Function at 0x409eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push ebx
cdq
xor eax, edx
mov ebx, dword [esp + 0x28]
sub eax, edx
mov edx, dword [ecx + 8]
cmp eax, dword [esp + 0x34]
push ebp
push esi
push edi
mov esi, dword [esp + 0x30]
mov edi, eax
cmovl edi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ecx
mov ecx, dword [esp + 0x14]
push 0
lea ebp, [ebx + esi*2]
mov eax, dword [eax + 4]
sub eax, edx
mov dword [esp + 0x1c], ebp
imul edi, eax
mov eax, dword [esp + 0x4c]
cmp ecx, eax
cmovl ecx, eax
mov eax, dword [esp + 0x3c]
imul ecx, edx
add edi, ecx
sub edi, dword [eax + 0xc]
add edi, esi
lea eax, [edi + 1]
push eax
push 4
push 2
call fcn.00401560
mov edx, dword [esp + 0x3c]
add esp, 0x10
mov dword [edx], eax
test eax, eax
jne 0x409f2f
call fcn.00418900
mov edx, dword [esp + 0x2c]
mov eax, dword [edx]
xor esi, esi
mov dword [esp + 0x20], 0
mov dword [eax + 4], edi
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
lea eax, [eax + edi*2]
mov word [eax + ecx], si
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
add esi, eax
cmp ebx, ebp
je 0x40a10a
nop dword [eax]
cmp word [ebx], 0x25
mov dword [esp + 0x1c], ebx
je 0x409f79
nop word [eax + eax]
add ebx, 2
cmp word [ebx], 0x25
jne 0x409f70
movzx eax, word [ebx + 2]
mov edx, ebx
mov edi, ebx
mov byte [esp + 0x13], 0
add ebx, 2
mov ecx, eax
cmp eax, 0x4c
jne 0x409f9c
movzx ecx, word [edx + 4]
lea ebx, [edx + 4]
mov byte [esp + 0x13], 1
movzx eax, cx
push eax
call fcn.00407fe0
add esp, 4
movsx ebp, word [eax + 2]
sar ebp, 0xb
cmp ebp, 0xffffffff
je 0x409fe9
lea eax, [ebx + 2]
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x18]
je 0x409fe9
movzx eax, word [eax]
push eax
call fcn.00407fe0
add esp, 4
movsx ecx, word [eax + 2]
sar ecx, 0xb
cmp ecx, 0xffffffff
je 0x409fe9
mov ebx, dword [esp + 0x24]
lea eax, [ebp*4]
add eax, ebp
lea ebp, [ecx + eax*2]
mov eax, dword [esp + 0x38]
cmp ebp, dword [eax]
mov eax, dword [esp + 0x1c]
je 0x40a00e
mov edi, ebx
sub edi, eax
and edi, 0xfffffffe
push edi
push eax
push esi
call fcn.005229c0
add esp, 0xc
add esi, edi
jmp 0x40a0d4
sub edi, eax
add ebx, 2
and edi, 0xfffffffe
push edi
push eax
push esi
call fcn.005229c0
mov eax, dword [esp + 0x4c]
add esi, edi
mov ecx, dword [esp + 0x54]
add esp, 0xc
cmp byte [esp + 0x13], 0
mov edi, dword [esp + 0x14]
je 0x40a03f
cmp edi, ecx
cmovl edi, ecx
sub edi, ecx
jmp 0x40a046
cmp edi, eax
cmovl edi, eax
sub edi, eax
mov ebp, dword [esp + 0x3c]
test ebp, ebp
jle 0x40a06e
test edi, edi
je 0x40a06e
mov edx, edi
mov ax, word [esp + 0x50]
mov ecx, esi
add esi, 2
mov word [ecx], ax
sub edx, 1
jne 0x40a054
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x40]
cmp byte [esp + 0x13], 0
je 0x40a089
lea eax, [ecx + ecx]
push eax
push dword [esp + 0x50]
push esi
call fcn.005229c0
mov eax, dword [esp + 0x54]
jmp 0x40a09a
add eax, eax
push eax
push dword [esp + 0x48]
push esi
call fcn.005229c0
mov eax, dword [esp + 0x4c]
add eax, eax
add esp, 0xc
add esi, eax
mov eax, esi
test ebp, ebp
jns 0x40a0c2
test edi, edi
je 0x40a0c2
nop dword [eax + eax]
mov ax, word [esp + 0x50]
mov ecx, esi
add esi, 2
mov word [ecx], ax
sub edi, 1
jne 0x40a0b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [ecx + 4]
je 0x40a0ea
cmp ebx, dword [esp + 0x18]
jne 0x409f60
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x18]
sub eax, ebx
and eax, 0xfffffffe
push eax
push ebx
push esi
call fcn.005229c0
mov eax, dword [esp + 0x38]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0x18
ret