Function at 0x1001b770
Capabilities:
Create pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x684
push ebx
push esi
lea ecx, [eax + 0x1188]
push edi
mov edi, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
cmp eax, ecx
ja 0x1001b836
mov ebx, dword [esp + 0x14]
jmp 0x1001b7a0
cmp edi, 0x4ca0
ja 0x1001b972
je 0x1001b959
cmp edi, 0x4bd4
ja 0x1001b8c8
je 0x1001b8af
cmp edi, 0x466a
ja 0x1001b860
je 0x1001b841
mov eax, edi
sub eax, 0x4604
je 0x1001b807
sub eax, 0x33
jne 0x1001bb79
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov edx, dword [edx + 4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ecx + 0x1c]
and ecx, eax
and edx, eax
cmp ecx, edx
jne 0x1001b836
jmp 0x1001bb79
cmp dword [ebp + 0xc], 0
jne 0x1001bb79
push 0x101613e6
push 0
push str.word_countess
push str.TuxFamily:_Free_hosting_for_free_people
call fcn.100fe360
push 0
call fcn.100fe15b
add esp, 0x14
call fcn.100fd9d0
mov al, byte [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [eax + 6]
push ecx
add eax, 0x1c
push eax
push edx
call fcn.10024040
add esp, 0x10
jmp 0x1001bb79
cmp edi, 0x4ba1
jne 0x1001bb79
push 2
lea eax, [esp + 0x26]
push 0x10163814
push eax
mov dword [esp + 0x2c], 0x5c
call fcn.100fdf85
push 0xc
lea ecx, [esp + 0x34]
push 0x10163818
push ecx
call fcn.100fdb50
push 2
lea edx, [esp + 0x3c]
push 0x10163824
push edx
call fcn.100fe1b7
add esp, 0x24
jmp 0x1001bb79
push 1
lea eax, [esp + 0x24]
push 0x101638c0
push eax
call fcn.100fe1b7
add esp, 0xc
jmp 0x1001bb79
mov eax, edi
sub eax, 0x4c07
je 0x1001b92f
sub eax, 0x33
je 0x1001b8ff
sub eax, 0x33
jne 0x1001bb79
mov eax, dword [0x1016384c]
mov ecx, dword [0x10163850]
mov dword [esp + 0x46], 0x65
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
jmp 0x1001bb79
xor eax, eax
movzx ecx, word [eax + 0x101638c8]
mov word [esp + eax + 0x3e], cx
add eax, 2
test cx, cx
jne 0x1001b901
mov edx, dword [0x101638d0]
mov ax, word [0x101638d4]
mov dword [esp + 0x42], edx
mov word [esp + 0x46], ax
jmp 0x1001bb79
push 8
lea ecx, [esp + 0x38]
push 0x1016388c
push ecx
call fcn.100fdb50
push 6
lea edx, [esp + 0x4a]
push 0x10163894
push edx
call fcn.100fdb50
add esp, 0x18
jmp 0x1001bb79
push 4
lea eax, [esp + 0x56]
push 0x101638c4
push eax
call fcn.100fdb50
add esp, 0xc
jmp 0x1001bb79
cmp edi, 0x4d6c
ja 0x1001ba61
je 0x1001ba59
mov eax, edi
sub eax, 0x4cd3
je 0x1001ba11
sub eax, 0x33
je 0x1001b9a4
sub eax, 0x33
je 0x1001bb0a
jmp 0x1001bb79
lea edi, [esp + 0x4c]
add edi, 0xfffffffe
jmp 0x1001b9b0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1001b9b0
mov ecx, dword [0x10163834]
mov eax, dword [0x1016383c]
mov edx, dword [0x10163838]
mov dword [edi], ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], edx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x10163840]
mov word [esp + eax + 0x76], cx
add eax, 2
test cx, cx
jne 0x1001b9e0
push 4
lea ecx, [esp + 0x7e]
push 0x10163848
push ecx
call fcn.100fdb50
mov edi, dword [esp + 0x1c]
add esp, 0xc
jmp 0x1001bb79
push 1
lea edx, [esp + 0x50]
push 0x1016389c
push edx
call fcn.100fe1b7
mov eax, dword [0x101638a0]
mov cx, word [0x101638a4]
add esp, 0xc
mov dword [esp + 0x56], eax
mov word [esp + 0x5a], cx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str._message_f]
mov word [esp + eax + 0x5a], cx
add eax, 2
test cx, cx
jne 0x1001ba40
jmp 0x1001bb79
or ebx, 0xffffffff
jmp 0x1001bb79
mov eax, edi
sub eax, 0x4d9f
je 0x1001bb45
sub eax, 0x33
je 0x1001bb28
sub eax, 0x33
jne 0x1001bb79
mov esi, 0x3ea6
mov eax, esi
sub eax, 0x3ea6
je 0x1001baba
sub eax, 0x1f
je 0x1001ba9e
sub eax, 0x1f
je 0x1001b836
jmp 0x1001bafb
push 0x104
lea edx, [esp + 0x8c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [esp + 0xc], 1
jmp 0x1001bafb
cmp byte [esp + 0xe], 0
je 0x1001bafb
mov edi, dword [esp + 0x18]
push 0
lea eax, [esp + 0x88]
push eax
push 0x400
lea ecx, [esp + 0x29c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x10]
add esi, 0x1f
cmp esi, 0x3ee4
jbe 0x1001ba85
push 4
lea eax, [esp + 0x80]
push 0x1016382c
push eax
call fcn.100fdf85
add esp, 0xc
mov byte [esp + 0xd], 1
jmp 0x1001bb79
cmp byte [esp + 0xf], 0
je 0x1001bb3b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0xd], 0
mov cl, byte [esp + 0xd]
mov byte [esp + 0xe], cl
jmp 0x1001bb79
push 0
push 0
push 0x200
push 0x200
push 0xff
push 6
push 3
lea eax, [esp + 0x3c]
lea edx, [esp + 0x68]
push eax
mov dword [esp + 0x38], edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ebx, eax
cmp ebx, 0xffffffff
sete byte [esp + 0xf]
add edi, 0x33
mov dword [esp + 0x10], edi
cmp edi, dword [esp + 0x14]
jbe 0x1001b7a0
mov al, byte [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret