Function at 0x41bb30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x548f00
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push ebx
push esi
push edi
mov eax, dword [0x57a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
lea eax, [edi + 0x138]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 0x12c]
cmp esi, dword [edi + 0x130]
je 0x41bf8b
push esi
lea ecx, [ebp - 0x98]
call fcn.00419150
mov dword [ebp - 4], 0
cmp dword [ebp - 0x94], 1
jne 0x41bf75
cmp dword [ebp - 0x30], 1
jne 0x41bf75
mov ecx, 0x1e
call fcn.004bd1b0
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
js 0x41bf75
mov edx, dword [ebp - 0x90]
mov ecx, ebx
call fcn.004bb250
mov eax, dword [ebx*4 + 0x20a514c]
or ecx, 0xffffffff
mov edi, dword [ebp - 0x68]
xor edx, edx
movd xmm0, dword [ebp - 0x70]
cvtdq2ps xmm0, xmm0
mov word [eax + 0x224], cx
mov eax, dword [ebx*4 + 0x20a514c]
mov ecx, dword [ebp - 0x6c]
mov word [eax + 0x144], cx
mov eax, dword [ebx*4 + 0x20a514c]
mov word [eax + 0x146], di
mov eax, dword [ebx*4 + 0x20a514c]
mov byte [eax + 0x149], 0x1e
mov ecx, dword [ebx*4 + 0x20a514c]
movzx eax, word [ecx + 0x144]
mov word [ecx + 0x166], ax
mov ecx, dword [ebx*4 + 0x20a514c]
movzx eax, word [ecx + 0x146]
mov word [ecx + 0x168], ax
mov ecx, dword [ebx*4 + 0x20a514c]
movzx eax, word [ecx + 0x144]
mov word [ecx + 0x162], ax
mov ecx, dword [ebx*4 + 0x20a514c]
movzx eax, word [ecx + 0x146]
mov word [ecx + 0x164], ax
mov ecx, dword [ebx*4 + 0x20a514c]
movzx eax, byte [ebp - 0x5c]
mov byte [ecx + 0x148], al
mov ecx, dword [ebx*4 + 0x20a514c]
movzx eax, byte [ecx + 0x144]
mov byte [ecx + 0x160], al
mov ecx, dword [ebx*4 + 0x20a514c]
movzx eax, byte [ecx + 0x146]
mov byte [ecx + 0x161], al
mov eax, dword [ebx*4 + 0x20a514c]
mov byte [eax + 0x216], 0
mov eax, dword [ebx*4 + 0x20a514c]
mov dword [eax + 0x220], 0
mov eax, dword [ebx*4 + 0x20a514c]
movss dword [eax + 0xfc], xmm0
movd xmm0, dword [ebp - 0x74]
mov eax, dword [ebx*4 + 0x20a514c]
cvtdq2ps xmm0, xmm0
movss dword [eax + 0x100], xmm0
mov eax, dword [ebx*4 + 0x20a514c]
mov byte [eax + 0xdc0], 1
mov eax, dword [ebp - 0x7c]
test eax, eax
cmovns edx, eax
mov eax, 3
cmp edx, 3
cmovg edx, eax
mov eax, dword [ebp - 0x78]
xor ecx, ecx
test eax, eax
cmovns ecx, eax
mov eax, 3
cmp ecx, 3
cmovg ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x10], ecx
sub eax, 0x115
je 0x41bd78
sub eax, 6
jne 0x41bda6
mov eax, dword [ebx*4 + 0x20a514c]
mov ecx, dword [edx*4 + 0x5d8f74]
mov dword [eax + 0x300], ecx
mov eax, dword [ebx*4 + 0x20a514c]
mov dword [eax + 0x304], ecx
mov eax, dword [ebx*4 + 0x20a514c]
mov ecx, dword [ebp - 0x10]
mov byte [eax + 0xdc8], dl
mov eax, dword [ebx*4 + 0x20a514c]
mov byte [eax + 0xdc9], cl
jmp 0x41bda6
mov eax, dword [ebx*4 + 0x20a514c]
mov ecx, dword [edx*4 + 0x5d8f64]
mov dword [eax + 0x300], ecx
mov eax, dword [ebx*4 + 0x20a514c]
mov dword [eax + 0x304], ecx
mov eax, dword [ebx*4 + 0x20a514c]
mov byte [eax + 0xdc8], dl
call fcn.00526930
cdq
mov ecx, 0xff
idiv ecx
inc dl
mov byte [esi + 0x70], dl
mov eax, dword [ebx*4 + 0x20a514c]
mov byte [eax + 0xdbc], dl
call fcn.00526930
and eax, 0x800000ff
jns 0x41bdd8
dec eax
or eax, 0xffffff00
inc eax
mov byte [esi + 0x71], al
mov ecx, dword [ebx*4 + 0x20a514c]
mov byte [ecx + 0xdbd], al
call fcn.00526930
and eax, 0x800000ff
jns 0x41bdfb
dec eax
or eax, 0xffffff00
inc eax
mov byte [esi + 0x72], al
mov ecx, dword [ebx*4 + 0x20a514c]
mov byte [ecx + 0xdbe], al
call fcn.00526930
and eax, 0x800000ff
jns 0x41be1e
dec eax
or eax, 0xffffff00
inc eax
cmp dword [ebp - 0x90], 0x115
mov byte [esi + 0x73], al
mov ecx, dword [ebx*4 + 0x20a514c]
mov byte [ecx + 0xdbf], al
jne 0x41bf68
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
js 0x41beb9
xor eax, eax
cmp ecx, 0xff
setle al
test eax, eax
je 0x41beb9
test edi, edi
js 0x41beb9
xor eax, eax
cmp edi, 0xff
setle al
test eax, eax
je 0x41beb9
lea eax, [ecx + 3]
lea edi, [ecx - 2]
mov dword [ebp - 0x10], eax
cmp edi, eax
jg 0x41beb6
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x10]
lea ebx, [eax + 2]
nop dword [eax]
cmp eax, ebx
jg 0x41beae
mov ecx, eax
mov edx, ebx
shl ecx, 8
sub edx, eax
add ecx, edi
inc edx
mov eax, dword [0xfbe010]
lea ecx, [ecx + 0x100]
and byte [ecx + eax - 0x100], 0xef
sub edx, 1
jne 0x41be90
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x10]
inc edi
cmp edi, ecx
jle 0x41be80
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x68]
push 0
push 0
push 0
push 0
push 0
push 0xd
push 0
push dword [ebx*4 + 0x20a514c]
call fcn.00477200
mov eax, dword [ebx*4 + 0x20a514c]
mov ecx, dword [ebp - 0x34]
mov byte [eax + 0xdc1], 1
cmp ecx, 0xffffffff
je 0x41bf24
test ecx, ecx
js 0x41bf24
xor eax, eax
cmp ecx, 0x1194
setl al
test eax, eax
je 0x41bf24
mov eax, dword [ecx*4 + 0x20a514c]
cmp dword [eax + 4], 3
jne 0x41bf24
mov edx, 0xdb
cmp word [eax + 0xcc], dx
jne 0x41bf24
push ebx
push ecx
call fcn.0041d9c0
test eax, eax
jne 0x41bf68
jmp 0x41bf53
mov ecx, dword [ebp - 0x6c]
lea eax, [edi + 4]
push eax
push ecx
call fcn.0041d830
test eax, eax
js 0x41bf4c
cmp eax, 0x1194
jge 0x41bf4c
push ebx
push eax
mov dword [esi + 0x64], eax
call fcn.0041d9c0
test eax, eax
jne 0x41bf68
jmp 0x41bf53
mov dword [esi + 0x64], 0xffffffff
push dword [ebp - 0x8c]
push str._CastleSiege__CCastleSiege::CreateDbNPC___ERROR___Failed_to_Create_Gate_Lever_:_GateIndex:_d
push 1
call fcn.005262e0
add esp, 0xc
mov edi, dword [ebp - 0x18]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x68], 2
add esi, 0x74
mov dword [ebp - 4], 0xffffffff
cmp esi, dword [edi + 0x130]
jne 0x41bb82
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret