Function at 0x406a8f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
sub eax, dword [ecx + 0x74]
mov ecx, dword [ebp + 8]
sub eax, dword [ecx + 0x6c]
mov dword [ebp - 0xc], eax
xor eax, eax
test eax, eax
je 0x406ae6
cmp dword [ebp - 0xc], 0
jne 0x406ad9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6c], 0
jne 0x406ad9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x74], 0
jne 0x406ad9
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x406ae6
cmp dword [ebp - 0xc], 0xffffffff
jne 0x406ae6
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x106]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x6c], eax
jb 0x406bf0
push dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x38]
add eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x38]
call fcn.0040d520
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x70]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x70], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6c]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x5c]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x5c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov ecx, dword [ebp - 0x14]
lea eax, [eax + ecx*2]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
dec eax
dec eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 4]
cmp eax, ecx
sbb eax, eax
not eax
and eax, edx
mov ecx, dword [ebp - 8]
mov word [ecx], ax
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x406b62
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40]
mov ecx, dword [ebp - 0x14]
lea eax, [eax + ecx*2]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
dec eax
dec eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 4]
cmp eax, ecx
sbb eax, eax
not eax
and eax, edx
mov ecx, dword [ebp - 8]
mov word [ecx], ax
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x406baf
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax + 4], 0
jne 0x406c00
jmp 0x406c9c
push dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x6c]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x74]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00406c9e
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x74]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x74], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x74], 3
jb 0x406c81
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x6c]
movzx eax, byte [eax + ecx]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x48], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x48]
mov ecx, dword [ecx + 0x58]
shl eax, cl
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x6c]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x38]
movzx ecx, byte [edx + ecx + 1]
xor eax, ecx
mov ecx, dword [ebp + 8]
and eax, dword [ecx + 0x54]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x48], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x74], 0x106
jae 0x406c9c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax + 4], 0
jne 0x406a9e
leave
ret