Function at 0x470ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x28
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0xb8]
push ebp
push edi
lea edi, [esi + 0xc]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x24], eax
cmp ebx, 2
jne 0x471018
mov byte [esp + 0x13], 1
jmp 0x47102c
cmp ebx, 3
je 0x471027
mov byte [esp + 0x13], 4
cmp ebx, 4
jne 0x47102c
mov byte [esp + 0x13], 2
mov ecx, dword [esi + 0x44]
imul ecx, ebx
add ecx, dword [esi + 0x2c]
lea eax, [ecx + eax + 1]
mov ecx, edi
call fcn.0046fd10
mov edx, dword [edi + 0x10]
sub edx, dword [edi + 0xc]
mov ebp, dword [esi + 0x24]
cmp ebp, edx
jb 0x471052
call fcn.00480e22
mov eax, dword [edi + 0xc]
mov byte [eax + ebp], bl
xor ebp, ebp
test ebx, ebx
jle 0x4710c3
mov edi, edi
cmp ebp, dword [esi + 0xb8]
jge 0x471078
mov ecx, dword [esi + ebp*8 + 0xbc]
mov edx, dword [ecx + 8]
mov dword [esp + 0x14], edx
jmp 0x471080
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esi + 0x44]
mov edx, dword [edi + 0x10]
imul eax, ebp
mov ecx, dword [esi + 0x24]
sub edx, dword [edi + 0xc]
lea eax, [eax + ecx + 1]
mov dword [esp + 0x1c], eax
cmp eax, edx
jb 0x4710a4
call fcn.00480e22
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x48]
push ecx
lea ecx, [esp + edx*4 + 0x18]
mov edx, dword [edi + 0xc]
push ecx
add edx, eax
push edx
call fcn.00483e40
inc ebp
add esp, 0xc
cmp ebp, ebx
jl 0x471060
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x60]
call edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 8]
xor bl, bl
cmp ecx, dword [eax + 0x10]
mov dword [esp + 0x14], 0
mov edx, 8
mov dword [esp + 0x28], ecx
jge 0x47121f
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 0xc]
mov dword [esp + 0x24], ecx
jge 0x4711ca
jmp 0x471114
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0x28]
imul eax, dword [esp + 0x28]
add eax, ecx
mov ecx, dword [esp + 0x1c]
movzx ecx, byte [eax + ecx]
mov eax, ecx
shr eax, 0xd
xor eax, ecx
and eax, 0xff
mov eax, dword [esi + eax*4 + 0x8bc]
test eax, eax
je 0x47114b
lea ecx, [ecx]
cmp dword [eax + 8], ecx
je 0x471165
mov eax, dword [eax]
test eax, eax
jne 0x471140
mov byte [esp + 0x3c], 0xff
test edx, edx
je 0x47116e
movzx ebp, byte [esp + 0x13]
mov ecx, ebp
shl bl, cl
or bl, byte [esp + 0x3c]
sub edx, ebp
jmp 0x4711ae
mov cl, byte [eax + 4]
mov byte [esp + 0x3c], cl
jmp 0x471150
mov edx, dword [esi + 0x44]
imul edx, dword [esp + 0x18]
add edx, dword [esi + 0x24]
mov ecx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
sub ecx, dword [edi + 0xc]
lea ebp, [edx + eax + 1]
cmp ebp, ecx
jb 0x471190
call fcn.00480e22
mov edx, dword [edi + 0xc]
movzx ecx, byte [esp + 0x13]
inc dword [esp + 0x14]
mov byte [edx + ebp], bl
xor bl, bl
shl bl, cl
mov edx, 8
or bl, byte [esp + 0x3c]
sub edx, ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
inc eax
cmp eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
jl 0x471110
mov eax, ecx
test edx, edx
je 0x4711d6
movzx ecx, byte [esp + 0x13]
nop
shl bl, cl
sub edx, ecx
jne 0x4711d0
mov edx, dword [esi + 0x44]
imul edx, dword [esp + 0x18]
add edx, dword [esi + 0x24]
mov ecx, dword [esp + 0x14]
lea ebp, [edx + ecx + 1]
mov edx, dword [edi + 0x10]
sub edx, dword [edi + 0xc]
cmp ebp, edx
jb 0x4711fc
call fcn.00480e22
mov eax, dword [esp + 0x38]
mov ecx, dword [edi + 0xc]
inc dword [esp + 0x14]
mov byte [ecx + ebp], bl
mov ecx, dword [esp + 0x28]
inc ecx
xor bl, bl
cmp ecx, dword [eax + 0x10]
mov edx, 8
mov dword [esp + 0x28], ecx
jl 0x4710f5
pop edi
pop ebp
pop ebx
add esp, 0x28
ret 8