Function at 0x3004f35f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
xor ebp, ebp
mov eax, edi
and eax, 0x3ff
cmp eax, 0x1f
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
jne 0x3004f3a7
mov ecx, edi
shr ecx, 0x10
and cl, 0xf
cmp cl, 0xf
jne 0x3004f3a7
and edi, 0xfff0ffff
mov dword [esp + 0x3c], edi
mov dword [esp + 0x28], 1
xor ecx, ecx
mov eax, 0x30013130
nop
cmp dword [eax], edi
je 0x3004f3c5
add eax, 0xc
add ecx, 1
cmp eax, 0x300133ac
jl 0x3004f3af
jmp 0x3004f51a
lea ecx, [ecx + ecx*2]
add ecx, ecx
mov esi, dword [ecx + ecx + 0x30013138]
add ecx, ecx
mov eax, 0xaaaaaaab
mul dword [ecx + 0x30013134]
shr edx, 1
cmp esi, ebp
lea ebx, [edx + edx*2]
lea ebx, [ebx*2 + 0x300133b0]
mov dword [esp + 0x20], esi
mov dword [0x300a47c8], ebp
mov dword [esp + 0x1c], ebp
jle 0x3004f51a
movzx edx, byte [ebx + 1]
mov eax, dword [edx*4 + 0x30066020]
cmp byte [eax], 0xa
jne 0x3004f442
movzx ecx, byte [ebx + 1]
movzx edx, byte [ebx]
mov eax, dword [ecx*4 + 0x30066020]
movzx ecx, byte [ebx + 3]
lea eax, [eax + edx*4]
movzx edx, byte [ebx + 2]
mov byte [eax + 4], cl
movzx ecx, byte [ebx + 4]
mov byte [eax + 5], dl
movzx edx, byte [ebx + 5]
mov byte [eax + 6], cl
mov byte [eax + 7], dl
jmp 0x3004f504
push 2
push 0x404
call fcn.3005408c
cmp eax, ebp
mov dword [esp + 0x24], eax
je 0x3004f918
movzx cx, byte [ebx + 1]
mov edx, dword [0x300a47c8]
mov bp, word [ebx]
mov byte [edx*8 + 0x300a4188], cl
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x30066020]
mov dword [edx*8 + 0x300a418c], ecx
add edx, 1
xor edi, edi
mov dword [0x300a47c8], edx
mov byte [eax], 0xa
and bp, 0xff00
lea esi, [eax + 5]
lea edx, [esp + 0x10]
mov eax, ebp
push edx
or eax, edi
push eax
call fcn.3004ee46
mov eax, dword [esp + 0x18]
mov byte [esi - 1], ah
mov byte [esi], al
mov ax, word [esp + 0x1a]
mov byte [esi + 1], al
mov byte [esi + 2], ah
add edi, 1
add esp, 8
add esi, 4
cmp di, 0x100
jb 0x3004f496
movzx ecx, byte [ebx]
mov eax, dword [esp + 0x24]
movzx edx, byte [ebx + 3]
mov edi, dword [esp + 0x3c]
lea esi, [eax + ecx*4]
movzx ecx, byte [ebx + 2]
mov byte [esi + 4], dl
movzx edx, byte [ebx + 4]
mov byte [esi + 5], cl
movzx ecx, byte [ebx + 5]
mov byte [esi + 6], dl
movzx edx, byte [ebx + 1]
mov byte [esi + 7], cl
mov esi, dword [esp + 0x20]
mov dword [edx*4 + 0x30066020], eax
xor ebp, ebp
mov eax, dword [esp + 0x1c]
add eax, 1
add ebx, 6
cmp eax, esi
mov dword [esp + 0x1c], eax
jl 0x3004f400
mov edx, 1
mov ebp, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebp
xor ecx, ecx
mov eax, 0x30010ee0
cmp dword [eax], edi
je 0x3004f56f
add eax, 0xc
add ecx, 1
cmp eax, 0x30010f70
jl 0x3004f530
cmp dword [esp + 0x28], 0
je 0x3004f562
mov ecx, dword [0x30066024]
mov edx, dword [0x30066020]
mov al, 0x31
mov byte [ecx + 0xc9], al
mov byte [edx + 0x129], al
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
lea ecx, [ecx + ecx*2]
add ecx, ecx
mov esi, dword [ecx + ecx + 0x30010ee4]
add ecx, ecx
test esi, esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], esi
je 0x3004f918
cmp edi, 0x412
jne 0x3004f5ad
mov dword [esp + 0x14], 0x3008a2f0
mov dword [esp + 0x18], 0x3008a388
mov dword [esp + 0x2c], 0x3008aaf0
xor ebx, ebx
cmp word [ecx + 0x30010ee8], bx
jbe 0x3004f7e4
lea ecx, [ecx]
mov ax, word [esi + ebx*2]
test ax, ax
je 0x3004f7d2
movzx eax, ah
mov edi, dword [eax*4 + 0x30066020]
cmp byte [edi], 0xa
mov dword [esp + 0x34], eax
jne 0x3004f687
cmp dword [esp + 0x3c], 0x412
je 0x3004f61a
mov eax, ebx
cdq
mov ecx, 0xfe
idiv ecx
movzx ecx, byte [esi + ebx*2]
lea ecx, [edi + ecx*4]
add al, 0x80
mov byte [ecx + 4], al
movzx eax, byte [esi + ebx*2]
add dl, 2
mov byte [ecx + 5], dl
mov byte [ecx + 6], 2
mov byte [edi + eax*4 + 7], 2
jmp 0x3004f7c6
cmp edx, 0x26
jge 0x3004f632
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + edx*4]
cmp ebx, ecx
jl 0x3004f632
add edx, 1
mov dword [esp + 0x1c], edx
cmp ebp, 0x1d9
mov ecx, dword [esp + 0x14]
movzx eax, byte [esi + ebx*2]
mov dl, byte [ecx + edx*4 - 2]
mov ecx, dword [esp + 0x18]
mov byte [edi + eax*4 + 4], dl
jge 0x3004f65d
movzx eax, word [ecx + ebp*4]
cmp ebx, eax
jl 0x3004f65d
add ebp, 1
mov dword [esp + 0x20], ebp
movzx edx, byte [esi + ebx*2]
lea eax, [edi + edx*4]
mov dl, byte [ecx + ebp*4 - 2]
mov byte [eax + 5], dl
mov dl, bl
sub dl, byte [ecx + ebp*4 - 4]
add dl, dl
add dl, 0x41
mov byte [eax + 6], dl
movzx eax, byte [esi + ebx*2]
mov byte [edi + eax*4 + 7], 2
jmp 0x3004f7c6
push 2
push 0x404
call fcn.3005408c
mov ebp, eax
test ebp, ebp
je 0x3004f918
movzx ax, byte [esi + ebx*2 + 1]
mov ecx, dword [0x300a47c8]
movzx edx, al
mov byte [ecx*8 + 0x300a4188], al
mov eax, dword [edx*4 + 0x30066020]
mov dword [ecx*8 + 0x300a418c], eax
mov ax, word [esi + ebx*2]
add ecx, 1
xor edi, edi
mov dword [0x300a47c8], ecx
mov byte [ebp], 0xa
lea esi, [ebp + 5]
and eax, 0xff00
mov dword [esp + 0x30], eax
jmp 0x3004f6e6
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
or eax, edi
push eax
call fcn.3004ee46
mov eax, dword [esp + 0x18]
mov byte [esi - 1], ah
mov byte [esi], al
mov ax, word [esp + 0x1a]
mov byte [esi + 1], al
mov byte [esi + 2], ah
add edi, 1
add esp, 8
add esi, 4
cmp di, 0x100
jb 0x3004f6e2
cmp dword [esp + 0x3c], 0x412
je 0x3004f748
mov eax, ebx
cdq
mov ecx, 0xfe
idiv ecx
mov ecx, dword [esp + 0x24]
movzx ecx, byte [ecx + ebx*2]
lea ecx, [ebp + ecx*4]
add al, 0x80
mov byte [ecx + 4], al
add dl, 2
mov byte [ecx + 5], dl
mov byte [ecx + 6], 2
jmp 0x3004f7b3
mov eax, dword [esp + 0x1c]
cmp eax, 0x26
jge 0x3004f764
mov edx, dword [esp + 0x14]
movzx ecx, word [edx + eax*4]
cmp ebx, ecx
jl 0x3004f764
add eax, 1
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + ebx*2]
mov esi, dword [esp + 0x14]
mov al, byte [esi + eax*4 - 2]
mov edi, dword [esp + 0x18]
mov byte [ebp + edx*4 + 4], al
mov eax, dword [esp + 0x20]
cmp eax, 0x1d9
jge 0x3004f796
movzx edx, word [edi + eax*4]
cmp ebx, edx
jl 0x3004f796
add eax, 1
mov dword [esp + 0x20], eax
movzx ecx, byte [ecx + ebx*2]
mov dl, byte [edi + eax*4 - 2]
lea esi, [ebp + ecx*4]
mov cl, bl
sub cl, byte [edi + eax*4 - 4]
mov byte [esi + 5], dl
add cl, cl
add cl, 0x41
mov byte [esi + 6], cl
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x24]
mov dword [edx*4 + 0x30066020], ebp
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
movzx eax, word [ecx + 0x30010ee8]
add ebx, 1
cmp ebx, eax
jl 0x3004f5be
cmp edi, 0x412
jne 0x3004f562
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov edi, edi
movzx ecx, byte [ebx + 1]
mov edx, dword [ecx*4 + 0x30066020]
cmp byte [edx], 0xa
jne 0x3004f839
movzx eax, byte [ebx + 1]
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 2]
mov eax, dword [eax*4 + 0x30066020]
lea eax, [eax + ecx*4]
movzx ecx, byte [ebx + 3]
mov byte [eax + 4], dl
movzx edx, byte [ebx + 4]
mov byte [eax + 5], cl
mov byte [eax + 6], dl
jmp 0x3004f8eb
push 2
push 0x404
call fcn.3005408c
test eax, eax
mov dword [esp + 0x24], eax
je 0x3004f918
movzx cx, byte [ebx + 1]
mov edx, dword [0x300a47c8]
mov bp, word [ebx]
mov byte [edx*8 + 0x300a4188], cl
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x30066020]
mov dword [edx*8 + 0x300a418c], ecx
add edx, 1
xor edi, edi
mov dword [0x300a47c8], edx
mov byte [eax], 0xa
and bp, 0xff00
lea esi, [eax + 5]
nop
lea edx, [esp + 0x10]
mov eax, ebp
push edx
or eax, edi
push eax
call fcn.3004ee46
mov eax, dword [esp + 0x18]
mov byte [esi - 1], ah
mov byte [esi], al
mov ax, word [esp + 0x1a]
mov byte [esi + 1], al
mov byte [esi + 2], ah
add edi, 1
add esp, 8
add esi, 4
cmp di, 0x100
jb 0x3004f88e
movzx ecx, byte [ebx]
mov esi, dword [esp + 0x24]
movzx edx, byte [ebx + 2]
lea eax, [esi + ecx*4]
movzx ecx, byte [ebx + 3]
mov byte [eax + 4], dl
movzx edx, byte [ebx + 4]
mov byte [eax + 5], cl
mov byte [eax + 6], dl
movzx edx, byte [ebx + 1]
mov dword [edx*4 + 0x30066020], esi
movzx ecx, byte [ebx + 5]
mov byte [eax + 7], cl
mov eax, dword [esp + 0x1c]
add eax, 1
add ebx, 6
cmp eax, 0x609
mov dword [esp + 0x1c], eax
jl 0x3004f7fe
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret