Function at 0x476538
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 0x24]
sub esp, 0xc
mov eax, 0xff
push ebx
push ebp
push esi
push edi
cmp dword [esp + 0x44], eax
jne 0x476667
mov dword [esp + 0x44], edx
test edx, edx
je 0x476783
mov ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x28]
imul edi, dword [esp + 0x2c], 3
neg esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
add ecx, dword [esp + 0x24]
mov dword [esp + 0x14], edi
lea ebp, [ecx + eax*4]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ebp
mov dword [esp + 0x38], eax
mov ebx, dword [ecx + 0xcc]
imul ebx, eax
mov dword [esp + 0x24], ebp
add ebx, dword [ecx + 0xc8]
add ebx, edi
cmp dword [esp + 0x3c], 0
jle 0x47663b
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
movzx edi, byte [ebp + 3]
mov esi, 0xff
movzx eax, byte [ebp + 2]
sub esi, edi
movzx ecx, byte [ebx + 2]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx]
mov byte [ebx + 1], al
movzx eax, byte [ebp]
lea ebp, [ebp + 4]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
dec dword [esp + 0x2c]
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x4765bd
mov ebp, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
dec edx
inc eax
cmp dword [ecx + 0xe8], 0
mov dword [esp + 0x44], edx
mov dword [esp + 0x38], eax
jne 0x476652
add ebp, esi
jmp 0x476656
add ebp, dword [esp + 0x28]
mov dword [esp + 0x40], ebp
test edx, edx
jne 0x476595
jmp 0x476783
mov dword [esp + 0x10], edx
test edx, edx
je 0x476783
mov ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x28]
imul edi, dword [esp + 0x2c], 3
neg esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], esi
add ecx, dword [esp + 0x24]
mov dword [esp + 0x18], edi
lea ebp, [ecx + eax*4]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ebp
mov dword [esp + 0x38], eax
mov ebx, dword [ecx + 0xcc]
imul ebx, eax
mov dword [esp + 0x24], ebp
add ebx, dword [ecx + 0xc8]
add ebx, edi
cmp dword [esp + 0x3c], 0
jle 0x47675c
mov eax, dword [esp + 0x3c]
mov ecx, 0xff
mov dword [esp + 0x2c], eax
movzx eax, byte [ebp + 3]
mov edi, ecx
imul eax, dword [esp + 0x44]
cdq
idiv ecx
movzx ecx, byte [ebx + 2]
mov esi, eax
movzx eax, byte [ebp + 2]
imul eax, esi
sub edi, esi
imul ecx, edi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, esi
imul ecx, edi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx]
mov byte [ebx + 1], al
movzx eax, byte [ebp]
lea ebp, [ebp + 4]
imul eax, esi
imul ecx, edi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
dec dword [esp + 0x2c]
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x4766d7
mov ebp, dword [esp + 0x40]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
dec edx
inc eax
cmp dword [ecx + 0xe8], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x38], eax
jne 0x476773
add ebp, esi
jmp 0x476777
add ebp, dword [esp + 0x28]
mov dword [esp + 0x40], ebp
test edx, edx
jne 0x4766aa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x28