Function at 0x40c470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ecx, byte [edx]
test cl, cl
je 0x40c729
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ebp, ebp
je 0x40c4ac
cmp edx, ebp
jae 0x40c729
test edi, edi
je 0x40c729
movzx ebx, cl
test cl, cl
js 0x40c4e0
inc edx
lea ecx, [eax + 2]
mov word [eax], bx
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
movzx ecx, byte [edx]
test cl, cl
jne 0x40c4a0
jmp 0x40c729
mov ebp, ebx
and ebp, 0xffffffe0
cmp ebp, 0xc0
jne 0x40c4f8
cmp cl, 0xc2
jae 0x40c53b
mov ebp, dword [esp + 0x28]
jmp 0x40c4cc
mov esi, ebx
and esi, 0xfffffff0
cmp esi, 0xe0
jne 0x40c56c
movzx esi, byte [edx + 1]
mov dword [esp], esi
cmp cl, 0xed
mov ebp, dword [esp + 0x28]
je 0x40c5c1
cmp ebx, 0xe0
mov ecx, dword [esp]
jne 0x40c5cd
mov ecx, dword [esp]
add cl, 0x40
cmp cl, 0xe0
mov ecx, dword [esp]
jb 0x40c4cc
jmp 0x40c5cd
movzx ecx, byte [edx + 1]
movzx esi, cl
mov ebp, esi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x40c5b7
and ebx, 0x1f
shl ebx, 6
add edx, 2
and esi, 0x3f
or esi, ebx
lea ecx, [eax + 2]
mov word [eax], si
mov ebp, dword [esp + 0x28]
jmp 0x40c4c2
mov esi, ebx
and esi, 0xfffffff8
cmp esi, 0xf0
mov ebp, dword [esp + 0x28]
jne 0x40c704
cmp cl, 0xf4
ja 0x40c4cc
movzx ecx, byte [edx + 1]
mov dword [esp], ecx
je 0x40c621
cmp ebx, 0xf0
jne 0x40c62a
mov ecx, dword [esp]
add cl, 0x40
cmp cl, 0xd0
mov ecx, dword [esp]
jb 0x40c4cc
jmp 0x40c62a
inc edx
mov ebp, dword [esp + 0x28]
jmp 0x40c4cf
mov ecx, dword [esp]
cmp cl, 0x9f
ja 0x40c4cc
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40c70b
movzx ecx, byte [edx + 2]
movzx ebp, cl
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40c615
shl ebx, 0xc
mov ecx, dword [esp]
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
add edx, 3
and ebp, 0x3f
or ebp, ecx
lea ecx, [eax + 2]
mov word [eax], bp
mov ebp, dword [esp + 0x28]
jmp 0x40c4c2
add edx, 2
mov ebp, dword [esp + 0x28]
jmp 0x40c4cf
cmp cl, 0x8f
ja 0x40c4cc
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40c70b
movzx ebp, byte [edx + 2]
mov ecx, ebp
xor ecx, 0xffffff3f
mov esi, ebp
or esi, 0xc0
and esi, ecx
cmp esi, 0x80
jne 0x40c711
movzx ecx, byte [edx + 3]
movzx esi, cl
mov dword [esp + 4], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40c71d
and ebx, 7
shl ebx, 0x12
mov ecx, dword [esp]
and ecx, 0x3f
shl ecx, 0xc
or ecx, ebx
mov ebx, ebp
not ebx
or ebx, 0x3f
add ebx, ebp
shl ebx, 6
lea ebp, [ebx + ecx]
add ebp, 0x40
add edx, 4
mov esi, ebp
and esi, 0xfffff800
cmp esi, 0xd800
je 0x40c4f2
add ebx, ecx
mov ecx, dword [esp + 4]
and ecx, 0x3f
add ebx, ecx
add ebx, 0x40
cmp ebx, 0x10000
jb 0x40c4f2
mov ecx, ebp
cmp edi, 2
mov ebp, dword [esp + 0x28]
jb 0x40c704
add ecx, 0xf0000
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40c4c2
mov ecx, eax
jmp 0x40c4c2
inc edx
jmp 0x40c4cc
add edx, 2
mov ebp, dword [esp + 0x28]
jmp 0x40c4cc
add edx, 3
mov ebp, dword [esp + 0x28]
jmp 0x40c4cf
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret