Function at 0x40b670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x30]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x2c]
cmp eax, dword [esp + 0x34]
mov dword [esp + 8], eax
cmovl eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, edx
mov ecx, dword [esp + 4]
push ebx
push ebp
mov eax, dword [eax + 4]
sub eax, dword [edx + 8]
push esi
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x34]
imul ecx, eax
mov eax, dword [esp + 0x14]
cmp eax, esi
push edi
mov edi, dword [esp + 0x34]
cmovl eax, esi
imul eax, dword [edx + 8]
mov esi, ecx
push 0
lea ebp, [ebx + edi*2]
mov dword [esp + 0x20], ebp
add esi, eax
mov eax, edx
sub esi, dword [eax + 0xc]
add esi, edi
lea eax, [esi + 1]
push eax
push 4
push 2
call fcn.00403540
mov edi, dword [esp + 0x40]
add esp, 0x10
mov dword [edi], eax
test eax, eax
jne 0x40b6f0
call fcn.00425c40
mov eax, dword [edi]
xor edx, edx
mov dword [esp + 0x20], edx
mov dword [eax + 4], esi
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
lea eax, [eax + esi*2]
mov word [eax + ecx], dx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
add esi, eax
cmp ebx, ebp
je 0x40b8ba
cmp word [ebx], 0x25
mov dword [esp + 0x14], ebx
je 0x40b729
add ebx, 2
cmp word [ebx], 0x25
jne 0x40b720
movzx eax, word [ebx + 2]
mov edi, ebx
add ebx, 2
mov byte [esp + 0x13], 0
mov ecx, eax
cmp eax, 0x4c
jne 0x40b74a
movzx ecx, word [ebx + 2]
add ebx, 2
mov byte [esp + 0x13], 1
movzx eax, cx
push eax
call fcn.00409f10
add esp, 4
movsx ebp, word [eax + 2]
sar ebp, 0xb
cmp ebp, 0xffffffff
je 0x40b797
lea eax, [ebx + 2]
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x1c]
je 0x40b797
movzx eax, word [eax]
push eax
call fcn.00409f10
add esp, 4
movsx ecx, word [eax + 2]
sar ecx, 0xb
cmp ecx, 0xffffffff
je 0x40b797
mov ebx, dword [esp + 0x24]
lea eax, [ebp*4]
add eax, ebp
lea ebp, [ecx + eax*2]
mov eax, dword [esp + 0x3c]
cmp ebp, dword [eax]
mov eax, dword [esp + 0x14]
je 0x40b7bc
mov edi, ebx
sub edi, eax
and edi, 0xfffffffe
push edi
push eax
push esi
call fcn.00526230
add esp, 0xc
add esi, edi
jmp 0x40b884
sub edi, eax
add ebx, 2
and edi, 0xfffffffe
push edi
push eax
push esi
call fcn.00526230
mov eax, dword [esp + 0x50]
add esi, edi
mov ecx, dword [esp + 0x58]
add esp, 0xc
cmp byte [esp + 0x13], 0
mov edi, dword [esp + 0x18]
je 0x40b7ed
cmp edi, ecx
cmovl edi, ecx
sub edi, ecx
jmp 0x40b7f4
cmp edi, eax
cmovl edi, eax
sub edi, eax
mov ebp, dword [esp + 0x40]
test ebp, ebp
jle 0x40b81c
test edi, edi
je 0x40b81c
mov edx, edi
mov ax, word [esp + 0x54]
mov ecx, esi
add esi, 2
mov word [ecx], ax
sub edx, 1
jne 0x40b802
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x44]
cmp byte [esp + 0x13], 0
je 0x40b837
lea eax, [ecx + ecx]
push eax
push dword [esp + 0x54]
push esi
call fcn.00526230
mov eax, dword [esp + 0x58]
jmp 0x40b848
add eax, eax
push eax
push dword [esp + 0x4c]
push esi
call fcn.00526230
mov eax, dword [esp + 0x50]
add eax, eax
add esp, 0xc
add esi, eax
mov eax, esi
test ebp, ebp
jns 0x40b872
test edi, edi
je 0x40b872
nop dword [eax]
mov ax, word [esp + 0x54]
mov ecx, esi
add esi, 2
mov word [ecx], ax
sub edi, 1
jne 0x40b860
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x3c]
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [edx + 4]
je 0x40b89a
cmp ebx, dword [esp + 0x1c]
jne 0x40b716
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x1c]
sub eax, ebx
and eax, 0xfffffffe
push eax
push ebx
push esi
call fcn.00526230
mov eax, dword [esp + 0x3c]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret