Function at 0x10035870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [ebp - 0x18], eax
jle 0x10035aa4
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor edi, edi
cmp ecx, 2
jl 0x10035a9f
dec dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 0x14], edi
add edi, 2
cmp edi, ecx
jg 0x10035a9f
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
cmp esi, ecx
jae 0x10035a22
cmp esi, ecx
jae 0x10035a39
mov eax, dword [ebp + 8]
lea edx, [esi + 1]
mov dword [eax + 0xc], edx
movzx eax, byte [esi]
mov esi, edx
mov dword [ebp - 0x10], eax
cmp esi, ecx
jae 0x10035a45
cmp esi, ecx
jae 0x10035a5c
mov edx, dword [ebp + 8]
lea eax, [esi + 1]
mov dword [edx + 0xc], eax
movzx edx, byte [esi]
mov esi, eax
shl edx, 8
or edx, dword [ebp - 0x10]
lea eax, [edx - 0xd800]
cmp eax, 0x7ff
mov dword [ebp - 0x10], eax
ja 0x1003597d
mov edi, dword [ebp - 0x14]
xor edx, edx
add edi, 4
cmp edi, dword [ebp + 0xc]
jg 0x1003595b
cmp esi, ecx
jae 0x10035a63
cmp esi, ecx
mov dword [ebp - 0x14], edi
jae 0x10035a7a
mov edx, dword [ebp + 8]
lea eax, [esi + 1]
mov dword [edx + 0xc], eax
movzx edi, byte [esi]
mov esi, eax
cmp esi, ecx
jae 0x10035a81
cmp esi, ecx
jae 0x10035a98
mov ecx, dword [ebp + 8]
lea eax, [esi + 1]
mov dword [ecx + 0xc], eax
movzx edx, byte [esi]
shl edx, 8
or edx, edi
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add edx, 0xffff2400
mov eax, edx
or eax, ecx
cmp eax, 0x3ff
ja 0x10035a9f
shl ecx, 0xa
lea edx, [ecx + edx + 0x10000]
test edx, edx
je 0x10035a9f
cmp edx, 0x7f
ja 0x1003599b
mov ecx, dword [ebp + 0x10]
mov eax, ebx
sub eax, ecx
cmp eax, dword [ebp - 0x18]
jge 0x10035a12
mov byte [ebx], dl
inc ebx
jmp 0x10035a12
mov eax, edx
mov esi, ebx
mov cl, 0x23
or eax, 1
sub esi, dword [ebp + 0x10]
bsr eax, eax
xor eax, 0x1f
sub cl, al
movzx eax, cl
imul ecx, eax, 0xcd
shr ecx, 0xa
cmp esi, dword [ebp - 0x18]
lea eax, [ecx + ecx]
lea esi, [eax + eax*2]
jge 0x100359e8
lea eax, [eax + eax*2 - 6]
mov dword [ebp - 0x14], edi
mov edi, 0x100
shr edi, cl
mov dword [ebp - 0x10], eax
mov eax, edx
mov ecx, dword [ebp - 0x10]
neg edi
shr eax, cl
or eax, edi
mov edi, dword [ebp - 0x14]
mov byte [ebx], al
inc ebx
mov ecx, dword [ebp + 0x10]
cmp esi, 0xc
jb 0x10035a12
mov eax, ebx
sub eax, ecx
cmp eax, dword [ebp - 0x18]
jge 0x10035a0a
mov eax, edx
lea ecx, [esi - 0xc]
shr eax, cl
mov ecx, dword [ebp + 0x10]
and al, 0x3f
or al, 0x80
mov byte [ebx], al
inc ebx
add esi, 0xfffffffa
cmp esi, 0xb
jg 0x100359f0
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 1]
cmp eax, ecx
jl 0x1003589d
jmp 0x10035a9f
mov ecx, dword [ebp + 8]
mov esi, ecx
call fcn.10034c90
mov eax, esi
mov esi, dword [esi + 0xc]
mov ecx, dword [eax + 0x10]
jmp 0x100358bc
mov dword [ebp - 0x10], 0
jmp 0x100358d5
mov ecx, dword [ebp + 8]
mov esi, ecx
call fcn.10034c90
mov eax, esi
mov esi, dword [esi + 0xc]
mov ecx, dword [eax + 0x10]
jmp 0x100358dd
xor edx, edx
jmp 0x100358f6
mov ecx, dword [ebp + 8]
mov esi, ecx
call fcn.10034c90
mov eax, esi
mov esi, dword [esi + 0xc]
mov ecx, dword [eax + 0x10]
jmp 0x1003591e
xor edi, edi
jmp 0x10035937
mov ecx, dword [ebp + 8]
mov esi, ecx
call fcn.10034c90
mov eax, esi
mov esi, dword [esi + 0xc]
mov ecx, dword [eax + 0x10]
jmp 0x1003593f
xor edx, edx
jmp 0x10035956
mov byte [ebx], 0
jmp 0x10035aa9
mov edi, 0xffffffea
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret