Function at 0x1001a030
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090248
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x244], ebx
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push eax
lea eax, [ebp - 0x222]
push eax
call fcn.10055aa0
add esp, 0xc
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x230], 0
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], 1
mov eax, dword [ebx + 0x426c]
test eax, eax
je 0x1001a106
push eax
call fcn.10052152
add esp, 4
mov dword [ebx + 0x426c], 0
mov dword [ebx + 0x426c], 0
mov dword [ebx + 0x4268], 0
mov dword [ebx + 0x4264], 0
push str.applications.dat
push 0x100e1fb0
push 0x10086350
lea eax, [ebp - 0x224]
push eax
call fcn.10004ed0
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x254], esi
cmp esi, 0xffffffff
jne 0x1001a173
mov ecx, ebx
call fcn.10035450
mov esi, eax
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, esi
jmp 0x1001aacb
push 0
lea eax, [ebp - 0x248]
push eax
push 0xc
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001a946
cmp dword [ebp - 0x248], 0xc
jne 0x1001a946
cmp dword [ebp - 0x230], 0x140002
jne 0x1001a1ec
cmp dword [ebp - 0x22c], 0x628
jne 0x1001a1ec
cmp dword [ebp - 0x228], 0x20
jbe 0x1001a1ec
lea eax, [ebp - 0x230]
push eax
mov edx, esi
mov ecx, ebx
call fcn.1001aaf0
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0x10
xor eax, eax
jmp 0x1001aacb
mov ecx, ebx
call fcn.10035450
mov edi, eax
test edi, edi
je 0x1001a2a0
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x1001a22a
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1001a286
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1001a265
mov byte [esi + 0xffff], 0
push esi
push str.LoadProtectedApplications
push 1
mov edx, 0x223
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1001a27d
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, edi
jmp 0x1001aacb
cmp dword [ebp - 0x230], 0x140003
jne 0x1001a92c
cmp dword [ebp - 0x22c], 0xa30
jne 0x1001a92c
mov eax, dword [ebp - 0x228]
add eax, 0x72
mov dword [ebp - 0x25c], eax
imul esi, eax, 0xa30
lea eax, [esi + 0xa]
push eax
call fcn.1005218a
add esp, 4
mov edi, eax
mov dword [ebp - 0x238], edi
test edi, edi
jne 0x1001a398
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x1001a31e
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1001a37b
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push 5
test eax, eax
jle 0x1001a35a
mov byte [esi + 0xffff], 0
push esi
push str.LoadProtectedApplications
push 1
mov edx, 0x22f
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1001a372
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, 5
jmp 0x1001aacb
push esi
push 0
push edi
call fcn.10055aa0
imul eax, dword [ebx + 0x4264], 0xa30
push eax
push dword [ebx + 0x426c]
push edi
call fcn.10055450
add esp, 0x18
mov ecx, dword [ebx + 0x4264]
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x268], ecx
xor eax, eax
mov edi, dword [ebp - 0x244]
mov dword [ebp - 0x24c], eax
cmp eax, dword [ebp - 0x228]
jae 0x1001a6e3
imul ebx, ecx, 0xa30
add ebx, dword [ebp - 0x238]
mov dword [ebp - 0x23c], ebx
push 0
lea eax, [ebp - 0x248]
push eax
push 0xa30
push ebx
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001a67b
cmp dword [ebp - 0x248], 0xa30
jne 0x1001a67b
xor edi, edi
mov dword [ebp - 0x26c], edi
cmp edi, 4
jge 0x1001a5a0
imul esi, edi, 0x20c
lea ecx, [ebx + 0x208]
mov dword [ebp - 0x250], ecx
lea eax, [esi + str.MicrosoftEdge.exe]
push eax
push ecx
call fcn.100513c3
add esp, 8
test eax, eax
jne 0x1001a59a
mov dword [ebx + 0x624], 4
mov eax, dword [ebx + 0x61c]
mov dword [esi + 0x100e0338], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [eax + 0x1e]
mov dword [ebp - 0x264], 0
push 0x1000a
call fcn.1005218a
mov dword [ebp - 0x234], eax
push 0x2000a
call fcn.1005218a
add esp, 8
mov esi, eax
cmp dword [ebp - 0x234], 0
je 0x1001a55c
test esi, esi
je 0x1001a55c
push dword [ebp - 0x250]
push str.Precedence_changed_to_MBAE_APPLICATION_SHIELD_NO_INJECT_to_app:__s
push 0xffff
push esi
call fcn.1005211a
add esp, 0x10
test eax, eax
jle 0x1001a547
xor eax, eax
mov word [esi + 0x1fffe], ax
push 0xffffffffffffffff
push esi
mov ecx, esi
call fcn.10001b80
inc eax
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x264]
push eax
call fcn.10052d14
add esp, 0x14
test eax, eax
je 0x1001a525
push ebx
push esi
push str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.10052604
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
push dword [ebp - 0x234]
push str.LoadProtectedApplications
push 4
mov edx, 0x243
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1001a574
push ebx
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
jmp 0x1001a56e
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x1001a587
push eax
call fcn.10052152
add esp, 4
test esi, esi
je 0x1001a594
push esi
call fcn.10052152
add esp, 4
mov ebx, dword [ebp - 0x23c]
inc edi
jmp 0x1001a42e
xor eax, eax
mov dword [ebp - 0x258], eax
xor esi, esi
mov dword [ebp - 0x260], esi
mov edi, dword [ebp - 0x244]
cmp esi, dword [edi + 0x4264]
jae 0x1001a632
imul edi, esi, 0xa30
add edi, dword [ebp - 0x238]
push ebx
push edi
call fcn.100513c3
add esp, 8
test eax, eax
je 0x1001a60c
lea eax, [ebx + 0x410]
push eax
lea eax, [edi + 0x410]
push eax
call fcn.100513c3
add esp, 8
test eax, eax
je 0x1001a60c
lea eax, [ebx + 0x208]
push eax
lea eax, [edi + 0x208]
push eax
call fcn.100513c3
add esp, 8
test eax, eax
jne 0x1001a626
mov eax, dword [ebx + 0x61c]
mov dword [edi + 0x61c], eax
mov eax, 1
mov dword [ebp - 0x258], eax
inc esi
jmp 0x1001a5aa
mov eax, dword [ebp - 0x258]
inc esi
jmp 0x1001a5aa
test eax, eax
je 0x1001a648
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x24c]
inc eax
jmp 0x1001a3d5
mov dword [ebx + 0x62c], 0
mov dword [ebx + 0x628], 0
mov ecx, dword [ebp - 0x240]
inc ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x268], ecx
mov eax, dword [ebp - 0x24c]
inc eax
jmp 0x1001a3d5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
je 0x1001a968
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1001a9bd
mov byte [esi + 0xffff], 0
push esi
push str.LoadProtectedApplications
push 1
mov edx, 0x23a
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1001a9d5
xor eax, eax
mov word [edi + 0x4280], ax
xor ebx, ebx
mov dword [ebp - 0x24c], ebx
cmp ebx, ecx
jae 0x1001a8c7
imul eax, ebx, 0xa30
add eax, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
cmp dword [eax + 0x61c], 0
je 0x1001a8b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [eax + 0x1e]
mov dword [ebp - 0x250], 0
push 0x1000a
call fcn.1005218a
mov dword [ebp - 0x234], eax
push 0x2000a
call fcn.1005218a
add esp, 8
mov esi, eax
cmp dword [ebp - 0x234], 0
je 0x1001a807
test esi, esi
je 0x1001a807
mov eax, dword [ebp - 0x23c]
lea ecx, [eax + 0x208]
push ecx
push dword [eax + 0x624]
push str.Adding_shielded_app__d__to_injection_list:__s
push 0xffff
push esi
call fcn.1005211a
add esp, 0x14
test eax, eax
jle 0x1001a7f2
xor eax, eax
mov word [esi + 0x1fffe], ax
push 0xffffffffffffffff
push esi
mov ecx, esi
call fcn.10001b80
inc eax
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x250]
push eax
call fcn.10052d14
add esp, 0x14
test eax, eax
je 0x1001a7d0
push edi
push esi
push str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.10052604
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
push dword [ebp - 0x234]
push str.LoadProtectedApplications
push 4
mov edx, 0x267
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1001a81f
push edi
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
jmp 0x1001a819
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x1001a832
push eax
call fcn.10052152
add esp, 4
test esi, esi
je 0x1001a83f
push esi
call fcn.10052152
add esp, 4
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx + 0x4280]
mov edx, dword [ebp - 0x23c]
call fcn.10037f10
mov edi, eax
test edi, edi
je 0x1001a8b5
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
je 0x1001a210
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1001a265
mov byte [esi + 0xffff], 0
push esi
push str.LoadProtectedApplications
push 1
mov edx, 0x26a
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1001a27d
inc ebx
mov dword [ebp - 0x24c], ebx
mov ecx, dword [ebp - 0x240]
jmp 0x1001a6f4
mov edi, dword [ebp - 0x244]
mov eax, dword [edi + 0x426c]
test eax, eax
je 0x1001a8e6
push eax
call fcn.10052152
add esp, 4
mov ecx, dword [ebp - 0x240]
mov dword [edi + 0x426c], 0
mov dword [edi + 0x4264], ecx
mov eax, dword [ebp - 0x238]
mov dword [edi + 0x426c], eax
mov eax, dword [ebp - 0x25c]
mov dword [edi + 0x4268], eax
xor esi, esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 4], esi
call fcn.1001a9ff
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1001aacb
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
xor eax, eax
jmp 0x1001aacb
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x1001a982
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1001a9de
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1001a9bd
mov byte [esi + 0xffff], 0
push esi
push str.LoadProtectedApplications
push 1
mov edx, 0x215
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1001a9d5
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
lea eax, [ebx + 0x1e]
jmp 0x1001aacb
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret