Function at 0x10040bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, dword [ebp + 8]
mov eax, dword [0x100ea080]
xor eax, ebp
mov dword [esp + 0x30], eax
cmp byte [edx + 0xb], 0
js 0x10040beb
mov word [edx], 0
mov byte [edx + 0xb], 0
jmp 0x10040bf9
mov eax, dword [edx]
mov word [eax], 0
mov dword [edx + 4], 0
cmp byte [esi + 0xb], 0
mov dword [esp + 0x14], edx
js 0x10040c0e
mov word [esi], 0
mov byte [esi + 0xb], 0
jmp 0x10040c1c
mov eax, dword [esi]
mov word [eax], 0
mov dword [esi + 4], 0
movzx eax, byte [ecx + 0xb]
mov esi, ecx
mov dword [esp + 0x10], eax
test al, al
jns 0x10040c33
mov esi, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], ecx
movzx eax, byte [0x100eb81c]
xor eax, 3
xor edi, edi
mov dword [esp + 0x1c], eax
mov ebx, dword [edi*8 + 0x100d0db4]
mov eax, dword [edi*8 + 0x100d0db0]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x2b], bl
lea ecx, [ebx + ebx]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.100a9e00
add esp, 0xc
mov word [esp + ebx*2 + 0x20], 0
movzx edx, byte [esp + 0x2b]
test dl, dl
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edx
mov dword [esp + 0x18], eax
cmovs edx, eax
cmp edx, dword [esp + 0x10]
jbe 0x10040cc0
cmp byte [esp + 8], 0
js 0x10040d00
mov eax, dword [esp + 0x1c]
jmp 0x10040d16
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
test edx, edx
je 0x10040d23
cmp byte [esp + 8], 0
lea ebx, [esp + 0x20]
cmovs ebx, dword [esp + 0xc]
xor ecx, ecx
nop dword [eax]
movzx eax, word [esi + ecx*2]
cmp ax, word [ebx + ecx*2]
jne 0x10040ca6
add ecx, 1
cmp edx, ecx
jne 0x10040ce0
jmp 0x10040d23
push dword [esp + 0x20]
call fcn.100a6614
add esp, 4
movzx eax, byte [0x100eb81c]
xor eax, 3
add edi, 1
cmp edi, eax
jb 0x10040c43
jmp 0x10040d64
mov edx, dword [esp + 8]
test dl, dl
js 0x10040d35
mov edi, dword [esp + 4]
test edx, edx
jne 0x10040d4d
jmp 0x10040d64
push dword [esp + 0xc]
call fcn.100a6614
add esp, 4
mov edi, dword [esp + 4]
mov edx, dword [esp + 0x18]
test edx, edx
je 0x10040d64
movzx eax, byte [edi + 0xb]
test al, al
js 0x10040d5d
mov ecx, edi
cmp edx, eax
je 0x10040d64
jmp 0x10040d7d
mov eax, dword [edi + 4]
cmp edx, eax
jne 0x10040d7b
xor ebx, ebx
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.100a6651
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [edi]
lea edx, [ecx + eax*2]
mov esi, edx
test eax, eax
jle 0x10040da0
mov esi, ecx
nop dword [eax + eax]
cmp word [esi], 0x3d
je 0x10040da0
add esi, 2
add eax, 0xffffffff
jne 0x10040d90
mov esi, edx
mov eax, esi
sub eax, ecx
sar eax, 1
cmp esi, edx
mov esi, 0xffffffff
cmovne esi, eax
mov eax, edi
add edi, 0xc
lea ecx, [esp + 0x20]
push edi
push esi
push 0
push eax
call fcn.1003d956
mov ebx, dword [esp + 0x14]
cmp byte [ebx + 0xb], 0
js 0x10040dd8
mov word [ebx], 0
mov byte [ebx + 0xb], 0
jmp 0x10040dfd
mov eax, dword [ebx]
mov word [eax], 0
mov dword [ebx + 4], 0
cmp byte [ebx + 0xb], 0
jns 0x10040dfd
push dword [ebx]
call fcn.100a6614
add esp, 4
mov dword [ebx + 8], 0
mov eax, dword [esp + 0x28]
mov dword [ebx + 8], eax
movsd xmm0, qword [esp + 0x20]
movsd qword [ebx], xmm0
mov bl, 1
cmp esi, 0xffffffff
je 0x10040d66
add esi, 1
lea ecx, [esp + 0x20]
push edi
push 0xffffffffffffffff
push esi
push dword [esp + 0x10]
call fcn.1003d956
mov esi, dword [ebp + 8]
cmp byte [esi + 0xb], 0
js 0x10040e41
mov word [esi], 0
mov byte [esi + 0xb], 0
jmp 0x10040e66
mov eax, dword [esi]
mov word [eax], 0
mov dword [esi + 4], 0
cmp byte [esi + 0xb], 0
jns 0x10040e66
push dword [esi]
call fcn.100a6614
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esp + 0x28]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0x20]
movsd qword [esi], xmm0
jmp 0x10040d66