Function at 0x4bb315
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ecx + 4]
movzx ebp, byte [esi + 0x22]
mov edx, eax
push edi
mov edi, dword [esi + 0x24]
shr edx, 8
shr eax, 0xb
add edi, 8
and edx, 7
and eax, 0x1f
cmp ebx, 3
jne 0x4bb34f
lea ebx, [esp + 0x14]
push ebx
push edi
push edx
push eax
push ebp
call fcn.00491b10
jmp 0x4bb368
cmp ebx, 2
jne 0x4bb368
mov ebx, dword [ecx]
lea ebp, [esp + 0x14]
push ebp
push edi
push edx
push eax
movzx eax, byte [esi + 0x22]
push eax
mov eax, dword [ebx + 0x18]
call eax
movzx edx, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0x20]
mov ebx, dword [esi + 0x24]
shl ecx, 0x1c
or edx, ecx
mov ecx, dword [esi + 0x1c]
mov ebp, dword [ecx + 4]
mov edi, eax
shr edi, 8
shr eax, 0xb
or edx, 0x8000000
add ebx, 8
and edi, 7
and eax, 0x1f
cmp ebp, 3
jne 0x4bb3ae
push edx
push ebx
push edi
push eax
movzx eax, byte [esi + 0x22]
push eax
call fcn.00499550
jmp 0x4bb3c3
cmp ebp, 2
jne 0x4bb3c3
mov ebp, dword [ecx]
push edx
mov edx, dword [ebp + 0x1c]
push ebx
push edi
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
mov edi, dword [esi + 0x24]
mov ebp, dword [ebx + 4]
and eax, 7
or eax, 0xffffffa0
shl eax, 8
or eax, dword [esp + 0x24]
mov edx, ecx
shr edx, 8
shr ecx, 0xb
shl eax, 0x10
add edi, 4
and edx, 7
and ecx, 0x1f
cmp ebp, 3
jne 0x4bb40b
push eax
movzx eax, byte [esi + 0x22]
push edi
push edx
push ecx
push eax
mov ecx, ebx
call fcn.00499550
jmp 0x4bb422
cmp ebp, 2
jne 0x4bb422
mov ebp, dword [ebx]
push eax
movzx eax, byte [esi + 0x22]
push edi
push edx
push ecx
push eax
mov eax, dword [ebp + 0x1c]
mov ecx, ebx
call eax
mov dword [esp + 0x1c], 0x186a0
lea ebx, [ebx]
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edi, dword [ecx + 4]
mov ebx, dword [esi + 0x24]
movzx ebp, byte [esi + 0x22]
mov edx, eax
shr edx, 8
shr eax, 0xb
and edx, 7
and eax, 0x1f
cmp edi, 3
jne 0x4bb463
lea edi, [esp + 0x10]
push edi
push ebx
push edx
push eax
push ebp
call fcn.00491b10
jmp 0x4bb47c
cmp edi, 2
jne 0x4bb47c
mov edi, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push ebx
push edx
mov edx, dword [edi + 0x18]
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esp + 0x10]
test eax, 0x10000000
jne 0x4bb48e
test eax, 0xa0000000
jne 0x4bb499
sub dword [esp + 0x1c], 1
jns 0x4bb430
mov eax, dword [esp + 0x10]
mov ecx, eax
and ecx, 0xa0000000
cmp ecx, 0x80000000
je 0x4bb62f
mov dword [esp + 0x1c], 0x3e8
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edi, dword [esi + 0x24]
mov ebx, dword [ecx + 4]
movzx ebp, byte [esi + 0x22]
mov edx, eax
shr edx, 8
shr eax, 0xb
add edi, 8
and edx, 7
and eax, 0x1f
cmp ebx, 3
jne 0x4bb4eb
lea ebx, [esp + 0x14]
push ebx
push edi
push edx
push eax
push ebp
call fcn.00491b10
jmp 0x4bb504
cmp ebx, 2
jne 0x4bb504
mov ebx, dword [ecx]
lea ebp, [esp + 0x14]
push ebp
push edi
push edx
mov edx, dword [ebx + 0x18]
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 0x24]
mov edx, eax
shr eax, 0xb
and eax, 0x1f
shr edx, 8
mov ebp, eax
mov eax, dword [ecx + 4]
xor edi, 0x8000000
add ebx, 8
and edx, 7
cmp eax, 3
jne 0x4bb542
movzx eax, byte [esi + 0x22]
push edi
push ebx
push edx
push ebp
push eax
call fcn.00499550
jmp 0x4bb557
cmp eax, 2
jne 0x4bb557
movzx eax, byte [esi + 0x22]
push edi
push ebx
push edx
push ebp
push eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ecx + 4]
mov edi, dword [esi + 0x24]
movzx ebp, byte [esi + 0x22]
mov edx, eax
shr edx, 8
shr eax, 0xb
and edx, 7
and eax, 0x1f
cmp ebx, 3
jne 0x4bb58a
lea ebx, [esp + 0x10]
push ebx
push edi
push edx
push eax
push ebp
call fcn.00491b10
jmp 0x4bb5a3
cmp ebx, 2
jne 0x4bb5a3
mov ebx, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push edi
push edx
mov edx, dword [ebx + 0x18]
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esp + 0x10]
and eax, 0xb0000000
cmp eax, 0x10000000
je 0x4bb5be
sub dword [esp + 0x1c], 1
jns 0x4bb4b5
mov dword [esp + 0x1c], 0x3e8
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edi, dword [ecx + 4]
mov ebx, dword [esi + 0x24]
movzx ebp, byte [esi + 0x22]
mov edx, eax
shr edx, 8
shr eax, 0xb
and edx, 7
and eax, 0x1f
cmp edi, 3
jne 0x4bb5f9
lea edi, [esp + 0x10]
push edi
push ebx
push edx
push eax
push ebp
call fcn.00491b10
jmp 0x4bb612
cmp edi, 2
jne 0x4bb612
mov edi, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push ebx
push edx
mov edx, dword [edi + 0x18]
push eax
movzx eax, byte [esi + 0x22]
push eax
call edx
mov eax, dword [esp + 0x10]
test eax, 0x10000000
jne 0x4bb624
test eax, 0xa0000000
jne 0x4bb62b
sub dword [esp + 0x1c], 1
jns 0x4bb5c6
mov eax, dword [esp + 0x10]
pop edi
mov ecx, eax
pop esi
and ecx, 0xa0000000
pop ebp
pop ebx
cmp ecx, 0x80000000
jne 0x4bb65d
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov byte [edx], al
shr eax, 8
mov byte [ecx], al
mov eax, 1
add esp, 8
ret 0x14
xor eax, eax
add esp, 8
ret 0x14