Function at 0x4aafe3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
lea ebp, [esp - 0x188]
sub esp, 0xd2c
mov eax, dword [0x1015dd88]
xor eax, ebp
mov dword [ebp + 0x184], eax
cmp dword [ebp + 0x19c], 4
mov eax, dword [ebp + 0x190]
push ebx
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x194]
mov ebx, ecx
push edi
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x64], eax
jl 0x4ab037
push 0x10125a10
call dword [0x1010d5b8]
add eax, 0x40
push eax
call dword [0x1010d564]
pop ecx
pop ecx
mov eax, 0x10000
and dword [esi + eax*4], 0
dec eax
jns 0x4ab03c
xor eax, eax
mov ah, byte [ebx]
mov edi, eax
mov eax, dword [ebp + 0x198]
dec eax
cmp eax, 3
jl 0x4ab0b1
mov ecx, dword [ebp + 0x64]
lea ecx, [ecx + eax*2 - 4]
and word [ecx + 4], 0
xor edx, edx
mov dh, byte [ebx + eax]
sar edi, 8
sub eax, 4
or edi, edx
inc dword [esi + edi*4]
and word [ecx + 2], 0
xor edx, edx
mov dh, byte [ebx + eax + 3]
sar edi, 8
or edi, edx
inc dword [esi + edi*4]
and word [ecx], 0
xor edx, edx
mov dh, byte [ebx + eax + 2]
sar edi, 8
sub ecx, 8
or edi, edx
inc dword [esi + edi*4]
and word [ecx + 6], 0
xor edx, edx
mov dh, byte [ebx + eax + 1]
sar edi, 8
or edi, edx
inc dword [esi + edi*4]
cmp eax, 3
jge 0x4ab05c
test eax, eax
jl 0x4ab0cd
mov ecx, dword [ebp + 0x64]
and word [ecx + eax*2], 0
xor ecx, ecx
mov ch, byte [ebx + eax]
sar edi, 8
or edi, ecx
inc dword [esi + edi*4]
dec eax
jns 0x4ab0b5
mov ecx, dword [ebp + 0x198]
mov edx, dword [ebp + 0x64]
xor eax, eax
lea edi, [edx + ecx*2]
add ecx, ebx
mov dl, byte [ebx + eax]
mov byte [ecx + eax], dl
and word [edi], 0
inc eax
inc edi
inc edi
cmp eax, 0x22
jl 0x4ab0dd
cmp dword [ebp + 0x19c], 4
jl 0x4ab10f
push 0x10125998
call dword [0x1010d5b8]
add eax, 0x40
push eax
call dword [0x1010d564]
pop ecx
pop ecx
xor ecx, ecx
inc ecx
mov edx, dword [esi + ecx*4 - 4]
lea eax, [esi + ecx*4]
add dword [eax], edx
inc ecx
cmp ecx, 0x10000
jle 0x4ab112
mov edi, dword [ebp + 0x198]
xor eax, eax
mov ah, byte [ebx]
dec edi
cmp edi, 3
movzx ecx, ax
jl 0x4ab1ec
or dword [ebp + 0x74], 0xffffffff
sub dword [ebp + 0x74], ebx
mov dword [ebp + 0x80], 0xfffffffe
sub dword [ebp + 0x80], ebx
lea eax, [ebx + edi - 1]
mov ebx, dword [ebp + 0x6c]
xor edx, edx
mov dh, byte [eax + 1]
mov dl, ch
movzx ecx, dx
mov dword [ebp + 0x78], ecx
movzx ecx, cx
lea edx, [esi + ecx*4]
mov ecx, dword [edx]
dec ecx
mov dword [edx], ecx
mov dword [ebx + ecx*4], edi
xor ecx, ecx
mov ch, byte [eax]
mov cl, byte [ebp + 0x79]
movzx ecx, cx
mov dword [ebp + 0x78], ecx
movzx ecx, cx
lea edx, [esi + ecx*4]
mov ecx, dword [edx]
dec ecx
mov dword [edx], ecx
lea edx, [edi - 1]
mov dword [ebx + ecx*4], edx
xor ecx, ecx
mov ch, byte [eax - 1]
sub edi, 4
mov cl, byte [ebp + 0x79]
movzx ecx, cx
mov dword [ebp + 0x78], ecx
movzx ecx, cx
lea edx, [esi + ecx*4]
mov ecx, dword [edx]
dec ecx
mov dword [edx], ecx
mov edx, dword [ebp + 0x74]
add edx, eax
mov dword [ebx + ecx*4], edx
xor ecx, ecx
mov ch, byte [eax - 2]
mov cl, byte [ebp + 0x79]
movzx ecx, cx
mov dword [ebp + 0x78], ecx
movzx ecx, cx
lea edx, [esi + ecx*4]
mov ecx, dword [edx]
dec ecx
mov dword [edx], ecx
mov edx, dword [ebp + 0x80]
add edx, eax
sub eax, 4
cmp edi, 3
mov dword [ebx + ecx*4], edx
mov ecx, dword [ebp + 0x78]
jge 0x4ab159
mov ebx, dword [ebp + 0x70]
test edi, edi
jl 0x4ab20e
xor eax, eax
mov ah, byte [ebx + edi]
mov al, ch
movzx ecx, ax
movzx eax, cx
lea edx, [esi + eax*4]
mov eax, dword [edx]
dec eax
mov dword [edx], eax
mov edx, dword [ebp + 0x6c]
mov dword [edx + eax*4], edi
dec edi
jns 0x4ab1f0
push 0x100
xor edi, edi
lea eax, [ebp + 0x84]
push edi
push eax
call fcn.004f114c
add esp, 0xc
mov dword [ebp + edi*4 - 0x3a4], edi
inc edi
cmp edi, 0xff
jle 0x4ab225
xor eax, eax
inc eax
imul eax, eax, 3
inc eax
cmp eax, 0x100
jle 0x4ab238
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp + 0x7c]
push 3
cdq
pop ecx
idiv ecx
cmp eax, 0xff
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x78], eax
jg 0x4ab2f1
lea eax, [ebp - 0x3a4]
mov dword [ebp + 0x74], eax
mov edi, dword [ebp + 0x78]
mov eax, dword [ebp + edi*4 - 0x3a4]
mov ecx, dword [ebp + 0x74]
mov ecx, dword [ecx]
mov dword [ebp + 0x68], eax
shl eax, 0xa
shl ecx, 0xa
add eax, esi
lea edx, [ecx + esi]
mov ecx, dword [eax + 0x400]
sub ecx, dword [eax]
mov eax, dword [edx + 0x400]
sub eax, dword [edx]
cmp eax, ecx
jbe 0x4ab2d3
mov eax, dword [ebp + 0x74]
jmp 0x4ab2a2
mov eax, dword [ebp + 0x70]
mov edx, dword [eax]
mov dword [ebp + edi*4 - 0x3a4], edx
mov edx, dword [ebp + 0x7c]
sub edi, edx
shl edx, 2
sub eax, edx
mov edx, dword [ebp + 0x7c]
dec edx
cmp edi, edx
mov dword [ebp + 0x70], eax
jle 0x4ab2d3
mov eax, dword [eax]
shl eax, 0xa
add eax, esi
mov edx, dword [eax + 0x400]
sub edx, dword [eax]
cmp edx, ecx
ja 0x4ab29f
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x68]
add dword [ebp + 0x74], 4
cmp dword [ebp + 0x78], 0xff
mov dword [ebp + edi*4 - 0x3a4], eax
jle 0x4ab269
cmp dword [ebp + 0x7c], 1
jne 0x4ab246
and dword [ebp + 0x74], 0
and dword [ebp + 0x78], 0
mov eax, dword [ebp + 0x78]
mov edi, dword [ebp + eax*4 - 0x3a4]
and dword [ebp + 0x7c], 0
mov dword [ebp + 0x70], edi
cmp dword [ebp + 0x7c], edi
je 0x4ab3d7
shl edi, 8
add edi, dword [ebp + 0x7c]
lea eax, [esi + edi*4]
mov dword [ebp + 0x68], eax
mov eax, dword [eax]
test eax, 0x200000
jne 0x4ab3cb
mov ecx, 0xffdfffff
and eax, ecx
mov dword [ebp + 0x80], eax
mov eax, dword [ebp + 0x68]
mov edi, dword [eax + 4]
and edi, ecx
dec edi
cmp edi, dword [ebp + 0x80]
jle 0x4ab3ce
cmp dword [ebp + 0x19c], 4
jl 0x4ab388
mov eax, edi
sub eax, dword [ebp + 0x80]
inc eax
push eax
push dword [ebp + 0x74]
push dword [ebp + 0x7c]
push dword [ebp + 0x70]
push 0x101259e0
call dword [0x1010d5b8]
add eax, 0x40
push eax
call dword [0x1010d564]
add esp, 0x18
push dword [ebp + 0x1a0]
mov eax, dword [ebp + 0x80]
push 2
push edi
push dword [ebp + 0x198]
push dword [ebp + 0x64]
push ebx
push dword [ebp + 0x6c]
call fcn.004aac78
sub edi, dword [ebp + 0x80]
mov eax, dword [ebp + 0x74]
lea eax, [eax + edi + 1]
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x1a0]
add esp, 0x1c
cmp dword [eax], 0
jl 0x4ab648
mov eax, dword [ebp + 0x68]
or dword [eax], 0x200000
mov edi, dword [ebp + 0x70]
inc dword [ebp + 0x7c]
cmp dword [ebp + 0x7c], 0xff
jle 0x4ab314
lea eax, [ebp + edi + 0x84]
cmp byte [eax], 0
mov dword [ebp + 0x60], eax
je 0x4ab401
push 0x3ee
call fcn.004ad85b
pop ecx
mov ecx, edi
shl ecx, 2
lea eax, [esi + ecx]
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x80], eax
mov dword [ebp + 0x7c], ecx
xor eax, eax
mov edx, dword [ebp + 0x80]
mov edx, dword [edx]
and edx, 0xffdfffff
mov dword [ebp + eax - 0x7a4], edx
mov edx, dword [ebp + 0x80]
mov edx, dword [edx + 4]
add dword [ebp + 0x80], 0x400
and edx, 0xffdfffff
dec edx
mov dword [ebp + eax - 0xba4], edx
add eax, 4
cmp eax, 0x3fc
jle 0x4ab417
shl edi, 0xa
add edi, esi
mov eax, dword [edi]
lea edx, [ebp + ecx - 0x7a4]
mov dword [ebp + 0x80], edi
and eax, 0xffdfffff
mov dword [ebp + 0x68], edx
jmp 0x4ab4b7
mov edx, dword [ebp + 0x6c]
mov edx, dword [edx + eax*4]
dec edx
jns 0x4ab484
add edx, dword [ebp + 0x198]
movzx edi, byte [ebx + edx]
cmp byte [ebp + edi + 0x84], 0
jne 0x4ab4ad
lea ecx, [ebp + edi*4 - 0x7a4]
mov edi, dword [ebp + 0x6c]
mov dword [ebp + 0x70], ecx
mov ecx, dword [ecx]
mov dword [edi + ecx*4], edx
mov edx, dword [ebp + 0x70]
inc ecx
mov dword [edx], ecx
mov ecx, dword [ebp + 0x7c]
mov edi, dword [ebp + 0x80]
mov edx, dword [ebp + 0x68]
inc eax
cmp eax, dword [edx]
jl 0x4ab475
mov eax, dword [edi + 0x400]
lea ecx, [ebp + ecx - 0xba4]
and eax, 0xffdfffff
mov dword [ebp + 0x70], ecx
jmp 0x4ab510
mov ecx, dword [ebp + 0x6c]
mov edx, dword [ecx + eax*4]
dec edx
jns 0x4ab4e1
add edx, dword [ebp + 0x198]
movzx ecx, byte [ebx + edx]
cmp byte [ebp + ecx + 0x84], 0
jne 0x4ab50d
mov edi, dword [ebp + 0x6c]
lea ecx, [ebp + ecx*4 - 0xba4]
mov dword [ebp + 0x7c], ecx
mov ecx, dword [ecx]
mov dword [edi + ecx*4], edx
mov edx, dword [ebp + 0x7c]
mov edi, dword [ebp + 0x80]
dec ecx
mov dword [edx], ecx
mov ecx, dword [ebp + 0x70]
dec eax
cmp eax, dword [ecx]
jg 0x4ab4d2
mov eax, dword [ebp + 0x68]
mov eax, dword [eax]
mov ecx, dword [ecx]
lea edx, [eax - 1]
cmp edx, ecx
je 0x4ab53d
test eax, eax
jne 0x4ab532
mov eax, dword [ebp + 0x198]
dec eax
cmp ecx, eax
je 0x4ab53d
push 0x3ef
call fcn.004ad85b
pop ecx
mov eax, dword [ebp + 0x5c]
mov ecx, 0x100
or dword [eax], 0x200000
add eax, 0x400
dec ecx
jne 0x4ab545
cmp dword [ebp + 0x78], 0xff
mov eax, dword [ebp + 0x60]
mov byte [eax], 1
jge 0x4ab604
mov edx, dword [edi]
mov eax, dword [edi + 0x400]
and dword [ebp + 0x80], 0
mov ecx, 0xffdfffff
and edx, ecx
and eax, ecx
sub eax, edx
cmp eax, 0xfffe
jle 0x4ab59f
inc dword [ebp + 0x80]
mov ecx, dword [ebp + 0x80]
mov edi, eax
sar edi, cl
cmp edi, 0xfffe
jg 0x4ab587
dec eax
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x7c], eax
js 0x4ab5ea
add edx, eax
mov eax, dword [ebp + 0x6c]
lea edi, [eax + edx*4]
mov ecx, dword [ebp + 0x80]
mov eax, dword [ebp + 0x7c]
mov edx, dword [edi]
sar eax, cl
cmp edx, 0x22
movzx ecx, ax
mov eax, dword [ebp + 0x64]
mov word [eax + edx*2], cx
jge 0x4ab5db
mov eax, dword [ebp + 0x198]
add edx, eax
mov eax, dword [ebp + 0x64]
mov word [eax + edx*2], cx
dec dword [ebp + 0x7c]
sub edi, 4
cmp dword [ebp + 0x7c], 0
jge 0x4ab5b0
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x80]
sar eax, cl
cmp eax, 0xffff
jle 0x4ab604
push 0x3ea
call fcn.004ad85b
pop ecx
inc dword [ebp + 0x78]
cmp dword [ebp + 0x78], 0xff
jle 0x4ab303
cmp dword [ebp + 0x19c], 4
jl 0x4ab648
mov eax, dword [ebp + 0x198]
sub eax, dword [ebp + 0x74]
push eax
push dword [ebp + 0x74]
push dword [ebp + 0x198]
push 0x101259b4
call dword [0x1010d5b8]
add eax, 0x40
push eax
call dword [0x1010d564]
add esp, 0x14
mov ecx, dword [ebp + 0x184]
pop edi
xor ecx, ebp
pop ebx
call fcn.004f1032
add ebp, 0x188
leave
ret