Function at 0x10035ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [ebp - 0x18], eax
jle 0x10035cf3
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor edi, edi
cmp ecx, 2
jl 0x10035cee
dec dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 0x14], edi
add edi, 2
cmp edi, ecx
jg 0x10035cee
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
cmp ecx, eax
jae 0x10035c7b
cmp ecx, eax
mov dword [ebp - 0x10], eax
jae 0x10035c90
mov eax, dword [ebp + 8]
lea edx, [ecx + 1]
mov dword [eax + 0xc], edx
movzx esi, byte [ecx]
mov ecx, edx
shl esi, 8
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jae 0x10035c97
cmp ecx, eax
mov dword [ebp - 0x10], eax
jae 0x10035cad
mov edx, dword [ebp + 8]
lea eax, [ecx + 1]
mov dword [edx + 0xc], eax
movzx edx, byte [ecx]
mov ecx, eax
or edx, esi
lea esi, [edx - 0xd800]
cmp esi, 0x7ff
ja 0x10035bd6
mov edi, dword [ebp - 0x14]
xor edx, edx
add edi, 4
cmp edi, dword [ebp + 0xc]
jg 0x10035bb7
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jae 0x10035cb4
cmp ecx, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
jae 0x10035cca
mov edx, dword [ebp + 8]
lea eax, [ecx + 1]
mov dword [edx + 0xc], eax
movzx edi, byte [ecx]
mov ecx, eax
shl edi, 8
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jae 0x10035cd1
cmp ecx, eax
jae 0x10035ce7
mov edx, dword [ebp + 8]
lea eax, [ecx + 1]
mov dword [edx + 0xc], eax
movzx edx, byte [ecx]
or edx, edi
mov edi, dword [ebp - 0x14]
add edx, 0xffff2400
mov eax, edx
or eax, esi
cmp eax, 0x3ff
ja 0x10035cee
shl esi, 0xa
lea edx, [esi + edx + 0x10000]
test edx, edx
je 0x10035cee
cmp edx, 0x7f
ja 0x10035bf4
mov ecx, dword [ebp + 0x10]
mov eax, ebx
sub eax, ecx
cmp eax, dword [ebp - 0x18]
jge 0x10035c6b
mov byte [ebx], dl
inc ebx
jmp 0x10035c6b
mov eax, edx
mov esi, ebx
mov cl, 0x23
or eax, 1
sub esi, dword [ebp + 0x10]
bsr eax, eax
xor eax, 0x1f
sub cl, al
movzx eax, cl
imul ecx, eax, 0xcd
shr ecx, 0xa
cmp esi, dword [ebp - 0x18]
lea eax, [ecx + ecx]
lea esi, [eax + eax*2]
jge 0x10035c41
lea eax, [eax + eax*2 - 6]
mov dword [ebp - 0x14], edi
mov edi, 0x100
shr edi, cl
mov dword [ebp - 0x10], eax
mov eax, edx
mov ecx, dword [ebp - 0x10]
neg edi
shr eax, cl
or eax, edi
mov edi, dword [ebp - 0x14]
mov byte [ebx], al
inc ebx
mov ecx, dword [ebp + 0x10]
cmp esi, 0xc
jb 0x10035c6b
mov eax, ebx
sub eax, ecx
cmp eax, dword [ebp - 0x18]
jge 0x10035c63
mov eax, edx
lea ecx, [esi - 0xc]
shr eax, cl
mov ecx, dword [ebp + 0x10]
and al, 0x3f
or al, 0x80
mov byte [ebx], al
inc ebx
add esi, 0xfffffffa
cmp esi, 0xb
jg 0x10035c49
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 1]
cmp eax, ecx
jl 0x10035aed
jmp 0x10035cee
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.10034c90
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
jmp 0x10035b0c
xor esi, esi
jmp 0x10035b28
mov ecx, dword [ebp + 8]
call fcn.10034c90
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
jmp 0x10035b33
xor edx, edx
jmp 0x10035b4c
mov ecx, dword [ebp + 8]
call fcn.10034c90
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
jmp 0x10035b74
xor edi, edi
jmp 0x10035b93
mov ecx, dword [ebp + 8]
call fcn.10034c90
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
jmp 0x10035b9e
xor edx, edx
jmp 0x10035bb2
mov byte [ebx], 0
jmp 0x10035cf8
mov edi, 0xffffffea
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret