Function at 0x1001eac
Capabilities:
Create mailslot
Get hostname
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa04
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x1f8
xor ebx, ebx
push esi
lea eax, [ebp - 0x5f4]
push ebx
push eax
mov dword [ebp - 0x9f8], ecx
mov dword [ebp - 0x5f8], ebx
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x1fc]
push ebx
push eax
mov dword [ebp - 0xa00], ebx
mov dword [ebp - 0x200], ebx
call sub.msvcrt.dll_memset
push 0xe
pop ecx
push 0x1c4
lea eax, [ebp - 0x7bc]
push ebx
mov esi, 0x10012b0
lea edi, [ebp - 0x7f4]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
push 0x1f8
lea eax, [ebp - 0x3f8]
push ebx
push eax
mov dword [ebp - 0x3fc], ebx
call sub.msvcrt.dll_memset
push 0xe
pop ecx
push 0x1c4
lea eax, [ebp - 0x9b8]
push ebx
mov esi, 0x1001278
lea edi, [ebp - 0x9f0]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
add esp, 0x3c
lea eax, [ebp - 0x9fc]
push eax
lea eax, [ebp - 0x5f8]
mov esi, 0xfe
push eax
mov dword [ebp - 0xa04], ebx
mov dword [ebp - 0x9fc], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, ebx
jne 0x1001fa8
push 0x1f7
call fcn.01004b39
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01003992
xor eax, eax
inc eax
jmp 0x1002392
mov edi, dword [ebp - 0x9f8]
push ebx
push dword [edi + 0xa38]
call fcn.01003002
cmp eax, 0xd6
jbe 0x1001fc8
push 0x108
jmp 0x1001f8c
mov ecx, edi
call fcn.01001d3a
cmp eax, 1
jne 0x1001fe9
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x20001
add eax, 0x40
push eax
call fcn.01004b51
jmp 0x1001fa0
lea eax, [edi + 0x1fc]
push ebx
push eax
call fcn.01003002
test eax, eax
jbe 0x1002085
lea eax, [edi + 0x1fc]
push eax
call fcn.01004beb
test eax, eax
je 0x1002036
push esi
lea eax, [edi + 0x200]
push eax
lea eax, [ebp - 0x3fc]
push eax
call fcn.0100390c
push esi
lea eax, [ebp - 0x3fc]
push eax
lea eax, [edi + 0x1fc]
push eax
call fcn.0100390c
lea eax, [edi + 0x1fc]
push eax
call fcn.01004c3a
test eax, eax
lea eax, [edi + 0x1fc]
je 0x100208b
push eax
call fcn.0100505d
test eax, eax
jne 0x1002085
push ebx
lea eax, [ebp - 0x9fc]
push eax
lea eax, [ebp - 0x3fc]
push eax
lea eax, [edi + 0x1fc]
push eax
mov dword [ebp - 0x9fc], esi
call fcn.01004ce4
test eax, eax
jne 0x1002099
push 0x106
jmp 0x1001f8c
lea eax, [ebp - 0x5f8]
push esi
push eax
lea eax, [ebp - 0x3fc]
push eax
call fcn.0100390c
cmp dword [edi + 0xa3c], ebx
je 0x10020b1
cmp dword [edi + 0x7fc], ebx
jne 0x10020b1
cmp dword [edi + 0x9b4], ebx
jne 0x10020c0
push ebx
push edi
call fcn.01003002
test eax, eax
je 0x1002277
push ebx
lea eax, [edi + 0x1fc]
push eax
call fcn.01003002
test eax, eax
jne 0x10020f3
push dword [edi + 0xa38]
lea eax, [ebp - 0x9f0]
push eax
lea eax, [ebp - 0x200]
push esi
push eax
call fcn.01001e4d
add esp, 0x10
jmp 0x1002178
push esi
push 0x1001270
lea eax, [ebp - 0x200]
push eax
call fcn.0100390c
lea eax, [ebp - 0x3fc]
push eax
call fcn.01004beb
test eax, eax
push esi
lea eax, [ebp - 0x3f8]
jne 0x1002122
lea eax, [ebp - 0x3fc]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.0100394f
push esi
push 0x100126c
lea eax, [ebp - 0x200]
push eax
call fcn.0100394f
push esi
push 0x1001240
lea eax, [ebp - 0x200]
push eax
call fcn.0100394f
push esi
push 0x100126c
lea eax, [ebp - 0x200]
push eax
call fcn.0100394f
push esi
push dword [edi + 0xa38]
lea eax, [ebp - 0x200]
push eax
call fcn.0100394f
push ebx
push 0x80
push 3
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10021a6
push 0x1f9
jmp 0x1001f8c
push ebx
lea eax, [edi + 0x1fc]
push eax
call fcn.01003002
push ebx
test eax, eax
lea eax, [ebp - 0xa00]
push eax
push ebx
jbe 0x10021d6
lea eax, [ebp - 0x3fc]
push eax
call fcn.01003002
inc eax
push eax
lea eax, [ebp - 0x3fc]
jmp 0x10021ea
lea eax, [ebp - 0x5f8]
push eax
call fcn.01003002
inc eax
push eax
lea eax, [ebp - 0x5f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x1002253
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4cf
je 0x100222e
push dword [edi + 0xa38]
push 0xfb
call fcn.01004b39
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 1
add eax, 0x40
push 1
push eax
call fcn.010049e6
add esp, 0x14
jmp 0x1001fa0
push 0x1fa
call fcn.01004b39
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01003992
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001fa0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x1001220
add eax, 0x20
push eax
call fcn.01003992
push 0x1f6
jmp 0x100237c
push ebx
lea eax, [edi + 0x1fc]
push eax
call fcn.01003002
push dword [edi + 0xa38]
test eax, eax
jne 0x10022a7
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x200]
push esi
push eax
call fcn.01001e4d
add esp, 0x10
jmp 0x10022d4
mov eax, 0x100126c
push eax
push 0x1001240
push eax
lea eax, [ebp - 0x3fc]
push eax
push 0x1001270
push 0x1001224
lea eax, [ebp - 0x200]
push esi
push eax
call fcn.01001e4d
add esp, 0x24
push ebx
push dword [edi + 0xa40]
lea eax, [ebp - 0x200]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [ebp - 0x9f8], eax
cmp eax, 0xffffffff
jne 0x1002302
push 0xfc
jmp 0x1001f8c
push ebx
lea ecx, [ebp - 0xa04]
push ecx
push esi
lea ecx, [ebp - 0x5f8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x9f8]
mov dword [ebp - 0x9f4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x9f4], ebx
jne 0x1002364
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [ebp - 0x9f4], eax
call ebx
cmp eax, 0x79
jne 0x1002358
push dword [edi + 0xa38]
push 0xfd
jmp 0x100220e
push dword [ebp - 0x9f4]
push esi
jmp 0x100220e
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x1001220
add eax, 0x20
push eax
call fcn.01003992
push 0x1f5
call fcn.01004b39
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
call fcn.01003992
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002710
leave
ret