Function at 0x1000e230
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008ffd0
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2680
call fcn.10055c30
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x264c], 0
xor eax, eax
mov dword [ebp - 0x2648], eax
mov dword [ebp - 0x2644], eax
mov dword [ebp - 0x2640], eax
mov dword [ebp - 0x2698], eax
push 0x40
push eax
lea eax, [ebp - 0x2694]
push eax
call fcn.10055aa0
add esp, 0xc
mov dword [ebp - 0x263c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
push str.ESProtectionDriver
call fcn.10048d50
test eax, eax
jne 0x1000e2e8
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
xor eax, eax
jmp 0x1000e629
cmp dword [esi + 0x6280], 1
jne 0x1000e321
push 0
push 0xb
call fcn.10043e60
test eax, eax
jne 0x1000e321
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
lea eax, [esi + 0x1e]
jmp 0x1000e629
mov ecx, esi
call fcn.1000e940
mov edi, eax
test edi, edi
je 0x1000e3d5
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x1000e35f
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000e3bb
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1000e39a
mov byte [esi + 0xffff], 0
push esi
push str.StopHookingFilter
push 1
mov edx, 0x1b1
mov ecx, str...ProtectionNA.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1000e3b2
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, edi
jmp 0x1000e629
call fcn.1003ccd0
test eax, eax
je 0x1000e56c
push dword [esi + 0x6280]
push str.mbae64.exe
push 0x100e2400
push str._s_s__Stop__d__
lea eax, [ebp - 0x2638]
push eax
call fcn.1000ac10
add esp, 0x14
lea eax, [esi + 0x4280]
push eax
push 0x130c
lea eax, [ebp - 0x2638]
push eax
call fcn.10051f45
add esp, 0xc
push 0x10088cfc
push 0x130c
lea eax, [ebp - 0x2638]
push eax
call fcn.10051f45
add esp, 0xc
lea eax, [ebp - 0x264c]
push eax
lea eax, [ebp - 0x2698]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2638]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1000e51e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x1000e4a7
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000e503
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1000e4e2
mov byte [esi + 0xffff], 0
push esi
push str.StopHookingFilter
push 1
mov edx, 0x1c1
mov ecx, str...ProtectionNA.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1000e4fa
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
lea eax, [ebx + 0x1e]
jmp 0x1000e629
push 0xffffffffffffffff
push dword [ebp - 0x264c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x263c]
push eax
push dword [ebp - 0x264c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, eax
push dword [ebp - 0x264c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2648]
call esi
test edi, edi
je 0x1000e2fe
cmp dword [ebp - 0x263c], 0
jne 0x1000e2fe
mov dword [ebp - 4], 0
call fcn.1000e586
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1000e629
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret