Function at 0x295107
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
push ebx
push ebp
lea ebp, [ecx + edx]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x28]
xor ebx, ebx
add eax, edx
mov dword [esp + 0x14], ebp
push esi
mov dword [esp + 0xc], eax
movzx eax, byte [ecx + 1]
lea esi, [edx + 1]
movzx edx, byte [ecx]
shl edx, 8
or edx, eax
lea eax, [ebp - 2]
mov dword [esp + 0x30], eax
push edi
mov edi, ecx
cmp ecx, eax
jae 0x295351
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
imul eax, edx, 5
mov ecx, edx
shr ecx, 5
xor ecx, edx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x38]
shr ecx, 3
sub ecx, eax
mov eax, dword [esp + 0x38]
and ecx, 0xffff
mov ebp, dword [eax + ecx*4]
mov eax, edi
sub eax, dword [esp + 0x14]
add ebp, dword [esp + 0x14]
mov dword [edx + ecx*4], eax
mov eax, edi
mov edx, dword [esp + 0x14]
sub eax, ebp
dec eax
mov dword [esp + 0x18], eax
cmp eax, 0x2000
jge 0x29535e
cmp ebp, edx
jbe 0x29535e
mov al, byte [ebp + 2]
cmp al, byte [edi + 2]
jne 0x29535e
movzx edx, byte [ebp + 1]
lea ecx, [edi + 1]
movzx eax, byte [ebp]
mov dword [esp + 0x24], ecx
movzx ecx, byte [ecx]
shl edx, 8
or edx, eax
shl ecx, 8
movzx eax, byte [edi]
or ecx, eax
cmp edx, ecx
jne 0x29535e
mov eax, dword [esp + 0x34]
mov ecx, 0x108
sub eax, edi
cmp eax, ecx
push 2
cmova eax, ecx
mov dword [esp + 0x24], eax
lea eax, [esi + 4]
pop edx
cmp eax, dword [esp + 0x10]
jb 0x29520e
xor ecx, ecx
mov eax, esi
test ebx, ebx
sete cl
sub eax, ecx
add eax, 4
cmp eax, dword [esp + 0x10]
jae 0x29535a
mov eax, esi
lea ecx, [ebx - 1]
sub eax, ebx
mov byte [eax - 1], cl
xor eax, eax
test ebx, ebx
mov ebx, dword [esp + 0x20]
sete al
sub esi, eax
cmp ebx, 0x10
jbe 0x2952f6
mov al, byte [ebp + 3]
push 3
pop edx
cmp al, byte [edi + 3]
jne 0x295308
mov al, byte [ebp + 4]
push 4
pop edx
cmp al, byte [edi + 4]
jne 0x295308
mov al, byte [ebp + 5]
push 5
pop edx
cmp al, byte [edi + 5]
jne 0x295308
mov al, byte [ebp + 6]
push 6
pop edx
cmp al, byte [edi + 6]
jne 0x295308
mov al, byte [ebp + 7]
push 7
pop edx
cmp al, byte [edi + 7]
jne 0x295308
mov al, byte [ebp + 8]
push 8
pop edx
cmp al, byte [edi + 8]
jne 0x295308
mov al, byte [ebp + 9]
push 9
pop edx
cmp al, byte [edi + 9]
jne 0x295308
mov al, byte [ebp + 0xa]
push 0xa
pop edx
cmp al, byte [edi + 0xa]
jne 0x295308
mov al, byte [ebp + 0xb]
push 0xb
pop edx
cmp al, byte [edi + 0xb]
jne 0x295308
mov al, byte [ebp + 0xc]
push 0xc
pop edx
cmp al, byte [edi + 0xc]
jne 0x295308
mov al, byte [ebp + 0xd]
push 0xd
pop edx
cmp al, byte [edi + 0xd]
jne 0x295308
mov al, byte [ebp + 0xe]
push 0xe
pop edx
cmp al, byte [edi + 0xe]
jne 0x295308
mov al, byte [ebp + 0xf]
push 0xf
pop edx
cmp al, byte [edi + 0xf]
jne 0x295308
mov al, byte [ebp + 0x10]
push 0x10
pop edx
cmp al, byte [edi + 0x10]
jne 0x295308
mov al, byte [ebp + 0x11]
push 0x11
pop edx
cmp al, byte [edi + 0x11]
jne 0x295308
mov al, byte [ebp + 0x12]
push 0x12
pop edx
cmp al, byte [edi + 0x12]
jne 0x295308
lea ecx, [edx + edi]
sub ebp, edi
inc edx
inc ecx
cmp edx, ebx
jae 0x295308
mov al, byte [ecx + ebp]
cmp al, byte [ecx]
je 0x2952fb
mov ebx, dword [esp + 0x18]
sub edx, 2
cmp edx, 7
jae 0x295325
mov ecx, ebx
mov al, dl
sar ecx, 8
shl al, 5
add cl, al
mov byte [esi], cl
inc esi
jmp 0x295337
mov eax, ebx
sar eax, 8
sub al, 0x20
mov byte [esi], al
lea eax, [edx - 7]
mov byte [esi + 1], al
add esi, 2
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
inc edi
mov byte [esi], bl
add edi, edx
xor ebx, ebx
add esi, 2
cmp edi, eax
jb 0x29537b
mov ebp, dword [esp + 0x1c]
lea eax, [esi + 3]
cmp eax, dword [esp + 0x10]
jbe 0x29539b
xor eax, eax
jmp 0x2953b8
cmp esi, dword [esp + 0x10]
jae 0x29535a
mov al, byte [edi]
inc ebx
mov byte [esi], al
inc esi
mov eax, dword [esp + 0x34]
inc edi
cmp ebx, 0x20
jne 0x29537b
mov byte [esi - 0x21], 0x1f
xor ebx, ebx
inc esi
cmp edi, eax
jae 0x29534d
mov edx, dword [esp + 0x28]
jmp 0x295149
mov al, byte [edi]
inc ebx
mov byte [esi], al
inc esi
inc edi
cmp ebx, 0x20
jne 0x29539b
mov byte [esi - 0x21], 0x1f
xor ebx, ebx
inc esi
cmp edi, ebp
jb 0x295388
mov ecx, esi
lea edx, [ebx - 1]
sub ecx, ebx
mov byte [ecx - 1], dl
xor ecx, ecx
test ebx, ebx
sete cl
sub esi, ecx
sub esi, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret