Function at 0x28b870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ecx, byte [edx]
test cl, cl
je 0x28bb29
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ebp, ebp
je 0x28b8ac
cmp edx, ebp
jae 0x28bb29
test edi, edi
je 0x28bb29
movzx ebx, cl
test cl, cl
js 0x28b8e0
inc edx
lea ecx, [eax + 2]
mov word [eax], bx
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
movzx ecx, byte [edx]
test cl, cl
jne 0x28b8a0
jmp 0x28bb29
mov ebp, ebx
and ebp, 0xffffffe0
cmp ebp, 0xc0
jne 0x28b8f8
cmp cl, 0xc2
jae 0x28b93b
mov ebp, dword [esp + 0x28]
jmp 0x28b8cc
mov esi, ebx
and esi, 0xfffffff0
cmp esi, 0xe0
jne 0x28b96c
movzx esi, byte [edx + 1]
mov dword [esp], esi
cmp cl, 0xed
mov ebp, dword [esp + 0x28]
je 0x28b9c1
cmp ebx, 0xe0
mov ecx, dword [esp]
jne 0x28b9cd
mov ecx, dword [esp]
add cl, 0x40
cmp cl, 0xe0
mov ecx, dword [esp]
jb 0x28b8cc
jmp 0x28b9cd
movzx ecx, byte [edx + 1]
movzx esi, cl
mov ebp, esi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x28b9b7
and ebx, 0x1f
shl ebx, 6
add edx, 2
and esi, 0x3f
or esi, ebx
lea ecx, [eax + 2]
mov word [eax], si
mov ebp, dword [esp + 0x28]
jmp 0x28b8c2
mov esi, ebx
and esi, 0xfffffff8
cmp esi, 0xf0
mov ebp, dword [esp + 0x28]
jne 0x28bb04
cmp cl, 0xf4
ja 0x28b8cc
movzx ecx, byte [edx + 1]
mov dword [esp], ecx
je 0x28ba21
cmp ebx, 0xf0
jne 0x28ba2a
mov ecx, dword [esp]
add cl, 0x40
cmp cl, 0xd0
mov ecx, dword [esp]
jb 0x28b8cc
jmp 0x28ba2a
inc edx
mov ebp, dword [esp + 0x28]
jmp 0x28b8cf
mov ecx, dword [esp]
cmp cl, 0x9f
ja 0x28b8cc
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x28bb0b
movzx ecx, byte [edx + 2]
movzx ebp, cl
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x28ba15
shl ebx, 0xc
mov ecx, dword [esp]
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
add edx, 3
and ebp, 0x3f
or ebp, ecx
lea ecx, [eax + 2]
mov word [eax], bp
mov ebp, dword [esp + 0x28]
jmp 0x28b8c2
add edx, 2
mov ebp, dword [esp + 0x28]
jmp 0x28b8cf
cmp cl, 0x8f
ja 0x28b8cc
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x28bb0b
movzx ebp, byte [edx + 2]
mov ecx, ebp
xor ecx, 0xffffff3f
mov esi, ebp
or esi, 0xc0
and esi, ecx
cmp esi, 0x80
jne 0x28bb11
movzx ecx, byte [edx + 3]
movzx esi, cl
mov dword [esp + 4], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x28bb1d
and ebx, 7
shl ebx, 0x12
mov ecx, dword [esp]
and ecx, 0x3f
shl ecx, 0xc
or ecx, ebx
mov ebx, ebp
not ebx
or ebx, 0x3f
add ebx, ebp
shl ebx, 6
lea ebp, [ebx + ecx]
add ebp, 0x40
add edx, 4
mov esi, ebp
and esi, 0xfffff800
cmp esi, 0xd800
je 0x28b8f2
add ebx, ecx
mov ecx, dword [esp + 4]
and ecx, 0x3f
add ebx, ecx
add ebx, 0x40
cmp ebx, 0x10000
jb 0x28b8f2
mov ecx, ebp
cmp edi, 2
mov ebp, dword [esp + 0x28]
jb 0x28bb04
add ecx, 0xf0000
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x28b8c2
mov ecx, eax
jmp 0x28b8c2
inc edx
jmp 0x28b8cc
add edx, 2
mov ebp, dword [esp + 0x28]
jmp 0x28b8cc
add edx, 3
mov ebp, dword [esp + 0x28]
jmp 0x28b8cf
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret