a87
cmp byte [ebp - 0x21c], 0
je 0x1008ffee
lea ecx, [ebp - 0x234]
call fcn.10029b11
mov ecx, dword [ebp - 0x1c4]
mov byte [edi + 0x78], 1
test ecx, ecx
je 0x10090001
call fcn.10024d5e
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10033218
leave
ret