Function at 0x1002b820
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
call fcn.100361e0
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx + 4]
shr eax, 1
lea ecx, [eax*8 + 0x50]
push 0x300d
push ecx
call fcn.100292b0
xor esi, esi
add esp, 8
cmp eax, esi
mov dword [0x2f444d4], eax
jne 0x1002b85a
call fcn.1003cab0
mov edx, dword [ebx + 4]
shr edx, 1
lea eax, [edx*8 + 0x50]
push 0x300e
push eax
call fcn.100292b0
add esp, 8
cmp eax, esi
mov dword [0x2f444d0], eax
jne 0x1002b882
call fcn.1003cab0
mov eax, dword [0x2f444d4]
movsx ebp, word [esp + 0x50]
mov word [eax], 0x7fff
mov word [eax + 2], 0x7fff
mov ecx, dword [ebx + 4]
mov dword [0x2f444dc], esi
mov dword [0x2f444e0], esi
lea esi, [ebp + 1]
imul ecx, esi
push 0x3010
push ecx
call fcn.100292b0
mov ecx, dword [ebx + 4]
imul ecx, esi
mov edx, ecx
mov edi, eax
shr ecx, 2
xor eax, eax
mov dword [esp + 0x24], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
push 0x3011
push esi
rep stosb byte es:[edi], al
call fcn.100292b0
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov edi, eax
xor eax, eax
mov dword [esp + 0x28], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [ebx + 8]
add esp, 0x10
cmp dword [ebx], 0
mov dword [esp + 0x14], 0
jle 0x1002be6f
mov eax, ebp
neg eax
mov dword [esp + 0x24], eax
lea eax, [ebp*4]
sub eax, ebp
neg eax
add eax, eax
add eax, eax
add eax, eax
mov dword [esp + 0x20], eax
lea ebx, [ebx]
push esi
call fcn.1003c590
add esp, 4
cmp byte [esi + 0x10], 1
jne 0x1002b948
push esi
call fcn.1003c520
add esp, 4
cmp dword [esi + 0xc], 0
mov ebx, dword [0x2f444d4]
jne 0x1002bc05
mov edx, dword [0x2f444dc]
mov edi, edi
mov edi, dword [esi + 4]
movsx ebp, word [ebx + edx*8 + 2]
lea eax, [ebx + edx*8 + 2]
mov ecx, edi
sub ecx, dword [esi + 8]
cmp ebp, ecx
jge 0x1002b994
mov ecx, edi
sub ecx, dword [esi + 8]
lea ebx, [ebx]
movsx ebp, word [eax + 8]
add eax, 8
add edx, 1
cmp ebp, ecx
jl 0x1002b980
mov dword [0x2f444dc], edx
movsx eax, word [ebx + edx*8]
cmp eax, edi
jle 0x1002ba4f
mov eax, dword [0x2f44364]
test eax, eax
je 0x1002b9bc
mov ecx, dword [0x2f44360]
sub eax, 1
mov dword [0x2f44364], eax
mov eax, dword [ecx + eax*4]
jmp 0x1002b9ee
lea edx, [esp + 0x28]
push edx
push 0x14
push 0x2f44358
push 0x2f44354
push 0x2f44350
call fcn.10029ed0
mov eax, dword [0x2f44354]
mov ebx, dword [0x2f444d4]
mov edx, dword [0x2f444dc]
add esp, 0x14
add eax, 0xffffffff
mov ecx, dword [0x2f44350]
mov dword [esp + 0x10], eax
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
movzx ecx, word [esi + 4]
sub cx, word [esi + 8]
mov word [eax], cx
movzx ecx, word [esi + 4]
mov word [eax + 4], cx
mov ecx, dword [esp + 0x14]
mov word [eax + 2], cx
mov word [eax + 6], cx
mov cl, byte [esi + 8]
mov byte [eax + 0xc], cl
cmp dword [esi + 8], 0xff
jbe 0x1002ba30
mov byte [eax + 0xc], 0xff
movzx ecx, word [esi + 8]
mov word [eax + 0xa], cx
movzx ecx, word [eax]
mov word [eax + 8], cx
mov byte [eax + 0xd], 0
mov dword [eax + 0x10], 0
jmp 0x1002bb45
mov eax, dword [ebx + edx*8 + 4]
mov ecx, dword [0x2f44350]
mov dword [esp + 0x10], eax
lea eax, [eax + eax*4]
lea ebp, [ecx + eax*4]
mov eax, dword [esi + 4]
movsx ecx, word [ebp]
sub eax, dword [esi + 8]
cmp ecx, eax
jle 0x1002ba7d
mov ax, word [esi + 4]
sub ax, word [esi + 8]
mov word [ebp], ax
movsx ecx, word [ebp + 4]
cmp ecx, dword [esi + 4]
jge 0x1002ba8e
mov ax, word [esi + 4]
mov word [ebp + 4], ax
movzx ecx, byte [ebp + 0xc]
cmp ecx, dword [esi + 8]
jge 0x1002baaa
mov al, byte [esi + 8]
mov byte [ebp + 0xc], al
cmp dword [esi + 8], 0xff
jbe 0x1002baaa
mov byte [ebp + 0xc], 0xff
movsx ecx, word [ebp + 6]
mov eax, dword [esp + 0x14]
cmp ecx, eax
jne 0x1002baba
or byte [ebp + 0xd], 2
mov word [ebp + 6], ax
mov ax, word [ebp + 0xa]
mov ecx, 0xffff
sub ecx, dword [esi + 8]
movzx edi, ax
cmp edi, ecx
jbe 0x1002bad9
mov word [ebp + 0xa], 0xffff
jmp 0x1002bae4
mov cx, word [esi + 8]
add cx, ax
mov word [ebp + 0xa], cx
movsx ecx, word [ebx + edx*8 + 2]
mov eax, dword [esi + 4]
cmp ecx, eax
jg 0x1002bb45
movsx ecx, word [ebx + edx*8 + 8]
add edx, 1
cmp ecx, eax
mov dword [0x2f444dc], edx
jg 0x1002bb3c
mov eax, dword [ebx + edx*8 + 4]
mov edi, dword [esp + 0x10]
cmp eax, edi
jne 0x1002bb14
or byte [ebp + 0xd], 4
jmp 0x1002bb29
push eax
call fcn.1002b320
mov ebx, dword [0x2f444d4]
mov edx, dword [0x2f444dc]
add esp, 4
movsx eax, word [ebx + edx*8 + 8]
add edx, 1
cmp eax, dword [esi + 4]
mov dword [0x2f444dc], edx
jle 0x1002bb02
sub edx, 1
mov dword [0x2f444dc], edx
movzx edi, word [esi + 4]
sub di, word [esi + 8]
mov eax, dword [0x2f444e0]
mov ecx, dword [0x2f444d0]
mov word [ecx + eax*8], di
movzx edi, word [esi + 4]
mov word [ecx + eax*8 + 2], di
mov edi, dword [esp + 0x10]
mov dword [ecx + eax*8 + 4], edi
mov ebp, 1
add dword [esi + 0x14], ebp
add eax, ebp
mov dword [0x2f444e0], eax
mov eax, dword [esi + 0x14]
movzx ecx, byte [eax]
mov edi, 0xff
cmp ecx, edi
mov dword [esi + 8], ecx
jne 0x1002bbb5
mov dword [esi + 8], 0
cmp byte [eax], 0xff
jne 0x1002bbaf
lea ebx, [ebx]
add dword [esi + 8], edi
add eax, ebp
mov ecx, eax
mov dword [esi + 0x14], eax
cmp byte [ecx], 0xff
je 0x1002bba0
movzx ecx, byte [eax]
add dword [esi + 8], ecx
mov ecx, dword [esi + 8]
add dword [esi + 4], ecx
test ecx, ecx
je 0x1002bbc5
add eax, 1
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
movzx ecx, byte [eax]
cmp ecx, edi
mov dword [esi + 8], ecx
jne 0x1002bbf7
mov dword [esi + 8], 0
cmp byte [eax], 0xff
jne 0x1002bbee
mov edi, edi
add dword [esi + 8], edi
add dword [esi + 0x14], ebp
mov eax, dword [esi + 0x14]
cmp byte [eax], 0xff
je 0x1002bbe0
mov ecx, dword [esi + 0x14]
movzx eax, byte [ecx]
add dword [esi + 8], eax
mov ecx, dword [esi + 8]
add dword [esi + 4], ecx
test ecx, ecx
jne 0x1002b960
mov edi, dword [esp + 0x14]
test edi, edi
jle 0x1002bd24
xor edx, edx
cmp word [ebx], 0x7fff
mov dword [0x2f444dc], edx
je 0x1002bd24
jmp 0x1002bc30
mov eax, dword [ebx + edx*8 + 4]
mov ecx, dword [0x2f44350]
mov dword [esp + 0x10], eax
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
mov ax, word [ecx]
cmp ax, 0x8001
je 0x1002bd0f
movsx ebp, word [ecx + 6]
cmp ebp, edi
jge 0x1002bd0f
movsx edx, ax
movsx eax, word [ecx + 4]
sub eax, edx
movsx edx, word [esp + 0x4c]
cmp eax, edx
jg 0x1002bcd6
movsx edi, word [ecx + 2]
movsx eax, word [esp + 0x50]
mov edx, ebp
sub edx, edi
add edx, 1
cmp edx, eax
jg 0x1002bcd6
cmp edi, ebp
jg 0x1002bcd6
movsx ebp, word [esp + 0x50]
mov eax, edi
cdq
idiv ebp
mov eax, dword [esp + 0x18]
mov byte [edx + eax], 1
movsx eax, word [ecx]
movsx ebx, word [ecx + 4]
cmp eax, ebx
jg 0x1002bccb
mov ebx, dword [esp + 0x1c]
jmp 0x1002bcb0
mov ebp, dword [esp + 0x40]
mov ebp, dword [ebp + 4]
imul ebp, edx
add ebp, eax
mov byte [ebx + ebp], 1
movsx ebp, word [ecx + 4]
add eax, 1
cmp eax, ebp
jle 0x1002bcb0
movsx edx, word [ecx + 6]
add edi, 1
cmp edi, edx
jle 0x1002bc87
lea eax, [esp + 0x10]
push eax
push 4
push 0x2f44368
push 0x2f44364
push 0x2f44360
mov word [ecx], 0x8001
mov word [ecx + 2], 0x8001
call fcn.10029ed0
mov ebx, dword [0x2f444d4]
mov edx, dword [0x2f444dc]
mov edi, dword [esp + 0x28]
add esp, 0x14
add edx, 1
cmp word [ebx + edx*8], 0x7fff
mov dword [0x2f444dc], edx
jne 0x1002bc30
movsx ecx, word [esp + 0x50]
cmp edi, ecx
jle 0x1002be19
mov eax, dword [esp + 0x24]
cdq
idiv ecx
mov ecx, dword [esp + 0x18]
mov ebp, edx
cmp byte [ecx + ebp], 0
je 0x1002be19
mov edx, dword [esp + 0x40]
mov edi, dword [edx + 8]
add edi, dword [esp + 0x20]
push edi
call fcn.1003c590
add esp, 4
cmp byte [edi + 0x10], 1
je 0x1002bd70
push 1
push 0
call fcn.10036360
add esp, 8
mov edi, edi
mov al, byte [edi + 0x10]
cmp al, 1
je 0x1002bdb2
movsx ecx, word [esp + 0x4c]
mov edx, dword [edi + 8]
cmp edx, ecx
ja 0x1002bdb2
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 4]
mov ecx, dword [edi + 4]
imul eax, ebp
mov ebx, ecx
sub ebx, edx
mov edx, dword [esp + 0x1c]
add ebx, eax
cmp byte [ebx + edx], 0
je 0x1002bdad
add eax, ecx
cmp byte [eax + edx], 0
je 0x1002bdad
push 1
push ecx
jmp 0x1002bdba
push 2
push ecx
jmp 0x1002bdba
mov edx, dword [edi + 4]
movzx ecx, al
push ecx
push edx
call fcn.10036360
add esp, 8
push edi
call fcn.1003c520
add esp, 4
cmp dword [edi + 0xc], 0
je 0x1002bd70
mov eax, dword [edi]
push eax
call fcn.10029420
mov ebx, dword [esp + 0x44]
mov ecx, dword [ebx + 4]
push ecx
call fcn.10036390
mov dword [edi], eax
mov ecx, dword [ebx + 4]
mov edi, ecx
mov ebx, dword [0x2f444d4]
imul edi, ebp
add edi, dword [esp + 0x24]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 8
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov byte [eax + ebp], 0
mov ecx, dword [0x2f444d0]
mov eax, dword [0x2f444e0]
add dword [esp + 0x20], 0x18
add dword [esp + 0x24], 1
mov word [ecx + eax*8], 0x7fff
mov word [ecx + eax*8 + 2], 0x7fff
mov eax, ebx
mov dword [0x2f444d4], ecx
mov ecx, dword [esp + 0x40]
add edi, 1
mov dword [0x2f444d8], eax
mov dword [0x2f444d0], eax
xor eax, eax
add esi, 0x18
cmp edi, dword [ecx]
mov dword [0x2f444dc], eax
mov dword [0x2f444e0], eax
mov dword [esp + 0x14], edi
jl 0x1002b930
call fcn.10036200
xor esi, esi
cmp dword [0x2f444e4], esi
jne 0x1002be88
call fcn.1002b4a0
call fcn.1002b500
mov dword [0x2f444e4], esi
call fcn.1002b690
cmp dword [esp + 0x44], esi
je 0x1002be9e
call fcn.1002b720
mov edx, dword [0x2f444d4]
push edx
call fcn.10029420
mov eax, dword [0x2f444d0]
push eax
call fcn.10029420
mov ecx, dword [esp + 0x20]
push ecx
call fcn.10029420
mov edx, dword [esp + 0x28]
push edx
call fcn.10029420
add esp, 0x10
pop edi
mov dword [0x2f444e4], esi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret