Function at 0x100089b0
Capabilities:
Contain obfuscated stackstrings
Extract http body
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x100748d1
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x1008c54c]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c54c]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x240], ebx
test byte [0x10090690], 1
mov eax, 0xf2
mov word [esp + 0xb4], ax
mov ecx, 0x34
mov word [esp + 0xb6], cx
mov edx, 0xdb
mov word [esp + 0xb8], dx
mov eax, 0x38
mov word [esp + 0xba], ax
mov ecx, 0x9c
mov word [esp + 0xbc], cx
mov edx, 0x2b
mov word [esp + 0xbe], dx
mov eax, 0x7f
mov word [esp + 0xc0], ax
mov ecx, 0xc7
mov word [esp + 0xc2], cx
mov edx, 0x18
mov word [esp + 0xc4], dx
mov eax, 0x89
mov word [esp + 0xc6], ax
mov ecx, 0xda
mov edx, 0x93
mov eax, 0x56
mov word [esp + 0xc8], cx
mov word [esp + 0xcc], dx
mov word [esp + 0xce], ax
mov ecx, 0xb4
mov edx, 0x4d
mov eax, 0xe8
mov word [esp + 0xd0], cx
mov word [esp + 0xd2], dx
mov word [esp + 0xd4], ax
mov ecx, 0x11
mov edx, 0x1d
mov eax, 0xab
mov word [esp + 0xd6], cx
mov word [esp + 0xd8], dx
mov word [esp + 0xda], ax
mov ecx, 0x79
mov edx, 0xe7
mov eax, 0xb1
mov word [esp + 0xdc], cx
mov word [esp + 0xde], dx
mov word [esp + 0xe0], ax
jne 0x10008b58
or dword [0x10090690], 1
lea ecx, [esp + 0xb4]
push ecx
lea eax, [esp + 0xd0]
mov byte [esp + 0x244], 1
call fcn.10043d20
push 0x100784d0
call fcn.1005f1f6
add esp, 4
mov byte [esp + 0x240], bl
mov ebp, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, dword [0x10090668]
lea eax, [esp + 0xa4]
xor edx, edx
push eax
mov word [esp + 0xa8], dx
call ebp
mov ecx, 8
push edi
mov word [esp + 0xa8], cx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0xac], eax
cmp eax, ebx
jne 0x10008bbd
cmp edi, ebx
je 0x10008bbd
mov edx, 0xa
push 0x8007000e
mov word [esp + 0xa8], dx
mov dword [esp + 0xb0], 0x8007000e
call fcn.10001c10
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xb4]
push eax
push str.LLLLL
push ebx
push ebx
push 1
add esi, 0x74
push 0x1f4
push esi
mov byte [esp + 0x26c], 2
call fcn.1004a6cf
add esp, 0x2c
lea ecx, [esp + 0xa4]
push ecx
mov byte [esp + 0x244], bl
call ebp
push ebx
lea edx, [esp + 0x20]
push edx
push 9
push 2
push 0xcb
push esi
call fcn.1004a6cf
mov eax, dword [esp + 0x34]
add esp, 0x18
mov esi, eax
mov dword [esp + 0x24], esi
cmp eax, ebx
je 0x10009a31
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov al, 0x92
sub al, byte [0x1008d8c0]
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0xa4], al
mov dword [esp + 0x1c], ebx
mov eax, dword [esi]
mov edx, dword [eax]
push str._D_3
push esi
mov dword [esp + 0x34], esi
call edx
mov al, byte [0x1008d8c1]
mov cl, 0x46
imul cl
mov cl, 0xd7
sub cl, al
cmp dword [esp + 0x18], ebx
jne 0x10008c81
mov dword [esp + 0x240], 0xffffffff
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
jmp 0x10009a31
mov dword [esp + 0x20], ebx
mov al, cl
mov cl, 0x92
imul cl
mov byte [0x1008d8bc], al
mov edx, 0xb
mov eax, 0xffffffff
mov word [esp + 0x64], dx
mov word [esp + 0x6c], ax
mov byte [esp + 0x240], 5
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov ebx, 0x1007e7f2
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
call fcn.1001bcb0
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x10008ce8
push 0x8007000e
call fcn.10001c10
lea edi, [esp + 0x1c]
lea esi, [esp + 0xb4]
mov byte [esp + 0x240], 6
call fcn.1002d3d0
mov byte [esp + 0x240], 7
test byte [0x10090688], 1
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
mov byte [esp + 0x94], 0x45
mov byte [esp + 0x95], 0x20
mov byte [esp + 0x96], 0xf3
mov byte [esp + 0x97], 0xb4
mov byte [esp + 0x98], 0x1c
mov byte [esp + 0x88], 0x1a
mov byte [esp + 0x89], 0x53
mov byte [esp + 0x8a], 0x96
mov byte [esp + 0x8b], 0xd8
mov byte [esp + 0x8c], 0x7a
jne 0x10008db3
or dword [0x10090688], 1
lea esi, [esp + 0x88]
lea edi, [esp + 0x94]
mov byte [esp + 0x240], 8
call fcn.10043e30
push 0x100784f0
call fcn.1005f1f6
add esp, 4
mov byte [esp + 0x240], 7
mov ebx, dword [0x10090660]
test ebx, ebx
je 0x10008dd7
call fcn.1001bcb0
mov dword [esp + 0x94], eax
test eax, eax
jne 0x10008de2
push 0x8007000e
call fcn.10001c10
mov dword [esp + 0x94], 0
lea edi, [esp + 0x94]
lea esi, [esp + 0xcc]
mov byte [esp + 0x240], 9
call fcn.1002d3d0
mov bl, 0xa
mov byte [esp + 0x240], bl
test byte [0x1009068c], 1
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov byte [esp + 0xa4], 0x36
mov byte [esp + 0xa5], 0xab
mov byte [esp + 0xa6], 0x48
mov byte [esp + 0xa7], 0x3e
mov byte [esp + 0xa8], 0x4f
mov byte [esp + 0xa9], 0x11
mov byte [esp + 0xaa], 0xe2
mov byte [esp + 0xab], 0xdd
mov byte [esp + 0xac], 0x95
mov byte [esp + 0x88], 0x42
mov byte [esp + 0x89], 0xce
mov byte [esp + 0x8a], 0x30
mov byte [esp + 0x8b], 0x4a
mov byte [esp + 0x8c], 0x60
mov byte [esp + 0x8d], 0x79
mov byte [esp + 0x8e], 0x96
mov byte [esp + 0x8f], 0xb0
mov byte [esp + 0x90], 0xf9
jne 0x10008ef4
or dword [0x1009068c], 1
lea esi, [esp + 0x88]
lea edi, [esp + 0xa4]
mov byte [esp + 0x240], 0xb
call fcn.10043d80
push 0x100784e0
call fcn.1005f1f6
add esp, 4
mov byte [esp + 0x240], bl
mov ebx, dword [0x10090664]
test ebx, ebx
je 0x10008f1a
call fcn.1001bcb0
mov esi, eax
mov dword [esp + 0x88], esi
test esi, esi
jne 0x10008f23
push 0x8007000e
call fcn.10001c10
xor esi, esi
mov dword [esp + 0x88], esi
mov byte [esp + 0x240], 0xc
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x58]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x74]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x58]
mov ecx, dword [ebp]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x74]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x50]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x64]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x6c]
push esi
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0xf4]
push ebp
call eax
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, eax
call esi
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0xcc]
push ecx
call ebx
mov edx, dword [esp + 0x94]
push edx
call esi
lea eax, [esp + 0xb4]
push eax
call ebx
mov ecx, dword [esp + 0x1c]
push ecx
call esi
lea edx, [esp + 0x64]
push edx
mov byte [esp + 0x244], 4
call ebx
mov bl, byte [0x1008d8bf]
add bl, byte [esp + 0xa0]
sub bl, 0x75
test edi, edi
jge 0x10009017
mov byte [esp + 0x240], 3
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10009a02
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x10009a02
push 1
push 0
push 0xc
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov ebp, eax
mov al, byte [esp + 0xa0]
mov cl, byte [0x1008d8bf]
imul bl
mov dl, al
mov al, cl
sub al, dl
add al, 0x62
imul cl
imul byte [0x1008d8be]
imul byte [0x1008d8bd]
imul byte [esp + 0xa0]
imul bl
imul bl
mov byte [0x1008d8bc], al
mov eax, 0x38
mov word [esp + 0xe4], ax
mov ecx, 0x73
mov word [esp + 0xe6], cx
mov edx, 0x37
mov word [esp + 0xe8], dx
mov eax, 0xfd
mov word [esp + 0xea], ax
mov ecx, 0x3f
mov word [esp + 0xec], cx
mov edx, 0x50
mov word [esp + 0xee], dx
mov eax, 0xca
mov word [esp + 0xf0], ax
mov ecx, 0x26
mov word [esp + 0xf2], cx
mov edx, 0x56
mov word [esp + 0xf4], dx
mov eax, 0x40
mov word [esp + 0xf6], ax
mov ecx, 0xc0
mov word [esp + 0xf8], cx
mov edx, 0xf6
mov word [esp + 0xfa], dx
mov eax, 0x6c
mov word [esp + 0xfc], ax
mov ecx, 0xe6
mov word [esp + 0xfe], cx
mov edx, 0x1f
mov word [esp + 0x100], dx
mov eax, 0xd
mov word [esp + 0x102], ax
mov ecx, 0x94
mov word [esp + 0x104], cx
mov edx, 0x5e
mov word [esp + 0x106], dx
mov eax, 0x38
mov word [esp + 0x108], ax
mov ecx, 0xe6
mov edx, 0xad
mov eax, 0xa0
mov word [esp + 0x10a], cx
mov word [esp + 0x10c], dx
mov word [esp + 0x10e], ax
mov ecx, 0x66
mov edx, 0xdb
mov eax, 0x11
mov word [esp + 0x110], cx
mov word [esp + 0x112], dx
mov word [esp + 0x114], ax
mov ecx, 0x81
mov edx, 0xfd
mov eax, 0x22
mov word [esp + 0x116], cx
mov word [esp + 0x118], dx
mov word [esp + 0x11a], ax
mov ecx, 0x2a
mov edx, 0xc0
mov eax, 0x15
mov word [esp + 0x11c], cx
mov word [esp + 0x11e], dx
mov word [esp + 0x120], ax
mov ecx, 0x99
mov word [esp + 0x122], cx
mov edx, 0x2c
mov word [esp + 0x124], dx
mov eax, 0x45
mov word [esp + 0x126], ax
mov ecx, 0x7f
mov word [esp + 0x128], cx
mov edx, 0x26
mov word [esp + 0x12a], dx
mov eax, 0x72
mov word [esp + 0x12c], ax
mov ecx, 0xc2
mov word [esp + 0x12e], cx
mov edx, 0x36
mov word [esp + 0x130], dx
mov eax, 0x46
mov word [esp + 0x132], ax
mov ecx, 0xb4
mov word [esp + 0x134], cx
mov edx, 0x35
mov word [esp + 0x136], dx
mov eax, 0x34
mov word [esp + 0x138], ax
mov ecx, 0x69
mov word [esp + 0x13a], cx
mov edx, 0x91
mov word [esp + 0x13c], dx
mov eax, 0x67
mov word [esp + 0x13e], ax
mov ecx, 0xf2
mov word [esp + 0x140], cx
mov edx, 0x73
mov word [esp + 0x142], dx
mov eax, 0x42
mov word [esp + 0x144], ax
mov ecx, 0x7a
mov word [esp + 0x146], cx
mov edx, 0xa0
mov word [esp + 0x148], dx
mov eax, 0x3a
mov word [esp + 0x14a], ax
mov ecx, 0xa7
mov word [esp + 0x14c], cx
mov edx, 0x2e
mov word [esp + 0x14e], dx
mov eax, 0x43
mov word [esp + 0x150], ax
mov ecx, 0x6b
mov word [esp + 0x152], cx
mov edx, 0xe
mov eax, edx
mov word [esp + 0x154], dx
mov word [esp + 0x156], ax
mov ecx, 0x2a
mov word [esp + 0x158], cx
mov edx, 0x83
mov word [esp + 0x15a], dx
mov eax, 0x47
mov ecx, 0x52
mov word [esp + 0x15c], ax
mov word [esp + 0x15e], cx
mov edx, 0x68
mov word [esp + 0x160], dx
mov eax, 0x51
mov ecx, 0x56
mov word [esp + 0x162], ax
mov word [esp + 0x164], cx
mov edx, 0x28
mov eax, 0x2c
mov ecx, 0x4b
mov word [esp + 0x166], dx
mov edx, 0x7a
mov word [esp + 0x168], ax
mov word [esp + 0x16a], cx
mov eax, 0xb8
mov ecx, 0xcb
mov word [esp + 0x16c], dx
mov word [esp + 0x16e], ax
mov word [esp + 0x170], cx
mov edx, 0xdb
mov word [esp + 0x172], dx
mov eax, 0x47
mov word [esp + 0x174], ax
mov ecx, 0xc
mov word [esp + 0x176], cx
mov edx, 6
mov word [esp + 0x178], dx
mov eax, 0x5c
mov word [esp + 0x17a], ax
mov ecx, 0x9c
mov word [esp + 0x17c], cx
mov edx, 0x5a
mov word [esp + 0x17e], dx
mov eax, 0x81
mov word [esp + 0x180], ax
mov ecx, 0xf0
mov word [esp + 0x182], cx
mov edx, 0xc4
mov word [esp + 0x184], dx
mov eax, 0xbf
mov word [esp + 0x186], ax
mov ecx, 4
mov word [esp + 0x18c], cx
mov edx, 0x1b
mov word [esp + 0x18e], dx
mov eax, 0x43
mov word [esp + 0x190], ax
mov ecx, 0x90
mov word [esp + 0x192], cx
mov edx, 0x53
mov word [esp + 0x194], dx
mov eax, 0x6e
mov word [esp + 0x196], ax
mov ecx, 0xf6
mov word [esp + 0x198], cx
mov edx, 0x55
mov word [esp + 0x19a], dx
mov eax, 0x22
mov word [esp + 0x19c], ax
mov ecx, 0x39
mov word [esp + 0x19e], cx
mov edx, 0xac
mov word [esp + 0x1a0], dx
mov eax, 0x93
mov word [esp + 0x1a2], ax
mov ecx, 0x52
mov word [esp + 0x1a4], cx
mov edx, 0x8e
mov word [esp + 0x1a6], dx
mov eax, 0x6b
mov word [esp + 0x1a8], ax
mov ecx, 0x60
mov word [esp + 0x1aa], cx
mov edx, 0xf8
mov word [esp + 0x1ac], dx
mov eax, 0x72
mov word [esp + 0x1ae], ax
mov ecx, 0x18
mov edx, 0x84
mov eax, 0xc2
mov word [esp + 0x1b0], cx
mov word [esp + 0x1b2], dx
mov word [esp + 0x1b4], ax
mov ecx, 0xc4
mov edx, 0x1f
mov eax, 0xfb
mov word [esp + 0x1b6], cx
mov word [esp + 0x1b8], dx
mov word [esp + 0x1ba], ax
mov ecx, 0x6a
mov edx, 0xa1
mov eax, 0xb2
mov word [esp + 0x1bc], cx
mov word [esp + 0x1be], dx
mov word [esp + 0x1c0], ax
mov ecx, 0x74
mov edx, 0x6f
mov eax, 0x92
mov word [esp + 0x1c2], cx
mov word [esp + 0x1c4], dx
mov word [esp + 0x1c6], ax
mov ecx, 0x53
mov word [esp + 0x1c8], cx
mov eax, 0x63
mov word [esp + 0x1cc], ax
mov edx, 0xd5
mov word [esp + 0x1ca], dx
mov ecx, 0x12
mov word [esp + 0x1ce], cx
mov eax, 0x7f
mov word [esp + 0x1d2], ax
mov edx, 0x52
mov word [esp + 0x1d0], dx
mov ecx, 0x48
mov word [esp + 0x1d4], cx
mov eax, 0x5e
mov word [esp + 0x1d8], ax
mov edx, 0xe2
mov word [esp + 0x1d6], dx
mov ecx, 0x2f
mov word [esp + 0x1da], cx
mov eax, 0x51
mov ecx, eax
mov word [esp + 0x1de], ax
mov word [esp + 0x1e0], cx
mov edx, 0xd0
mov word [esp + 0x1dc], dx
mov edx, 7
mov word [esp + 0x1e2], dx
mov eax, 0xaa
mov word [esp + 0x1e4], ax
mov ecx, 0x47
mov word [esp + 0x1e6], cx
mov edx, 0xbd
mov word [esp + 0x1e8], dx
mov eax, 0x25
mov word [esp + 0x1ea], ax
mov ecx, 7
mov word [esp + 0x1ec], cx
mov edx, 0x28
mov word [esp + 0x1ee], dx
mov eax, 0xe6
mov word [esp + 0x1f0], ax
mov ecx, 0x76
mov word [esp + 0x1f2], cx
mov edx, 0xe8
mov word [esp + 0x1f4], dx
mov eax, 0x79
mov word [esp + 0x1f6], ax
mov ecx, 0x6e
mov word [esp + 0x1f8], cx
mov edx, 0x33
mov word [esp + 0x1fa], dx
mov eax, 0x34
mov word [esp + 0x1fc], ax
mov ecx, 0x2e
mov word [esp + 0x1fe], cx
mov edx, 0x42
mov word [esp + 0x200], dx
mov eax, 0xea
mov ecx, 0x23
mov word [esp + 0x202], ax
mov word [esp + 0x204], cx
mov edx, 0x36
mov word [esp + 0x206], dx
mov eax, 0xd
mov ecx, 0x3f
mov word [esp + 0x208], ax
mov word [esp + 0x20a], cx
mov edx, 0x6d
mov eax, 8
mov ecx, 0x51
mov word [esp + 0x20c], dx
mov edx, 0x77
mov word [esp + 0x20e], ax
mov word [esp + 0x210], cx
mov eax, 0x55
mov ecx, 0xcb
mov word [esp + 0x212], dx
mov word [esp + 0x214], ax
mov word [esp + 0x216], cx
mov edx, 0xbf
test byte [0x10090684], 1
mov eax, 0xa2
mov ecx, 0x2b
mov word [esp + 0x218], dx
mov word [esp + 0x21a], ax
mov word [esp + 0x21c], cx
mov edx, 0x69
mov eax, 0x38
mov ecx, 0x60
mov word [esp + 0x21e], dx
mov word [esp + 0x220], ax
mov word [esp + 0x222], cx
mov edx, 0xb3
mov eax, 0x32
mov ecx, 0xf5
mov word [esp + 0x224], dx
mov word [esp + 0x226], ax
mov word [esp + 0x228], cx
mov edx, 0x9d
mov eax, 0xa8
mov ecx, 0x81
mov word [esp + 0x22a], dx
mov word [esp + 0x22c], ax
mov word [esp + 0x22e], cx
jne 0x100098e9
or dword [0x10090684], 1
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x190]
mov byte [esp + 0x244], 0xd
call fcn.10043ea0
push 0x10078500
call fcn.1005f1f6
add esp, 4
mov byte [esp + 0x240], 4
mov edi, dword [0x1009065c]
lea esi, [esp + 0x74]
call fcn.1000d520
mov byte [esp + 0x240], 0xe
mov al, byte [0x1008d8bc]
mov cl, 0x19
imul cl
inc al
imul byte [0x1008d8c1]
mov dl, 0x59
imul dl
add al, 0x24
mov byte [esp + 0x9c], al
mov eax, esi
push eax
lea ecx, [esp + 0x44]
push ecx
push ebp
mov byte [0x1008d8bd], 0x18
mov dword [esp + 0x4c], 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov cl, byte [0x1008d8be]
mov al, cl
add cl, byte [esp + 0xa0]
mov dl, 0x21
imul dl
mov dl, al
movzx eax, byte [0x1008d8bc]
sub al, dl
sub al, byte [0x1008d8bd]
push ebp
add al, byte [esp + 0xa4]
add al, 0x46
imul cl
sub al, byte [0x1008d8bd]
movzx ecx, byte [0x1008d8c1]
sub al, 0x7b
imul bl
imul byte [esp + 0xa0]
sub al, byte [0x1008d8bf]
sub cl, byte [0x1008d8bc]
sub al, byte [0x1008d8be]
sub al, byte [0x1008d8c0]
sub al, 0x53
imul cl
mov byte [0x1008d8c0], al
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0xec]
call eax
movzx eax, byte [0x1008d8be]
mov cl, 0xa3
imul cl
mov byte [0x1008d8bd], al
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0xf8]
call eax
push ebp
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
add byte [0x1008d8c0], 0xf3
mov ecx, esi
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x240], 3
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10009a02
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x240], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10009a1a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x240], 0xffffffff
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1005f0c0
add esp, 0x230
ret