Function at 0x10008790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xb8
mov eax, dword [0x1003d090]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xc0]
push ebp
push esi
mov esi, dword [esp + 0xc4]
push edi
mov ebp, 1
cmp eax, 0x404
je 0x100089ab
cmp eax, 0x405
jne 0x100087ef
test esi, esi
je 0x100089bf
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x100089bf
mov eax, dword [esi]
push edx
mov edx, dword [eax + 4]
push ecx
mov ecx, esi
call edx
jmp 0x100089bf
cmp eax, 0x406
je 0x100089ab
cmp eax, 0x407
je 0x100089ab
cmp eax, 0x408
jne 0x1000897f
test esi, esi
je 0x100089bf
cmp dword [esi + 0x64c], 0
jne 0x100089bf
push 0x7f
lea eax, [esp + 0x3d]
push 0
push eax
mov byte [esp + 0x44], 0
call sub.MSVCR90.dll_memset
mov al, 0x33
mov dl, 0x34
mov byte [esp + 0x1d], al
mov byte [esp + 0x21], al
mov al, 0x2d
mov cl, 0x41
mov byte [esp + 0x1c], dl
mov byte [esp + 0x24], al
mov byte [esp + 0x25], dl
mov byte [esp + 0x27], dl
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2e], al
mov dl, 0x31
mov byte [esp + 0x33], al
mov al, 0x32
add esp, 0xc
mov byte [esp + 0x12], 0x38
mov byte [esp + 0x13], 0x36
mov byte [esp + 0x14], 0x46
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], 0x39
mov byte [esp + 0x1a], 0x35
mov byte [esp + 0x1c], 0x44
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x39
mov byte [esp + 0x21], 0x66
mov byte [esp + 0x23], 0x42
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x35
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], 0x38
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2c], 0x37
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0x35
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], cl
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x43
mov byte [esp + 0x33], 0x36
mov byte [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [esp + 0x14]
push ecx
push str._s_d
lea edx, [esp + 0x44]
push 0x80
push edx
call dword [sym.imp.MSVCR90.dll_sprintf_s]
mov ecx, dword [esi + 0xc4]
add esp, 0x14
lea edi, [esi + 0x18c]
push edi
lea eax, [esp + 0x3c]
push eax
push 0
push 0x1f0003
push ecx
call fcn.10013d50
mov edx, eax
call fcn.1006ddfc
cmp dword [edi], 0
jne 0x1000894f
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi], eax
mov edi, dword [edi]
test edi, edi
je 0x1000895c
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call fcn.100ceea6
mov ecx, dword [esi + 0x1c]
or dword [esi + 0x8c], 2
test ecx, ecx
je 0x10008977
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov dword [esi + 0x64c], ebp
jmp 0x100089bf
cmp eax, 0x409
jne 0x100089a4
test esi, esi
je 0x100089bf
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x100089a0
mov eax, dword [esi]
push edx
mov edx, dword [eax + 0xc]
push ecx
mov ecx, esi
call edx
mov ebp, eax
jmp 0x100089bf
xor ebp, ebp
jmp 0x100089bf
cmp eax, 0x40a
jne 0x100089bf
test esi, esi
je 0x100089bf
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x100089bf
mov eax, dword [esi]
mov edx, dword [eax]
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.10031c98
add esp, 0xb8
ret 8