Function at 0x4726f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ecx + 4]
movzx ebp, byte [esi + 0x22]
mov edx, eax
push edi
mov edi, dword [esi + 0x24]
shr edx, 8
shr eax, 0xb
add edi, 8
and edx, 7
and eax, 0x1f
cmp ebx, 3
jne 0x47272f
lea ebx, [esp + 0x14]
push ebx
push edi
push edx
push eax
push ebp
call fcn.0044e800
jmp 0x472748
cmp ebx, 2
jne 0x472748
mov ebx, dword [ecx]
lea ebp, [esp + 0x14]
push ebp
push edi
push edx
push eax
movzx eax, byte [esi + 0x22]
push eax
mov eax, dword [ebx + 0x18]
call eax
movzx edx, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0x20]
mov ebx, dword [esi + 0x24]
shl ecx, 0x1c
or edx, ecx
mov ecx, dword [esi + 0x1c]
mov ebp, dword [ecx + 4]
mov edi, eax
shr edi, 8
shr eax, 0xb
or edx, 0x8000000
add ebx, 8
and edi, 7
and eax, 0x1f
cmp ebp, 3
jne 0x47278e
push edx
push ebx
push edi
push eax
movzx eax, byte [esi + 0x22]
push eax
call fcn.00448db0
jmp 0x4727a3
cmp ebp, 2
jne 0x4727a3
mov ebp, dword [ecx]
push edx
mov edx, dword [ebp + 0x1c]
push ebx
push edi
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
mov edi, dword [esi + 0x24]
mov ebp, dword [ebx + 4]
and eax, 7
or eax, 0xffffffa0
shl eax, 8
or eax, dword [esp + 0x24]
mov edx, ecx
shr edx, 8
shr ecx, 0xb
shl eax, 0x10
add edi, 4
and edx, 7
and ecx, 0x1f
cmp ebp, 3
jne 0x4727eb
push eax
movzx eax, byte [esi + 0x22]
push edi
push edx
push ecx
push eax
mov ecx, ebx
call fcn.00448db0
jmp 0x472802
cmp ebp, 2
jne 0x472802
mov ebp, dword [ebx]
push eax
movzx eax, byte [esi + 0x22]
push edi
push edx
push ecx
push eax
mov eax, dword [ebp + 0x1c]
mov ecx, ebx
call eax
mov dword [esp + 0x1c], 0x186a0
lea ebx, [ebx]
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edi, dword [ecx + 4]
mov ebx, dword [esi + 0x24]
movzx ebp, byte [esi + 0x22]
mov edx, eax
shr edx, 8
shr eax, 0xb
and edx, 7
and eax, 0x1f
cmp edi, 3
jne 0x472843
lea edi, [esp + 0x10]
push edi
push ebx
push edx
push eax
push ebp
call fcn.0044e800
jmp 0x47285c
cmp edi, 2
jne 0x47285c
mov edi, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push ebx
push edx
mov edx, dword [edi + 0x18]
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esp + 0x10]
test eax, 0x10000000
jne 0x47286e
test eax, 0xa0000000
jne 0x472879
sub dword [esp + 0x1c], 1
jns 0x472810
mov eax, dword [esp + 0x10]
mov ecx, eax
and ecx, 0xa0000000
cmp ecx, 0x80000000
je 0x472a0f
mov dword [esp + 0x1c], 0x3e8
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edi, dword [esi + 0x24]
mov ebx, dword [ecx + 4]
movzx ebp, byte [esi + 0x22]
mov edx, eax
shr edx, 8
shr eax, 0xb
add edi, 8
and edx, 7
and eax, 0x1f
cmp ebx, 3
jne 0x4728cb
lea ebx, [esp + 0x14]
push ebx
push edi
push edx
push eax
push ebp
call fcn.0044e800
jmp 0x4728e4
cmp ebx, 2
jne 0x4728e4
mov ebx, dword [ecx]
lea ebp, [esp + 0x14]
push ebp
push edi
push edx
mov edx, dword [ebx + 0x18]
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 0x24]
mov edx, eax
shr eax, 0xb
and eax, 0x1f
shr edx, 8
mov ebp, eax
mov eax, dword [ecx + 4]
xor edi, 0x8000000
add ebx, 8
and edx, 7
cmp eax, 3
jne 0x472922
movzx eax, byte [esi + 0x22]
push edi
push ebx
push edx
push ebp
push eax
call fcn.00448db0
jmp 0x472937
cmp eax, 2
jne 0x472937
movzx eax, byte [esi + 0x22]
push edi
push ebx
push edx
push ebp
push eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ecx + 4]
mov edi, dword [esi + 0x24]
movzx ebp, byte [esi + 0x22]
mov edx, eax
shr edx, 8
shr eax, 0xb
and edx, 7
and eax, 0x1f
cmp ebx, 3
jne 0x47296a
lea ebx, [esp + 0x10]
push ebx
push edi
push edx
push eax
push ebp
call fcn.0044e800
jmp 0x472983
cmp ebx, 2
jne 0x472983
mov ebx, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push edi
push edx
mov edx, dword [ebx + 0x18]
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esp + 0x10]
and eax, 0xb0000000
cmp eax, 0x10000000
je 0x47299e
sub dword [esp + 0x1c], 1
jns 0x472895
mov dword [esp + 0x1c], 0x3e8
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edi, dword [ecx + 4]
mov ebx, dword [esi + 0x24]
movzx ebp, byte [esi + 0x22]
mov edx, eax
shr edx, 8
shr eax, 0xb
and edx, 7
and eax, 0x1f
cmp edi, 3
jne 0x4729d9
lea edi, [esp + 0x10]
push edi
push ebx
push edx
push eax
push ebp
call fcn.0044e800
jmp 0x4729f2
cmp edi, 2
jne 0x4729f2
mov edi, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push ebx
push edx
mov edx, dword [edi + 0x18]
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esp + 0x10]
test eax, 0x10000000
jne 0x472a04
test eax, 0xa0000000
jne 0x472a0b
sub dword [esp + 0x1c], 1
jns 0x4729a6
mov eax, dword [esp + 0x10]
pop edi
mov ecx, eax
pop esi
and ecx, 0xa0000000
pop ebp
pop ebx
cmp ecx, 0x80000000
jne 0x472a3d
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov byte [edx], al
shr eax, 8
mov byte [ecx], al
mov eax, 1
add esp, 8
ret 0x14
xor eax, eax
add esp, 8
ret 0x14