Function at 0x10004640
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
mov eax, dword [0x9e6ddc8]
push ebx
push ebp
push esi
mov esi, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
push edi
push eax
call fcn.10013fb9
mov ecx, dword [0x9e6ddc8]
xor ebp, ebp
mov dword [esp + 0x14], eax
xor eax, eax
mov bp, word [ecx + 0x22]
mov ecx, 0x20f
imul ebp, esi
mov edi, 0x9e6de48
add ebp, 0x1f
rep stosd dword es:[edi], eax
mov edx, dword [0x9e6ddc8]
push 0xfa0a
add edx, 0x4fc
mov dword [0x9e6de4c], 0x83c
shr ebp, 3
push edx
and ebp, 0x1ffffffc
mov byte [0x9e6de50], 0x14
mov byte [0x9e6de51], 1
mov dword [0x9e6de58], 0xfa0a
call fcn.10011b60
xor ebx, ebx
add esp, 0xc
cmp eax, ebx
jne 0x10004715
mov eax, dword [0x9e6ddc8]
push 0x2eea
add eax, 0x4fc
mov dword [0x9e6de58], 0x2eea
push eax
call fcn.10011b60
add esp, 8
cmp eax, ebx
jne 0x10004715
mov ecx, dword [0x9e6ddc8]
push 0x271a
add ecx, 0x4fc
mov dword [0x9e6de58], 0x271a
push ecx
call fcn.10011b60
add esp, 8
cmp eax, ebx
je 0x10004728
lea edx, [eax + 0xd]
mov dword [0x9e6e38c], edx
mov eax, dword [eax + 9]
mov dword [0x9e6e390], eax
jmp 0x10004732
mov dword [0x9e6de58], 0xfa0a
mov ecx, dword [0x9e6ddc8]
mov eax, dword [esp + 0x24]
mov edi, 0x9e6de5c
cmp eax, ebx
lea esi, [ecx + 0x14]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x9e6ddc8]
mov ecx, 0x110
mov edi, 0x9e6de84
mov dword [0x9e6de6c], ebx
lea esi, [edx + 0x3c]
rep movsd dword es:[edi], dword [esi]
je 0x100047d8
mov esi, dword [0x9e6e57c]
mov eax, dword [0x9e6ddc8]
mov ecx, 1
or esi, ecx
mov dword [0x9e6e57c], esi
mov edx, dword [eax + 0x734]
or edx, ecx
mov dword [eax + 0x734], edx
cmp word [0x9e6de6a], 8
jne 0x100047d8
mov dword [0x9e6e6b0], ebx
xor ecx, ecx
mov eax, 0x9e6de85
xor edx, edx
mov dl, byte [eax + 1]
cmp edx, ecx
jne 0x100047ce
xor edx, edx
mov dl, byte [eax]
cmp edx, ecx
jne 0x100047ce
xor edx, edx
mov dl, byte [eax - 1]
cmp edx, ecx
jne 0x100047ce
add eax, 4
inc ecx
cmp eax, 0x9e6e285
jl 0x100047a7
jmp 0x100047d8
mov dword [0x9e6e6b0], 1
mov eax, dword [0x9e6ddc8]
mov esi, dword [0x9e6e57c]
mov edi, 2
mov ecx, dword [eax + 0x770]
mov dword [0x9e6e58c], ecx
mov edx, dword [eax + 0x774]
mov dword [0x9e6e590], edx
mov ecx, dword [eax + 0x778]
mov dword [0x9e6e594], ecx
mov edx, dword [eax + 0x734]
mov ecx, dword [esp + 0x28]
and edx, 4
or esi, edx
cmp ecx, 7
mov dword [0x9e6e57c], esi
mov dword [0x9e6e598], edi
jne 0x10004833
or dword [0x9e6e5c8], 1
test dword [eax + 0x734], 0x40000
je 0x10004849
or dword [0x9e6e57c], 0x1000000
push 0x8000
call fcn.100121a0
add esp, 4
cmp eax, ebx
mov dword [0x9e6de18], eax
jne 0x1000488b
mov esi, 0xffffe4a5
mov eax, dword [0x9e6ddc8]
push edi
mov dword [eax + 0xc], esi
mov ecx, dword [0x9e6ddc8]
mov edx, dword [ecx + 0x498]
push edx
call fcn.10013dbd
mov eax, dword [0x9e6de18]
add esp, 8
cmp eax, ebx
je 0x10004864
mov edx, dword [0x9e6ddc8]
mov ebx, dword [0x9e6e328]
lea ecx, [eax + 0x8000]
mov dword [0x9e6e304], eax
mov dword [0x9e6e310], ecx
mov dword [0x9e6e30c], eax
mov dword [0x9e6e308], eax
mov eax, dword [edx + 0x4e0]
and eax, 0x100
push 1
or ebx, eax
mov dword [0x9e6e328], ebx
call fcn.10005160
mov ecx, dword [0x9e6ddc8]
push 1
push 0x9e6de48
push ecx
mov dword [0x9e6e324], eax
call fcn.10012000
mov ecx, dword [0x9e6de58]
add esp, 0x10
cmp eax, edi
mov dword [0x9e6e684], eax
mov esi, ecx
jne 0x100049a7
xor ebx, ebx
jmp 0x10004906
mov ecx, dword [0x9e6de58]
cmp dword [0x9e6de54], 0xfffff7cb
jne 0x100049a3
cmp ecx, 0xfa0a
jne 0x10004925
mov ecx, 0x2eea
jmp 0x1000493b
sub ecx, 0x2eea
neg ecx
sbb ecx, ecx
and ecx, 0xd2f0
add ecx, 0x271a
cmp ecx, esi
mov dword [0x9e6de58], ecx
je 0x100049a3
mov edx, dword [0x9e6ddc8]
push ecx
add edx, 0x4fc
push edx
call fcn.10011b60
add esp, 8
cmp eax, ebx
je 0x10004973
lea ecx, [eax + 0xd]
mov dword [0x9e6e38c], ecx
mov edx, dword [eax + 9]
mov dword [0x9e6e390], edx
jmp 0x1000497f
mov dword [0x9e6e38c], ebx
mov dword [0x9e6e390], ebx
mov eax, dword [0x9e6ddc8]
push 1
push 0x9e6de48
push eax
call fcn.10012000
add esp, 0xc
cmp eax, edi
mov dword [0x9e6e684], eax
je 0x10004900
jmp 0x100049a7
cmp eax, edi
je 0x10004a0b
cmp eax, 1
je 0x10004a6e
push eax
push 0x9e6de48
call fcn.10004330
add esp, 8
test eax, eax
jne 0x100049e3
mov ecx, dword [0x9e6ddc8]
push 3
push 0x9e6de48
push ecx
call fcn.10012000
add esp, 0xc
cmp eax, edi
mov dword [0x9e6e684], eax
jne 0x100049a7
jmp 0x10004a0b
mov edx, dword [0x9e6ddc8]
mov esi, dword [0x9e6de54]
push 4
push 0x9e6de48
push edx
call fcn.10012000
add esp, 0xc
mov dword [0x9e6e684], edi
mov dword [0x9e6de54], esi
mov eax, dword [0x9e6ddc8]
mov ecx, dword [0x9e6de54]
push edi
mov dword [eax + 0xc], ecx
mov edx, dword [0x9e6ddc8]
mov eax, dword [edx + 0x498]
push eax
call fcn.10013dbd
mov eax, dword [0x9e6e684]
add esp, 8
cmp eax, edi
je 0x10004a0b
mov esi, 1
cmp eax, esi
je 0x10004a6e
mov ebx, 0xffffe4a6
mov ecx, dword [0x9e6ddc8]
push edi
mov dword [ecx + 0xc], ebx
mov edx, dword [0x9e6ddc8]
mov eax, dword [edx + 0x498]
push eax
call fcn.10013dbd
mov eax, dword [0x9e6e684]
add esp, 8
cmp eax, esi
jne 0x10004a46
call fcn.1000d580
mov ebx, eax
mov eax, dword [0x9e6e5b0]
xor edx, edx
mov esi, dword [esp + 0x20]
div ebp
test esi, esi
mov dword [esp + 0x28], eax
jne 0x10004a94
push esi
push ebx
call fcn.1000d180
add esp, 8
mov ecx, dword [0x9e6ddc8]
or edi, 0xffffffff
mov edx, dword [ecx + 0x4ac]
mov eax, dword [ecx + 0x4a0]
sub edx, eax
lea eax, [edx - 1]
mov edx, ebp
imul edx, dword [esp + 0x10]
cmp eax, edx
jae 0x10004abf
xor edx, edx
div ebp
mov edi, eax
mov edx, dword [0x9e6e5b0]
lea eax, [esp + 0x18]
push eax
push edx
push ecx
call fcn.1000f0b0
mov ecx, dword [0x9e6e5b0]
add esp, 0xc
add ecx, eax
mov dword [0x9e6e2e8], eax
test esi, esi
mov dword [0x9e6e2f4], ecx
je 0x10004af9
mov eax, dword [0x9e6e2fc]
or al, 2
mov dword [0x9e6e2fc], eax
mov eax, ecx
mov edx, dword [0x9e6ddc8]
mov ecx, dword [0x9e6e57c]
mov dword [0x9e6e2ec], eax
mov dword [0x9e6e2f0], eax
mov eax, dword [edx + 0x734]
mov edx, dword [esp + 0x28]
and eax, 0x10000
push 2
or ecx, eax
mov dword [0x9e6e694], 0
mov dword [0x9e6e57c], ecx
mov ecx, dword [esp + 0x14]
mov dword [0x9e6e698], ecx
mov dword [0x9e6e69c], edx
mov dword [0x9e6e6a0], esi
mov dword [0x9e6e6a4], ebp
mov dword [0x9e6e6a8], edi
mov dword [0x9e6e6ac], ebx
call fcn.10005160
mov dword [0x9e6e324], eax
mov eax, dword [0x9e6ddc8]
push 2
push 0x9e6de48
push eax
call fcn.10012000
add esp, 0x10
cmp eax, 2
mov dword [0x9e6e684], eax
je 0x10004be8
cmp eax, 1
je 0x10004be8
push eax
push 0x9e6de48
call fcn.10004340
add esp, 8
test eax, eax
jne 0x10004bbc
mov ecx, dword [0x9e6ddc8]
push 3
push 0x9e6de48
push ecx
call fcn.10012000
add esp, 0xc
cmp eax, 2
mov dword [0x9e6e684], eax
jne 0x10004b83
jmp 0x10004be8
mov edx, dword [0x9e6ddc8]
mov esi, dword [0x9e6de54]
push 4
push 0x9e6de48
push edx
call fcn.10012000
mov eax, 2
add esp, 0xc
mov dword [0x9e6e684], eax
mov dword [0x9e6de54], esi
mov ecx, dword [0x9e6e308]
mov edx, dword [0x9e6e30c]
cmp ecx, edx
je 0x10004c0c
push 7
push 0x9e6de48
call fcn.10004340
mov eax, dword [0x9e6e684]
add esp, 8
cmp eax, 2
jne 0x10004c40
mov edx, dword [0x9e6ddc8]
mov eax, dword [0x9e6de54]
push 2
mov dword [edx + 0xc], eax
mov ecx, dword [0x9e6ddc8]
mov edx, dword [ecx + 0x498]
push edx
call fcn.10013dbd
mov eax, dword [0x9e6e684]
add esp, 8
cmp eax, 2
je 0x10004c11
mov edi, 1
cmp eax, edi
je 0x10004c76
mov esi, 0xffffe4a6
mov eax, dword [0x9e6ddc8]
push 2
mov dword [eax + 0xc], esi
mov ecx, dword [0x9e6ddc8]
mov edx, dword [ecx + 0x498]
push edx
call fcn.10013dbd
mov eax, dword [0x9e6e684]
add esp, 8
cmp eax, edi
jne 0x10004c4e
mov eax, dword [0x9e6ddc8]
mov edi, dword [0x9e6e308]
push eax
mov eax, dword [0x9e6e30c]
sub eax, edi
push eax
call fcn.10001640
xor esi, esi
xor ebp, ebp
add esp, 8
mov dword [0x9e6de20], eax
mov dword [0x9e6e690], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call fcn.10005090
cmp ax, 0xffd8
mov ebx, 0xfffff9f4
je 0x10004ce8
mov ecx, dword [0x9e6ddc8]
push 2
mov dword [ecx + 0xc], ebx
mov edx, dword [0x9e6ddc8]
mov eax, dword [edx + 0x498]
push eax
call fcn.10013dbd
add esp, 8
call fcn.10005090
cmp ax, 0xffd8
jne 0x10004cbd
mov ecx, dword [0x9e6e690]
mov dword [0x9e6e688], ecx
call fcn.10005090
mov edi, eax
cmp di, 0xffda
je 0x10004f11
mov ebx, 0x9e6de24
mov dword [esp + 0x18], ebx
call fcn.10005090
mov si, ax
mov eax, edi
and esi, 0xffff
and eax, 0xffff
sub esi, 2
sub eax, 0xffc4
je 0x10004d6e
sub eax, 0x17
je 0x10004d43
cmp di, 0xffc0
jb 0x10004e79
jmp 0x10004e4d
call fcn.10005030
dec esi
cmp ebx, 0x9e6de30
jge 0x10004e9f
mov edx, dword [0x9e6e690]
inc ebp
mov dword [ebx], edx
add ebx, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebx
jmp 0x10004e4d
mov eax, dword [0x9e6e690]
add esi, eax
cmp eax, esi
mov dword [esp + 0x10], esi
jae 0x10004e0e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
lea ebp, [eax*4 + 0x9e6de3c]
lea ebx, [ecx*4 + 0x9e6de30]
call fcn.10005030
test al, 0xf0
jne 0x10004dc2
cmp ebx, 0x9e6de3c
jge 0x10004ec5
mov ecx, dword [esp + 0x20]
mov edx, dword [0x9e6e690]
inc ecx
mov dword [ebx], edx
mov dword [esp + 0x20], ecx
add ebx, 4
jmp 0x10004de2
cmp ebp, 0x9e6de48
jge 0x10004eeb
mov ecx, dword [esp + 0x28]
mov eax, dword [0x9e6e690]
inc ecx
mov dword [ebp], eax
mov dword [esp + 0x28], ecx
add ebp, 4
xor esi, esi
mov edi, 0x10
call fcn.10005030
and eax, 0xff
add esi, eax
dec edi
jne 0x10004de9
push esi
call fcn.10005100
mov eax, dword [0x9e6e690]
mov ecx, dword [esp + 0x14]
add esp, 4
cmp eax, ecx
jb 0x10004d97
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x10004e43
mov ecx, dword [0x9e6ddc8]
push 2
mov dword [ecx + 0xc], 0xfffff9f4
mov edx, dword [0x9e6ddc8]
mov eax, dword [edx + 0x498]
push eax
call fcn.10013dbd
mov eax, dword [0x9e6e690]
add esp, 8
cmp eax, esi
jne 0x10004e16
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
xor esi, esi
push esi
call fcn.10005100
mov ecx, dword [0x9e6e690]
add esp, 4
mov dword [0x9e6e688], ecx
call fcn.10005090
mov edi, eax
cmp di, 0xffda
je 0x10004f17
jmp 0x10004d0f
mov esi, 0xfffff9f4
mov edx, dword [0x9e6ddc8]
push 2
mov dword [edx + 0xc], esi
mov eax, dword [0x9e6ddc8]
mov ecx, dword [eax + 0x498]
push ecx
call fcn.10013dbd
add esp, 8
jmp 0x10004e7e
mov esi, 0xfffff9f4
mov edx, dword [0x9e6ddc8]
push 2
mov dword [edx + 0xc], esi
mov eax, dword [0x9e6ddc8]
mov ecx, dword [eax + 0x498]
push ecx
call fcn.10013dbd
add esp, 8
jmp 0x10004ea4
mov esi, 0xfffff9f4
mov edx, dword [0x9e6ddc8]
push 2
mov dword [edx + 0xc], esi
mov eax, dword [0x9e6ddc8]
mov ecx, dword [eax + 0x498]
push ecx
call fcn.10013dbd
add esp, 8
jmp 0x10004eca
mov esi, 0xfffff9f4
mov edx, dword [0x9e6ddc8]
push 2
mov dword [edx + 0xc], esi
mov eax, dword [0x9e6ddc8]
mov ecx, dword [eax + 0x498]
push ecx
call fcn.10013dbd
add esp, 8
jmp 0x10004ef0
mov edi, dword [esp + 0x28]
jmp 0x10004f24
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x28]
mov ebx, 0xfffff9f4
call fcn.10005090
and eax, 0xffff
sub eax, 2
push eax
call fcn.10005100
mov edx, dword [0x9e6ddc8]
add esp, 4
test byte [edx + 0x738], 1
je 0x10004f53
mov eax, dword [0x9e6e690]
mov dword [0x9e6e688], eax
mov ecx, dword [0x9e6de20]
mov eax, dword [0x9e6e688]
sub ecx, eax
mov dword [0x9e6e68c], ecx
test ebp, ebp
je 0x10004f72
test esi, esi
je 0x10004f72
test edi, edi
jne 0x10004f93
mov edx, dword [0x9e6ddc8]
push 2
mov dword [edx + 0xc], ebx
mov eax, dword [0x9e6ddc8]
mov ecx, dword [eax + 0x498]
push ecx
call fcn.10013dbd
add esp, 8
jmp 0x10004f66
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x10004ffe
cmp ebp, 3
jge 0x10004fbc
lea ecx, [ebp*4 + 0x9e6de20]
lea eax, [ebp*4 + 0x9e6de24]
mov edx, dword [ecx]
mov dword [eax], edx
add eax, 4
cmp eax, 0x9e6de30
jl 0x10004fae
cmp esi, 3
jge 0x10004fdd
lea ecx, [esi*4 + 0x9e6de2c]
lea eax, [esi*4 + 0x9e6de30]
mov edx, dword [ecx]
mov dword [eax], edx
add eax, 4
cmp eax, 0x9e6de3c
jl 0x10004fcf
cmp edi, 3
jge 0x10004ffe
lea ecx, [edi*4 + 0x9e6de38]
lea eax, [edi*4 + 0x9e6de3c]
mov edx, dword [ecx]
mov dword [eax], edx
add eax, 4
cmp eax, 0x9e6de48
jl 0x10004ff0
mov eax, dword [0x9e6ddc8]
push 4
push 0x9e6de48
push eax
call fcn.10012000
mov ecx, dword [0x9e6ddc8]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ecx + 0x494], 0x64
pop ebx
add esp, 0xc
ret