Function at 0x5035fb6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5073a2d
mov eax, dword fs:[0]
push eax
sub esp, 0xa68
mov eax, dword [0x509ddfc]
xor eax, esp
mov dword [esp + 0xa60], eax
push ebx
push esi
push edi
mov eax, dword [0x509ddfc]
xor eax, esp
push eax
lea eax, [esp + 0xa78]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
xor edi, edi
add eax, 0x60
mov esi, ecx
push edi
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
call fcn.050148cd
cmp dword [esi], edi
pop ecx
pop ecx
jne 0x5036031
mov eax, dword [ebx + 4]
push edi
push 0x300
push 0x3000
push eax
call fcn.05062683
add esp, 0x10
mov dword [esi], eax
mov ecx, ebx
mov dword [esp + 0x2c], ebx
call fcn.0503f80c
xor edx, edx
mov dword [esp + 0xa80], edi
lea eax, [esp + 0x248]
inc edx
mov ecx, edx
shr ecx, 1
movzx ecx, cx
mov word [eax - 2], cx
mov word [eax], cx
mov word [eax + 2], cx
add edx, 0x101
add eax, 8
cmp edx, 0x10101
jb 0x503604d
push edi
mov edi, 0x50524742
push edi
push edi
mov esi, 0x100
push esi
lea eax, [esp + 0x254]
push eax
push eax
mov ecx, ebx
call fcn.0506bbf5
xor ebx, ebx
movzx eax, word [esp + ebx*8 + 0x24a]
push eax
movzx eax, word [esp + ebx*8 + 0x24c]
push eax
movzx eax, word [esp + ebx*8 + 0x24e]
push eax
call fcn.05030f11
add esp, 0xc
mov word [esp + ebx*2 + 0x44], ax
inc ebx
cmp ebx, esi
jb 0x5036090
lea ecx, [esp + 0x44]
call fcn.0502f325
test al, al
jne 0x50360d3
lea ecx, [esp + 0x44]
call fcn.0502f30c
push 2
lea ecx, [esp + 0x48]
call fcn.0502f341
mov eax, dword [esp + 0x28]
xor edx, edx
add eax, 0x204
movzx ecx, word [esp + edx*2 + 0x44]
mov word [eax - 0x200], cx
mov word [eax], cx
mov word [eax + 0x200], cx
inc edx
inc eax
inc eax
cmp edx, esi
jb 0x50360e9
lea eax, [esp + 0x244]
push eax
lea ecx, [esp + 0x48]
call fcn.0502f4ac
lea ebx, [esp + 0xa50]
mov dword [esp + 0x14], 7
mov eax, dword [esp + 0x14]
push 0xf
pop ecx
xor edx, edx
div ecx
lea ecx, [esp + 0x244]
push eax
call fcn.0502f1e6
add dword [esp + 0x14], 0x8000
mov word [ebx], ax
inc ebx
inc ebx
cmp dword [esp + 0x14], 0x80007
jb 0x5036126
and dword [esp + 0x18], 0
lea eax, [esp + 0xa50]
mov dword [esp + 0x20], eax
mov ebx, 0x4000
jmp 0x5036171
mov esi, 0x100
mov eax, dword [esp + 0x20]
movzx eax, word [eax]
and dword [esp + 0x14], 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x248]
xor ecx, ecx
mov dx, word [esp + 0x1c]
mov word [eax - 2], dx
mov edx, dword [esp + 0x14]
movzx edx, word [esp + edx*2 + 0xa50]
mov word [eax], dx
mov dx, word [esp + ecx*2 + 0xa50]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x10
jb 0x503618a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x10
jb 0x5036188
mov ecx, dword [esp + 0x24]
push 0
push edi
push edi
push esi
lea eax, [esp + 0x254]
push eax
push eax
call fcn.0506bbf5
mov eax, dword [esp + 0x28]
push 1
push 0x300
push dword [esp + 0x20]
lea ecx, [esp + 0x3c]
push dword [eax]
call fcn.050623fb
lea ecx, [esp + 0x30]
mov byte [esp + 0xa80], 1
call fcn.05062448
lea esi, [esp + 0x244]
add eax, 2
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x14], 0x10
mov edx, dword [esi]
mov ecx, dword [esi + 4]
shr edx, 0x10
imul edx, edx, 0xff
add edx, ebx
shr edx, 0xf
mov byte [eax - 2], dl
movzx edx, cx
shr ecx, 0x10
imul edx, edx, 0xff
imul ecx, ecx, 0xff
add edx, ebx
add ecx, ebx
shr edx, 0xf
shr ecx, 0xf
mov byte [eax - 1], dl
mov byte [eax], cl
add eax, 3
add esi, 8
dec dword [esp + 0x14]
jne 0x503621e
dec dword [esp + 0x1c]
jne 0x5036216
lea ecx, [esp + 0x30]
mov byte [esp + 0xa80], 0
call fcn.0506242e
add dword [esp + 0x18], 0x300
add dword [esp + 0x20], 2
cmp dword [esp + 0x18], 0x3000
jb 0x503616c
mov ecx, dword [esp + 0x24]
or dword [esp + 0xa80], 0xffffffff
call fcn.0503f832
mov ecx, dword [esp + 0xa78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa60]
xor ecx, esp
call fcn.05070186
mov esp, ebp
pop ebp
ret 4