Function at 0x1000dba0
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008ffa8
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2684
call fcn.10055c30
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x2658], ebx
mov dword [ebp - 0x2654], 0
xor eax, eax
mov dword [ebp - 0x2650], eax
mov dword [ebp - 0x264c], eax
mov dword [ebp - 0x2648], eax
mov dword [ebp - 0x269c], eax
push 0x40
push eax
lea eax, [ebp - 0x2698]
push eax
call fcn.10055aa0
add esp, 0xc
mov dword [ebp - 0x2644], 0
cmp dword [ebx + 0x20], 0
je 0x1000e14b
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
push str.ESProtectionDriver
call fcn.10048d50
test eax, eax
jne 0x1000dd77
push str.ESProtectionDriver
call fcn.10048e70
test eax, eax
jne 0x1000dc83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
lea eax, [esi + 0x1e]
jmp 0x1000e20d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [eax + 0x1e]
mov dword [ebp - 0x263c], esi
mov dword [ebp - 0x2640], 0
push 0x1000a
call fcn.1005218a
mov dword [ebp - 0x2638], eax
push 0x2000a
call fcn.1005218a
add esp, 8
mov edi, eax
cmp dword [ebp - 0x2638], 0
je 0x1000de50
test edi, edi
je 0x1000de50
push str.Malwarebytes_Anti_Exploit_Driver_has_been_successfully_started
push 0xffff
push edi
call fcn.1005211a
add esp, 0xc
test eax, eax
jle 0x1000dd5f
xor eax, eax
mov word [edi + 0x1fffe], ax
push 0xffffffffffffffff
push edi
mov ecx, edi
call fcn.10001b80
inc eax
push eax
push dword [ebp - 0x2638]
lea eax, [ebp - 0x2640]
push eax
call fcn.10052d14
add esp, 0x14
test eax, eax
je 0x1000dd2f
push esi
push edi
push str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.10052604
add esp, 0xc
push edi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
jmp 0x1000dd35
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x263c]
push dword [ebp - 0x2638]
push str.StartHookingFilter
push 4
mov edx, 0x143
mov ecx, str...ProtectionNA.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1000de6a
push esi
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
jmp 0x1000de62
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [eax + 0x1e]
mov dword [ebp - 0x2640], esi
mov dword [ebp - 0x263c], 0
push 0x1000a
call fcn.1005218a
mov dword [ebp - 0x2638], eax
push 0x2000a
call fcn.1005218a
add esp, 8
mov edi, eax
cmp dword [ebp - 0x2638], 0
je 0x1000de50
test edi, edi
je 0x1000de50
push str.Malwarebytes_Anti_Exploit_Driver_is_running
push 0xffff
push edi
call fcn.1005211a
add esp, 0xc
test eax, eax
jle 0x1000dd5f
xor eax, eax
mov word [edi + 0x1fffe], ax
push 0xffffffffffffffff
push edi
mov ecx, edi
call fcn.10001b80
inc eax
push eax
push dword [ebp - 0x2638]
lea eax, [ebp - 0x263c]
push eax
call fcn.10052d14
add esp, 0x14
test eax, eax
je 0x1000de23
push esi
push edi
push str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.10052604
add esp, 0xc
push edi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
jmp 0x1000de29
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x2640]
push dword [ebp - 0x2638]
push str.StartHookingFilter
push 4
mov edx, 0x146
mov ecx, str...ProtectionNA.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1000de6a
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
mov eax, dword [ebp - 0x2638]
test eax, eax
je 0x1000de7d
push eax
call fcn.10052152
add esp, 4
test edi, edi
je 0x1000de8a
push edi
call fcn.10052152
add esp, 4
cmp dword [0x100e22bc], 0xa
jb 0x1000dee2
push str.mbae.dll
push 0x100e2400
push 0x10086350
lea eax, [ebp - 0x2634]
push eax
call fcn.1000ac10
lea ecx, [ebp - 0x2634]
call fcn.10006810
push str.mbae64.dll
push 0x100e2400
push 0x10086350
lea eax, [ebp - 0x2634]
push eax
call fcn.1000ac10
add esp, 0x20
lea ecx, [ebp - 0x2634]
call fcn.10006810
mov ecx, ebx
call fcn.1000e650
mov dword [ebp - 0x2638], eax
test eax, eax
je 0x1000dfa5
push 0x1000a
call fcn.1005218a
add esp, 4
mov edi, eax
test edi, edi
jne 0x1000df26
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call esi
mov ebx, dword [ebp - 0x2638]
jmp 0x1000df8b
push 0x100865c0
push 0xffff
push edi
call fcn.10052136
add esp, 0xc
test eax, eax
jle 0x1000df67
mov byte [edi + 0xffff], 0
mov ebx, dword [ebp - 0x2638]
push ebx
push edi
push str.StartHookingFilter
push 1
mov edx, 0x156
mov ecx, str...ProtectionNA.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1000df82
mov ebx, dword [ebp - 0x2638]
push ebx
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call esi
push edi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, ebx
jmp 0x1000e20d
call fcn.1003ccd0
test eax, eax
je 0x1000e138
push dword [ebx + 0x6280]
push str.mbae64.exe
push 0x100e2400
push str._s_s__Start__d__
lea eax, [ebp - 0x2634]
push eax
call fcn.1000ac10
lea eax, [ebx + 0x4280]
push eax
push 0x130c
lea eax, [ebp - 0x2634]
push eax
call fcn.10051f45
push 0x10088cfc
push 0x130c
lea eax, [ebp - 0x2634]
push eax
call fcn.10051f45
add esp, 0x2c
lea eax, [ebp - 0x2654]
push eax
lea eax, [ebp - 0x269c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2634]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1000e0ea
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
add eax, 0x1e
mov dword [ebp - 0x263c], eax
call ebx
lea ebx, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov edi, eax
test edi, edi
jne 0x1000e074
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call esi
jmp 0x1000e0cc
push 0x100865c0
push 0xffff
push edi
call fcn.10052136
add esp, 0xc
push ebx
test eax, eax
jle 0x1000e0af
mov byte [edi + 0xffff], 0
push edi
push str.StartHookingFilter
push 1
mov edx, 0x166
mov ecx, str...ProtectionNA.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1000e0c3
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call esi
push edi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, dword [ebp - 0x263c]
jmp 0x1000e20d
push 0xffffffffffffffff
push dword [ebp - 0x2654]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2644]
push eax
push dword [ebp - 0x2654]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, eax
push dword [ebp - 0x2654]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2650]
call esi
test edi, edi
je 0x1000dc60
cmp dword [ebp - 0x2644], 0
jne 0x1000dc60
mov dword [ebp - 4], 0
call fcn.1000e158
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1000e20d
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret