Function at 0x1001b9c
Capabilities:
Check for peb beingdebugged flag
Get file attributes
Get process heap force flags
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x1003008]
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
mov word [ebp - 0x28c], si
mov ecx, 0xa1
lea edi, [ebp - 0x28a]
rep stosd dword es:[edi], eax
push 0x143
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x28c]
push eax
mov dword [ebp - 0x2a8], esi
call sub.ntdll.dll_wcsncpy
add esp, 0xc
push 0x144
push 0x1001140
lea eax, [ebp - 0x28c]
push eax
call fcn.010014e1
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x18
pop edi
push esi
push esi
push 0x50
push 1
push 1
push esi
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2c0], eax
push esi
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0x100081
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 0x2c8], edi
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2bc], 0x40
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2b4], esi
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, esi
jl 0x1001df3
push 5
push edi
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x29c]
push eax
push dword [ebp - 0x294]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, esi
mov dword [ebp - 0x2ac], eax
jl 0x1001dd7
mov eax, dword fs:[0x18]
push dword [ebp - 0x2d8]
mov eax, dword [eax + 0x30]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x2b0], eax
je 0x1001dd7
push esi
push esi
push dword [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x29c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x294]
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, esi
mov dword [ebp - 0x2ac], eax
jl 0x1001dbe
push ebx
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x2d8]
mov eax, dword [eax + 0x30]
lea ecx, [ecx + ecx + 2]
push ecx
push esi
push dword [eax + 0x18]
call edi
mov ebx, eax
cmp ebx, esi
je 0x1001dbd
mov eax, dword [ebp - 0x2d8]
push eax
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0x290]
push ecx
add eax, eax
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlOemToUnicodeN]
cmp eax, esi
mov dword [ebp - 0x2ac], eax
jl 0x1001da9
shr dword [ebp - 0x290], 1
mov ecx, esi
je 0x1001d72
mov ax, word [ebx + ecx*2]
cmp ax, 0x1a
je 0x1001d63
cmp ax, 0xd
je 0x1001d63
cmp ax, si
jne 0x1001d69
mov word [ebx + ecx*2], 0x20
inc ecx
cmp ecx, dword [ebp - 0x290]
jb 0x1001d4e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
push esi
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x2a8], eax
je 0x1001dbd
mov ecx, dword [ebp - 0x2a8]
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx], ebx
mov eax, dword [ebp - 0x290]
mov word [ebx + eax*2], si
jmp 0x1001dbd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop ebx
mov eax, dword fs:[0x18]
push dword [ebp - 0x2b0]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x294]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x2ac], esi
jl 0x1001df3
mov eax, dword [ebp - 0x2a8]
jmp 0x1001df5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01002355
leave
ret 4