Function at 0x41c170
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x548f30
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x57a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5d90c0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x5d90b4]
mov edi, dword [0x5d90b8]
cmp esi, edi
je 0x41c698
push esi
lea ecx, [ebp - 0x90]
call fcn.00419150
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ebp - 0x88], eax
jne 0x41c247
mov ebx, dword [ebp - 0x84]
cmp ebx, dword [ebp + 0xc]
jne 0x41c247
mov edx, dword [ebp - 0x78]
test edx, edx
js 0x41c22e
xor eax, eax
cmp edx, 0x1194
setl al
test eax, eax
je 0x41c22e
mov ecx, dword [edx*4 + 0x20a514c]
cmp dword [ecx + 4], 3
jne 0x41c22e
movzx eax, word [ecx + 0xcc]
cmp eax, dword [ebp + 8]
jne 0x41c22e
cmp byte [ecx + 0x7a], 1
jne 0x41c22e
mov eax, dword [ecx + 0xdbc]
cmp eax, dword [ebp - 0x20]
jne 0x41c22e
test eax, eax
jne 0x41c25e
mov ecx, 0x1e
call fcn.004bd1b0
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
jns 0x41c2ae
mov edi, dword [0x5d90b8]
add esi, 0x74
mov dword [ebp - 4], 0xffffffff
cmp esi, edi
jne 0x41c1c1
jmp 0x41c698
movzx eax, byte [ecx + 0xdc9]
movss xmm0, dword [ecx + 0xfc]
push eax
movzx eax, byte [ecx + 0xdc8]
push eax
cvtps2pd xmm0, xmm0
sub esp, 0x10
movsd qword [esp + 8], xmm0
movss xmm0, dword [ecx + 0x100]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push edx
push ebx
push dword [ebp - 0x88]
push str._CastleSiege__CCastleSiege::AddDbNPC___ERROR___DB_NPC_EXIST__CLS:_d__IDX:_d__d___MAXHP:_d__HP:_d__DF:_d__RG:_d_
push 0
call fcn.005262e0
add esp, 0x2c
jmp 0x41c698
mov edx, dword [ebp - 0x88]
mov ecx, edi
call fcn.004bb250
mov eax, dword [edi*4 + 0x20a514c]
or ecx, 0xffffffff
mov ebx, dword [ebp - 0x60]
xor edx, edx
movd xmm0, dword [ebp - 0x44]
cvtdq2ps xmm0, xmm0
mov word [eax + 0x224], cx
mov eax, dword [edi*4 + 0x20a514c]
mov ecx, dword [ebp - 0x64]
mov word [eax + 0x144], cx
mov eax, dword [edi*4 + 0x20a514c]
mov word [eax + 0x146], bx
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0x149], 0x1e
mov ecx, dword [edi*4 + 0x20a514c]
movzx eax, word [ecx + 0x144]
mov word [ecx + 0x166], ax
mov ecx, dword [edi*4 + 0x20a514c]
movzx eax, word [ecx + 0x146]
mov word [ecx + 0x168], ax
mov ecx, dword [edi*4 + 0x20a514c]
movzx eax, word [ecx + 0x144]
mov word [ecx + 0x162], ax
mov ecx, dword [edi*4 + 0x20a514c]
movzx eax, word [ecx + 0x146]
mov word [ecx + 0x164], ax
mov ecx, dword [edi*4 + 0x20a514c]
movzx eax, byte [ebp - 0x54]
mov byte [ecx + 0x148], al
mov ecx, dword [edi*4 + 0x20a514c]
movzx eax, byte [ecx + 0x144]
mov byte [ecx + 0x160], al
mov ecx, dword [edi*4 + 0x20a514c]
movzx eax, byte [ecx + 0x146]
mov byte [ecx + 0x161], al
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0x216], 0
mov eax, dword [edi*4 + 0x20a514c]
mov dword [eax + 0x220], 0
mov eax, dword [edi*4 + 0x20a514c]
movss dword [eax + 0xfc], xmm0
movd xmm0, dword [ebp - 0x48]
mov eax, dword [edi*4 + 0x20a514c]
cvtdq2ps xmm0, xmm0
movss dword [eax + 0x100], xmm0
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0xdc0], 1
mov eax, dword [ebp - 0x50]
test eax, eax
cmovns edx, eax
mov eax, 3
cmp edx, eax
cmovg edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
test eax, eax
cmovns ecx, eax
mov eax, 3
cmp ecx, 3
cmovg ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [ebp + 8], ecx
sub eax, 0x115
je 0x41c455
sub eax, 6
jne 0x41c476
mov ecx, dword [edi*4 + 0x20a514c]
mov eax, dword [edx*4 + 0x5d8f74]
mov dword [ecx + 0x300], eax
mov eax, dword [edi*4 + 0x20a514c]
mov ecx, dword [ebp + 8]
mov byte [eax + 0xdc8], dl
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0xdc9], cl
jmp 0x41c476
mov ecx, dword [edi*4 + 0x20a514c]
mov eax, dword [edx*4 + 0x5d8f64]
mov dword [ecx + 0x300], eax
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0xdc8], dl
call fcn.00526930
cdq
mov ecx, 0xff
idiv ecx
inc dl
mov byte [esi + 0x70], dl
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0xdbc], dl
call fcn.00526930
mov ecx, eax
and ecx, 0x800000ff
jns 0x41c4ac
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esi + 0x71], cl
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0xdbd], cl
call fcn.00526930
mov ecx, eax
and ecx, 0x800000ff
jns 0x41c4d3
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esi + 0x72], cl
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0xdbe], cl
call fcn.00526930
mov ecx, eax
and ecx, 0x800000ff
jns 0x41c4fa
dec ecx
or ecx, 0xffffff00
inc ecx
cmp dword [ebp - 0x88], 0x115
mov byte [esi + 0x73], cl
mov eax, dword [edi*4 + 0x20a514c]
mov byte [eax + 0xdbf], cl
jne 0x41c648
mov ecx, dword [ebp - 0x64]
test ecx, ecx
js 0x41c599
xor eax, eax
cmp ecx, 0xff
setle al
test eax, eax
je 0x41c599
test ebx, ebx
js 0x41c599
xor eax, eax
cmp ebx, 0xff
setle al
test eax, eax
je 0x41c599
lea eax, [ecx + 3]
lea ebx, [ecx - 2]
mov dword [ebp + 8], eax
cmp ebx, eax
jg 0x41c596
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp + 8]
lea edi, [eax + 2]
nop dword [eax]
cmp eax, edi
jg 0x41c58e
mov ecx, eax
mov edx, edi
shl ecx, 8
sub edx, eax
add ecx, ebx
inc edx
mov eax, dword [0xfbe010]
lea ecx, [ecx + 0x100]
and byte [ecx + eax - 0x100], 0xef
sub edx, 1
jne 0x41c570
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp + 8]
inc ebx
cmp ebx, ecx
jle 0x41c560
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x60]
push 0
push 0
push 0
push 0
push 0
push 0xd
push 0
push dword [edi*4 + 0x20a514c]
call fcn.00477200
mov eax, dword [edi*4 + 0x20a514c]
mov ecx, dword [ebp - 0x2c]
mov byte [eax + 0xdc1], 1
cmp ecx, 0xffffffff
je 0x41c604
test ecx, ecx
js 0x41c604
xor eax, eax
cmp ecx, 0x1194
setl al
test eax, eax
je 0x41c604
mov eax, dword [ecx*4 + 0x20a514c]
cmp dword [eax + 4], 3
jne 0x41c604
mov edx, 0xdb
cmp word [eax + 0xcc], dx
jne 0x41c604
push edi
push ecx
call fcn.0041d9c0
test eax, eax
jne 0x41c648
jmp 0x41c633
mov ecx, dword [ebp - 0x64]
lea eax, [ebx + 4]
push eax
push ecx
call fcn.0041d830
test eax, eax
js 0x41c62c
cmp eax, 0x1194
jge 0x41c62c
push edi
push eax
mov dword [esi + 0x64], eax
call fcn.0041d9c0
test eax, eax
jne 0x41c648
jmp 0x41c633
mov dword [esi + 0x64], 0xffffffff
push dword [ebp - 0x84]
push str._CastleSiege__CCastleSiege::CreateDbNPC___ERROR___Failed_to_Create_Gate_Lever_:_GateIndex:_d
push 1
call fcn.005262e0
add esp, 0xc
mov ebx, dword [ebp - 0x88]
mov dword [esi + 0x18], edi
mov dword [esi + 0x68], 2
mov dword [esi + 4], 1
mov dword [ebp - 0x10], 1
cmp ebx, 0x115
je 0x41c676
cmp ebx, 0x11b
jne 0x41c698
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push ebx
push dword [ebp - 0x84]
push str._CastleSiege__CreateDBNPC___Index:_d__Num:_d__DF:_d__RG:_d__MaxHP:_d__HP:_d__
push 0
call fcn.005262e0
add esp, 0x20
push 0x5d90c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8