Function at 0x54d4a0
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x65eddf
mov eax, dword fs:[0]
push eax
mov eax, 0x2848
call fcn.006218a0
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x2844], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x285c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x286c]
mov eax, esi
mov ebp, ecx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54d4f0
sub eax, edx
cmp eax, 0x2800
ja 0x54de0e
push esi
call fcn.00406b80
add esp, 4
test eax, eax
jne 0x54de0e
lea edx, [esp + 0x58]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x54d520
lea ecx, [esp + 0x38]
call fcn.00402500
mov dword [esp + 0x2864], 0
lea ecx, [esp + 0x30]
call fcn.00402500
mov byte [esp + 0x2864], 1
lea eax, [esp + 0x58]
push 0x40
push eax
mov byte [esp + 0x27], 0
call fcn.00621750
add esp, 8
test eax, eax
je 0x54d70e
lea ecx, [esp + 0x58]
push 0x679990
push ecx
call fcn.00621810
mov esi, eax
add esp, 8
test esi, esi
je 0x54d70e
mov edx, esi
lea eax, [esp + 0x58]
sub edx, eax
cmp edx, 8
jg 0x54d70e
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54d5a0
sub eax, edx
cmp eax, 4
jbe 0x54d70e
add esi, 3
push 0x68a7b8
push esi
call fcn.006228d0
add esp, 8
test eax, eax
je 0x54d70e
cmp byte [eax], 0x40
jne 0x54d70e
inc eax
push 0x68a7b8
push eax
call fcn.006228d0
mov edi, eax
add esp, 8
cmp byte [edi], 0x40
jne 0x54d70e
mov edi, edi
lea eax, [edi + 1]
push 0x68a7b8
push eax
call fcn.006228d0
add esp, 8
test eax, eax
je 0x54d60e
cmp byte [eax], 0x40
jne 0x54d60e
mov edi, eax
jmp 0x54d5f0
lea ecx, [esp + 0x28]
call fcn.00402500
mov byte [esp + 0x2864], 2
mov ebx, edi
sub ebx, esi
lea ecx, [ebx + 1]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00402850
push ebx
push esi
push eax
mov dword [esp + 0x38], eax
call fcn.00621d10
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x48]
push ecx
push eax
mov byte [eax + ebx], 0
call fcn.0054c920
add esp, 0x18
test eax, eax
je 0x54d6fd
lea ecx, [esp + 0x20]
mov byte [esp + 0x1f], 1
call fcn.00402500
mov byte [esp + 0x2864], 3
lea edx, [esp + 0x58]
sub esi, edx
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x24]
call fcn.00402850
push esi
lea ecx, [esp + 0x5c]
mov ebx, eax
push ecx
push ebx
call fcn.00621d10
add esp, 0xc
lea ecx, [esp + 0x18]
mov byte [ebx + esi], 0
call fcn.00402500
mov byte [esp + 0x2864], 4
mov edx, dword [esp + 0x20]
inc edi
push edi
push edx
lea eax, [esp + 0x20]
push 0x678de0
push eax
call fcn.00402f70
mov ecx, dword [esp + 0x28]
push 0x2800
push ecx
lea edx, [esp + 0x70]
push edx
call fcn.004054a0
add esp, 0x1c
mov byte [esp + 0x2864], 3
lea ecx, [esp + 0x18]
call fcn.00402570
mov byte [esp + 0x2864], 2
lea ecx, [esp + 0x20]
call fcn.00402570
mov byte [esp + 0x2864], 1
lea ecx, [esp + 0x28]
call fcn.00402570
lea eax, [esp + 0x58]
push 0x679990
push eax
call fcn.00621810
add esp, 8
test eax, eax
je 0x54dace
add eax, 4
push 0x2f
push eax
call fcn.00621750
mov esi, eax
add esp, 8
test esi, esi
je 0x54dace
inc esi
push 0x6aaf28
push esi
mov dword [esp + 0x58], esi
call fcn.00621810
add esp, 8
test eax, eax
jne 0x54d76d
push str._26
push esi
call fcn.00621810
add esp, 8
test eax, eax
je 0x54dace
lea ecx, [esp + 0x20]
call fcn.00402500
mov byte [esp + 0x2864], 5
push esi
lea ecx, [esp + 0x24]
push 0x678ea8
push ecx
call fcn.00402f70
add esp, 0xc
push 0x6aaf28
push str._26
lea ecx, [esp + 0x28]
call fcn.00402c10
mov edx, dword [esp + 0x20]
push 0x6aaf28
push edx
call fcn.00621810
add esp, 8
mov byte [esp + 0x27], 0
test eax, eax
je 0x54dabd
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x54d7c8
sub ecx, esi
cmp ecx, 3
jbe 0x54da68
lea edi, [eax + 2]
push 0x3b
push edi
call fcn.00621750
add esp, 8
test eax, eax
je 0x54da68
sub eax, edi
mov ebx, eax
je 0x54da2e
push 0x6aaf28
lea ecx, [esp + 0x38]
call fcn.004030b0
mov byte [esp + 0x2864], 6
lea ecx, [esp + 0x18]
call fcn.00402500
mov byte [esp + 0x2864], 7
mov al, byte [edi]
mov byte [esp + 0x17], 1
mov byte [esp + 0x26], 1
cmp al, 0x78
je 0x54d88c
cmp al, 0x58
je 0x54d88c
xor esi, esi
mov byte [esp + 0x26], 0
test ebx, ebx
jbe 0x54d901
movsx eax, byte [esi + edi]
push eax
call fcn.0062214c
add esp, 4
test eax, eax
jne 0x54d85b
mov byte [esp + 0x17], al
jmp 0x54d885
mov cl, byte [esi + edi]
mov byte [esp + 0x44], cl
mov edx, dword [esp + 0x44]
push edx
lea ecx, [esp + 0x38]
call fcn.00415b70
mov al, byte [esi + edi]
mov byte [esp + 0x54], al
mov ecx, dword [esp + 0x54]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00415b70
inc esi
cmp esi, ebx
jb 0x54d844
jmp 0x54d8f6
mov byte [esp + 0x4c], al
mov edx, dword [esp + 0x4c]
push edx
lea ecx, [esp + 0x38]
call fcn.00415b70
mov esi, 1
cmp ebx, esi
jbe 0x54d901
jmp 0x54d8b0
movsx eax, byte [esi + edi]
push eax
call fcn.006221d0
add esp, 4
test eax, eax
jne 0x54d8c7
mov byte [esp + 0x17], al
jmp 0x54d8f1
mov cl, byte [esi + edi]
mov byte [esp + 0x40], cl
mov edx, dword [esp + 0x40]
push edx
lea ecx, [esp + 0x38]
call fcn.00415b70
mov al, byte [esi + edi]
mov byte [esp + 0x48], al
mov ecx, dword [esp + 0x48]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00415b70
inc esi
cmp esi, ebx
jb 0x54d8b0
cmp byte [esp + 0x17], 0
je 0x54da46
push 0x68a82c
lea ecx, [esp + 0x38]
mov byte [esp + 0x2b], 1
call fcn.00403070
cmp byte [esp + 0x26], 0
je 0x54d963
push 0x68cf7c
lea ecx, [esp + 0x40]
call fcn.004030b0
mov byte [esp + 0x2864], 8
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.0040e590
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.00402c10
mov byte [esp + 0x2864], 7
lea ecx, [esp + 0x3c]
jmp 0x54da07
lea ecx, [esp + 0x28]
call fcn.00402500
mov byte [esp + 0x2864], 9
mov edx, dword [esp + 0x18]
push edx
call fcn.006219a1
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 4
mov word [esp + 0x2c], ax
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
push ecx
push eax
push 0xfde9
mov word [esp + 0x4e], ax
call ebx
mov esi, eax
test esi, esi
je 0x54d9fb
push esi
lea ecx, [esp + 0x2c]
call fcn.00402850
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
lea edx, [esp + 0x40]
push edx
push 0
push 0xfde9
call ebx
test eax, eax
je 0x54d9fb
mov eax, dword [esp + 0x28]
push eax
call fcn.004aed50
mov esi, eax
add esp, 4
test esi, esi
je 0x54d9fb
mov ecx, dword [esp + 0x34]
push esi
push ecx
lea ecx, [esp + 0x28]
call fcn.00402c10
push esi
call fcn.005f4432
add esp, 4
mov byte [esp + 0x2864], 7
lea ecx, [esp + 0x28]
call fcn.00402570
mov byte [esp + 0x2864], 6
lea ecx, [esp + 0x18]
call fcn.00402570
mov byte [esp + 0x2864], 5
lea ecx, [esp + 0x34]
call fcn.00402570
push 0x6aaf28
push edi
call fcn.00621810
add esp, 8
test eax, eax
jne 0x54d7c3
jmp 0x54da68
mov byte [esp + 0x2864], 6
lea ecx, [esp + 0x18]
call fcn.00402570
mov byte [esp + 0x2864], 5
lea ecx, [esp + 0x34]
call fcn.00402570
cmp byte [esp + 0x27], 0
je 0x54dabd
mov eax, dword [esp + 0x20]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x54da78
mov edx, dword [esp + 0x50]
sub ecx, esi
lea esi, [esp + 0x2858]
sub esi, edx
cmp ecx, esi
jge 0x54dabd
mov byte [edx], 0
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x54da97
lea edi, [esp + 0x58]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x54daa7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x2864], 1
lea ecx, [esp + 0x20]
call fcn.00402570
lea edx, [esp + 0x58]
push edx
call fcn.0054bfe0
push 0x3c
mov byte [ebp + 0x7918], al
mov eax, dword [esp + 0x2878]
lea esi, [ebp + 4]
push 0
push esi
mov dword [ebp + 0x7914], eax
call fcn.00620850
lea eax, [ebp + 0x2840]
lea ecx, [ebp + 0x5040]
mov byte [eax], 0
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x5108]
mov byte [ecx], 0
mov dword [ebp + 0x28], ecx
add esp, 0x10
xor ecx, ecx
lea edi, [ebp + 0x40]
lea ebx, [ebp + 0x7908]
lea edx, [ebp + 0x50a4]
mov dword [ebp + 0x30], eax
lea eax, [esp + 0x58]
mov word [ebp + 0x1c], cx
mov byte [ebp + 0x791c], cl
mov byte [ebp + 0x791d], cl
mov byte [ebp + 0x791e], cl
mov byte [edi], 0
mov byte [ebx], 0
mov byte [ebp + 0x5108], 0
mov byte [edx], 0
mov dword [esi], 0x3c
mov dword [ebp + 0x3c], 0x2800
mov dword [ebp + 0x18], 0x2800
mov dword [ebp + 0x2c], 0x64
mov dword [ebp + 0xc], 0xa
mov dword [ebp + 0x34], 0x2800
mov dword [ebp + 0x24], 0x64
mov dword [ebp + 0x38], edi
mov dword [ebp + 8], ebx
mov dword [ebp + 0x20], edx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x54db93
push esi
push 0
sub eax, ecx
push eax
lea edx, [esp + 0x64]
push edx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x54dde9
push 0x26
lea ebx, [ebp + 0x5108]
push ebx
call fcn.00621750
add esp, 8
test eax, eax
je 0x54dbe1
push str._IDMAppersandRpl_SS_P789EO96_
push ebx
call fcn.00621810
add esp, 8
test eax, eax
jne 0x54dbe1
mov byte [ebp + 0x791c], 1
push 0x5b
push ebx
call fcn.00621750
add esp, 8
test eax, eax
je 0x54dc09
push str._IDM_LSB_Rpl_SS_P789EO96_
push ebx
call fcn.00621810
add esp, 8
test eax, eax
jne 0x54dc09
mov byte [ebp + 0x791d], 1
push 0x5d
push ebx
call fcn.00621750
add esp, 8
test eax, eax
je 0x54dc31
push str._IDM_RSB_Rpl_SS_P789EO96_
push ebx
call fcn.00621810
add esp, 8
test eax, eax
jne 0x54dc31
mov byte [ebp + 0x791e], 1
push 3
push 0x679bec
lea ebx, [ebp + 0x7908]
push ebx
call fcn.00624bdd
add esp, 0xc
test eax, eax
je 0x54dcc6
push 3
push 0x679be0
push ebx
call fcn.00624bdd
add esp, 0xc
test eax, eax
je 0x54dcc6
push 4
push str.rtmp
push ebx
call fcn.00624bdd
add esp, 0xc
test eax, eax
je 0x54dcc6
cmp byte [ebp + 0x7918], 0
jne 0x54dcd3
lea eax, [ebp + 0x5108]
push 0x25
push eax
call fcn.00621750
add esp, 8
test eax, eax
je 0x54dcc6
mov bl, 0x30
cmp byte [eax], 0x25
jne 0x54dd50
cmp byte [eax + 1], 0x32
lea ecx, [eax + 1]
jne 0x54dd50
cmp byte [eax + 2], bl
jne 0x54dd50
cmp byte [ecx], 0
je 0x54dcc6
push 0x25
push ecx
call fcn.00621750
add esp, 8
test eax, eax
jne 0x54dc93
cmp byte [ebp + 0x7918], 0
je 0x54de5c
mov eax, dword [ebp + 0x30]
push eax
lea ecx, [esp + 0x30]
call fcn.004030b0
mov byte [esp + 0x2864], 0xa
mov ebx, dword [esp + 0x2870]
mov ecx, dword [ebp + 0x30]
push ebx
push ecx
call fcn.005b7cb0
lea eax, [ebp + 0x7908]
push 0x679bec
push eax
call fcn.00621c8e
add esp, 0x10
test eax, eax
jne 0x54de4b
mov edx, dword [ebp + 0x30]
push edx
call fcn.0054bfe0
add esp, 4
test al, al
je 0x54de4b
mov ecx, dword [esp + 0x2c]
mov eax, dword [ebp + 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x54dd5c
test dl, dl
je 0x54dd4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x54dd5c
add eax, 2
add ecx, 2
test dl, dl
jne 0x54dd30
xor eax, eax
jmp 0x54dd61
mov ecx, ebp
call fcn.0054c6e0
jmp 0x54e102
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x54de4b
push edi
lea ecx, [esp + 0x2c]
call fcn.004030b0
mov byte [esp + 0x2864], 0xb
mov eax, 0x2800
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x18], eax
mov ecx, 0x64
mov dword [ebp + 0x34], eax
lea eax, [esp + 0x58]
mov dword [esi], 0x3c
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0xc], 0xa
mov dword [ebp + 0x24], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54dda8
push esi
sub eax, edx
push 0x10000000
push eax
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x54de15
mov byte [esp + 0x2864], 0xa
lea ecx, [esp + 0x28]
call fcn.00402570
mov byte [esp + 0x2864], 1
lea ecx, [esp + 0x2c]
call fcn.00402570
mov byte [esp + 0x2864], 0
lea ecx, [esp + 0x30]
call fcn.00402570
mov dword [esp + 0x2864], 0xffffffff
lea ecx, [esp + 0x38]
call fcn.00402570
xor eax, eax
jmp 0x54e12c
mov ecx, dword [ebp + 0x30]
push ebx
push ecx
call fcn.005b7cb0
mov ecx, dword [esp + 0x30]
mov edx, dword [ebp + 0x38]
add esp, 8
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x54de30
mov byte [esp + 0x2864], 0xa
lea ecx, [esp + 0x28]
call fcn.00402570
mov byte [esp + 0x2864], 1
lea ecx, [esp + 0x2c]
jmp 0x54dfb6
push edi
lea ecx, [esp + 0x1c]
call fcn.004030b0
mov byte [esp + 0x2864], 0xc
mov eax, 0x64
mov edi, 0x2800
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x24], eax
lea eax, [esp + 0x58]
mov dword [esi], 0x3c
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0xc], 0xa
mov dword [ebp + 0x34], edi
lea edx, [eax + 1]
jmp 0x54dea0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54dea0
push esi
sub eax, edx
push 0x10000000
push eax
lea edx, [esp + 0x64]
push edx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x54ded0
mov byte [esp + 0x2864], 1
lea ecx, [esp + 0x18]
jmp 0x54dde4
lea eax, [ebp + 0x5108]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54dee0
sub eax, edx
xor ecx, ecx
test eax, eax
jle 0x54df53
nop
cmp byte [ecx + ebp + 0x5108], 0x7f
lea esi, [ebp + 0x5108]
ja 0x54df07
inc ecx
cmp ecx, eax
jl 0x54def0
jmp 0x54df53
push 0x25
push esi
call fcn.00621750
add esp, 8
test eax, eax
jne 0x54df53
push esi
call fcn.004aed50
add esp, 4
test eax, eax
je 0x54df53
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x54df28
sub ecx, esi
cmp ecx, edi
jae 0x54df4a
lea esi, [ebp + 0x5108]
mov ecx, eax
sub esi, eax
nop
mov dl, byte [ecx]
mov byte [ecx + esi], dl
inc ecx
test dl, dl
jne 0x54df40
push eax
call fcn.005f4432
add esp, 4
mov eax, dword [esp + 0x18]
push 0x23
push eax
call fcn.00621750
mov esi, eax
add esp, 8
test esi, esi
je 0x54df95
push 0x67a490
lea edi, [ebp + 0x7908]
push edi
call fcn.00621c8e
add esp, 8
test eax, eax
je 0x54df92
push 0x679be4
push edi
call fcn.00621c8e
add esp, 8
test eax, eax
jne 0x54df95
mov byte [esi], 0
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp + 0x38]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x54dfa0
mov byte [esp + 0x2864], 1
lea ecx, [esp + 0x18]
call fcn.00402570
mov ecx, ebp
call fcn.0054c6e0
cmp byte [ebp + 0x791c], 0
je 0x54dfea
lea eax, [ebp + 0x5108]
push str._IDMAppersandRpl_SS_P789EO96_
push eax
call fcn.00621810
add esp, 8
test eax, eax
je 0x54dfea
mov byte [ebp + 0x791c], 0
cmp byte [ebp + 0x791d], 0
je 0x54e012
lea eax, [ebp + 0x5108]
push str._IDM_LSB_Rpl_SS_P789EO96_
push eax
call fcn.00621810
add esp, 8
test eax, eax
je 0x54e012
mov byte [ebp + 0x791d], 0
cmp byte [ebp + 0x791e], 0
je 0x54e03a
lea eax, [ebp + 0x5108]
push str._IDM_RSB_Rpl_SS_P789EO96_
push eax
call fcn.00621810
add esp, 8
test eax, eax
je 0x54e03a
mov byte [ebp + 0x791e], 0
cmp byte [esp + 0x1f], 0
je 0x54e091
mov ecx, dword [esp + 0x38]
mov eax, ecx
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x54e050
sub eax, esi
cmp eax, 0x64
jae 0x54e091
mov eax, dword [esp + 0x30]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x54e065
sub eax, esi
cmp eax, 0x64
jae 0x54e091
mov edx, dword [ebp + 0x20]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x54e076
mov ecx, dword [esp + 0x30]
mov edx, dword [ebp + 0x28]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x54e087
push 0x679be0
lea esi, [ebp + 0x7908]
push esi
call fcn.00621c8e
add esp, 8
test eax, eax
jne 0x54e0bc
xor ecx, ecx
cmp cx, word [ebp + 0x1c]
jne 0x54e0bc
mov edx, 0x6db
mov word [ebp + 0x1c], dx
jmp 0x54e102
push str.rtmp
push esi
call fcn.00621c8e
add esp, 8
test eax, eax
jne 0x54e0df
cmp ax, word [ebp + 0x1c]
jne 0x54e0df
mov ecx, 0x78f
mov word [ebp + 0x1c], cx
jmp 0x54e102
push str.rtmpt
push esi
call fcn.00621c8e
add esp, 8
test eax, eax
jne 0x54e102
xor edx, edx
cmp dx, word [ebp + 0x1c]
jne 0x54e102
mov eax, 0x50
mov word [ebp + 0x1c], ax
mov byte [esp + 0x2864], 0
lea ecx, [esp + 0x30]
call fcn.00402570
mov dword [esp + 0x2864], 0xffffffff
lea ecx, [esp + 0x38]
call fcn.00402570
mov eax, 1
mov ecx, dword [esp + 0x285c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2844]
xor ecx, esp
call fcn.0062016f
add esp, 0x2854
ret 8