Function at 0x406df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov edi, edx
mov eax, dword [0x8e4a3c]
xor eax, esp
mov dword [esp + 0x4c], eax
mov ebx, dword [ecx + 0x10]
mov eax, dword [ebx + 0x28]
mov word [esp + 0x44], ax
movzx esi, word [ebx + 0x2c]
mov word [esp + 0x46], si
mov edx, dword [ebx + 0x30]
add eax, edx
dec eax
mov word [esp + 0x48], ax
mov dword [esp + 8], ebx
add si, word [ebx + 0x34]
dec esi
mov word [esp + 0x4a], si
lea esi, [esp + 0x44]
push esi
mov dword [esp + 0x28], ecx
push ecx
call fcn.00401ab0
add esp, 8
lea eax, [esp + 0x3c]
mov dword [esp + 4], edi
push dword [edi + 8]
push esi
push eax
call fcn.004ad190
add esp, 0xc
test al, al
je 0x40719d
mov byte [esp + 2], 1
mov eax, dword [esp + 8]
cmp byte [eax + 0xd], 0
je 0x406e7b
cmp dword [esp + 0x68], 0
jg 0x406e93
jmp 0x40719d
mov eax, dword [esp + 8]
cmp byte [eax + 0xe], 0
sete byte [esp + 2]
cmp dword [esp + 0x68], 0
jle 0x40719d
mov eax, dword [esp + 0x24]
movsx edi, word [eax + 0x16]
mov ebp, dword [esp + 8]
mov ebx, dword [ebp + 0x34]
add ebx, edi
mov ecx, dword [ebp + 0x2c]
mov eax, ebx
sub eax, dword [ebp + 0x38]
mov edx, dword [esp + 4]
mov edx, dword [edx + 4]
movzx esi, word [edx + 4]
sub si, word [edx]
mov edx, dword [esp + 0x64]
add eax, ecx
mov dword [esp + 0x28], eax
inc esi
movsx eax, si
mov dword [esp + 0x14], eax
add ebx, ecx
movsx ecx, word [edx]
sub ebx, ecx
add edi, dword [ebp + 0x28]
mov edx, edi
movzx eax, byte [esp + 2]
xor al, 1
mov byte [esp + 3], al
lea eax, [esp + 0x6c]
movzx eax, word [eax]
movzx ecx, byte [esp + 0x70]
add ecx, 4
shr ecx, 3
mov dword [esp + 0x34], ecx
mov ecx, eax
shl ecx, 0x10
mov dword [esp + 0x1c], eax
or ecx, eax
and ecx, 0x7e0f81f
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
xor eax, eax
jmp 0x406f33
mov eax, dword [esp + 0x2c]
inc eax
mov ebx, dword [esp + 0xc]
cmp eax, dword [esp + 0x68]
je 0x40719d
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x24]
mov edi, eax
movsx eax, word [ecx + 0x14]
mov esi, dword [esp + 8]
mov edx, dword [esi + 0x28]
add edx, edi
movsx ebp, word [ecx + 0x16]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x2c], edi
movsx ecx, word [ecx + edi*2]
sub ebp, ecx
add ebp, dword [esi + 0x2c]
add edx, eax
add ebp, dword [esi + 0x34]
mov esi, ebx
mov dword [esp + 0xc], ebp
sub esi, ebp
setl byte [esp + 0x18]
mov ebp, esi
neg ebp
cmovs ebp, esi
cmp ebp, 2
jb 0x407080
cmp byte [esp + 2], 0
je 0x4070da
movzx ecx, byte [esp + 0x18]
xor eax, eax
mov al, cl
add eax, eax
dec eax
mov ecx, ebp
shr ecx, 1
sub ebp, ecx
add ebx, eax
mov esi, dword [esp + 0x20]
mov dword [esp + 0x18], ebp
jmp 0x406fb6
add ebx, eax
test ecx, ecx
je 0x40702a
dec ecx
movsx edi, word [esp + 0x3c]
cmp esi, edi
jl 0x406fb0
movsx edi, word [esp + 0x40]
cmp esi, edi
jg 0x406fb0
movsx edi, word [esp + 0x3e]
cmp ebx, edi
jl 0x406fb0
movsx edi, word [esp + 0x42]
cmp ebx, edi
jg 0x406fb0
mov esi, dword [esp + 4]
mov edi, dword [esi + 4]
movsx esi, word [edi]
mov ebp, dword [esp + 0x20]
sub ebp, esi
movsx esi, word [edi + 2]
mov edi, ebx
sub edi, esi
imul edi, dword [esp + 0x14]
add edi, ebp
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov word [ebp + edi*2], si
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
jmp 0x406fb0
add ebx, eax
test ebp, ebp
je 0x4070da
dec ebp
movsx ecx, word [esp + 0x3c]
cmp edx, ecx
jl 0x407020
movsx ecx, word [esp + 0x40]
cmp edx, ecx
jg 0x407020
movsx ecx, word [esp + 0x3e]
cmp ebx, ecx
jl 0x407020
movsx ecx, word [esp + 0x42]
cmp ebx, ecx
jg 0x407020
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 4]
movsx esi, word [ecx]
mov edi, edx
sub edi, esi
movsx ecx, word [ecx + 2]
mov esi, ebx
sub esi, ecx
imul esi, dword [esp + 0x14]
add esi, edi
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov word [edi + esi*2], cx
jmp 0x407020
movsx eax, word [esp + 0x3c]
cmp edx, eax
setl al
or al, byte [esp + 3]
jne 0x4070da
movsx eax, word [esp + 0x40]
cmp edx, eax
jg 0x4070da
movsx eax, word [esp + 0x3e]
cmp dword [esp + 0xc], eax
jl 0x4070da
movsx eax, word [esp + 0x42]
cmp dword [esp + 0xc], eax
jg 0x4070da
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
movsx ecx, word [eax]
mov esi, edx
sub esi, ecx
movsx eax, word [eax + 2]
mov ecx, dword [esp + 0xc]
sub ecx, eax
imul ecx, dword [esp + 0x14]
add ecx, esi
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
mov word [esi + ecx*2], ax
mov eax, dword [esp + 8]
cmp byte [eax + 0xe], 0
je 0x406f20
xor eax, eax
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0xc]
sub esi, ebx
setge al
mov ecx, esi
neg ecx
cmovs ecx, esi
lea esi, [eax + eax]
dec esi
inc ecx
mov dword [esp + 0x38], edx
jmp 0x407119
add ebx, esi
dec ecx
je 0x406f20
movsx eax, word [esp + 0x3c]
cmp edx, eax
jl 0x407110
movsx eax, word [esp + 0x40]
cmp edx, eax
jg 0x407110
movsx eax, word [esp + 0x3e]
cmp ebx, eax
jl 0x407110
movsx eax, word [esp + 0x42]
cmp ebx, eax
jg 0x407110
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
movsx edi, word [eax]
mov ebp, edx
sub ebp, edi
movsx edi, word [eax + 2]
mov eax, ebx
sub eax, edi
imul eax, dword [esp + 0x14]
add eax, ebp
mov edx, esi
mov esi, dword [esp + 0x10]
movzx edi, word [esi + eax*2]
mov ebp, edi
shl ebp, 0x10
or ebp, edi
and ebp, 0x7e0f81f
mov edi, dword [esp + 0x30]
sub edi, ebp
imul edi, dword [esp + 0x34]
shr edi, 5
add edi, ebp
and edi, 0x7e0f81f
mov ebp, edi
shr ebp, 0x10
or ebp, edi
mov word [esi + eax*2], bp
mov esi, edx
mov edx, dword [esp + 0x38]
jmp 0x407110
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.004c0e60
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret