Function at 0x4bf700
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x1f0]
mov edi, dword [esi + 0xaa0]
and edi, dword [ebp + 0x18]
shl eax, 4
add eax, 0x3556
mov dword [ebp + 8], edi
add eax, edi
lea ecx, [esi + eax*2]
mov eax, dword [esi + 0x18]
lea eax, [esi + eax*4]
cmp ebx, 0xffffffff
jne 0x4bf863
mov ebx, dword [ebp + 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
inc dword [esi + 0x18]
mov edi, dword [ebx]
mov eax, edi
mov edx, dword [ebx + 0x18]
sub eax, edx
mov ecx, dword [ebx + 0x14]
mov dword [ebp + 8], edx
movzx edx, byte [eax + ecx - 1]
mov ecx, 8
sub cl, byte [esi + 0xaa4]
mov eax, dword [esi + 0xaa8]
and eax, dword [ebp + 0x18]
shr edx, cl
mov ecx, dword [esi + 0xaa4]
shl eax, cl
lea ecx, [esi + 0xaac]
add edx, eax
imul eax, edx, 0x600
mov edx, dword [ebx + 0x14]
add ecx, eax
mov eax, edi
sub eax, dword [ebx + 0x18]
cmp dword [esi + 0x1f0], 7
mov dword [ebp + 0x18], ecx
movzx edx, byte [eax + edx]
jge 0x4bf7ba
push edx
push 8
push ecx
push esi
call fcn.004c0840
add esp, 0x10
jmp 0x4bf818
sub edi, dword [esi + 0x1f4]
sub edi, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
mov ebx, 0x100
add edx, ebx
movzx edi, byte [edi + eax - 1]
mov eax, dword [esi + 0x18]
mov ecx, edx
shr ecx, 7
add edi, edi
and ecx, 1
mov dword [esi + eax*4 + 0x20], ecx
mov ecx, ebx
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, ebx
add eax, ecx
add edx, edx
mov ecx, dword [ebp + 0x18]
lea ecx, [ecx + eax*2]
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
mov eax, edi
inc dword [esi + 0x18]
xor eax, edx
not eax
and ebx, eax
cmp edx, 0x10000
jb 0x4bf7d2
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + 0x1f0]
cmp eax, 3
jg 0x4bf836
xor eax, eax
mov dword [esi + 0x1f0], eax
mov eax, dword [ebp + 0x14]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 9
jg 0x4bf84f
add eax, 0xfffffffd
mov dword [esi + 0x1f0], eax
mov eax, dword [ebp + 0x14]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
pop ebp
ret
add eax, 0xfffffffa
mov dword [esi + 0x1f0], eax
mov eax, dword [ebp + 0x14]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov dword [eax + 0x20], 1
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
inc dword [esi + 0x18]
mov edx, dword [esi + 0x1f0]
mov eax, dword [esi + 0x18]
add edx, 0x3616
lea ecx, [esi + eax*4]
lea edx, [esi + edx*2]
cmp ebx, 4
jae 0x4bfa3a
mov dword [ecx + 0x20], 1
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], edx
inc dword [esi + 0x18]
mov eax, dword [esi + 0x18]
lea edx, [esi + eax*4]
test ebx, ebx
jne 0x4bf908
mov eax, dword [esi + 0x1f0]
add eax, 0x3622
mov dword [edx + 0x20], ebx
mov ebx, dword [ebp + 0x14]
lea ecx, [esi + eax*2]
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
inc dword [esi + 0x18]
mov eax, dword [esi + 0x1f0]
mov edx, dword [esi + 0x18]
shl eax, 4
add eax, 0x3646
add eax, edi
lea ecx, [esi + eax*2]
xor eax, eax
cmp ebx, 1
setne al
mov dword [esi + edx*4 + 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
inc dword [esi + 0x18]
jmp 0x4bf9d2
mov eax, dword [esi + ebx*4 + 0x1f4]
mov dword [ebp + 0x18], eax
mov eax, dword [esi + 0x1f0]
add eax, 0x3622
mov dword [edx + 0x20], 1
lea ecx, [esi + eax*2]
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], ecx
inc dword [esi + 0x18]
mov edx, dword [esi + 0x1f0]
mov eax, dword [esi + 0x18]
add edx, 0x362e
lea ecx, [esi + eax*4]
lea edx, [esi + edx*2]
cmp ebx, 1
jne 0x4bf964
mov dword [ecx + 0x20], 0
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], edx
inc dword [esi + 0x18]
jmp 0x4bf9ba
mov dword [ecx + 0x20], 1
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], edx
inc dword [esi + 0x18]
mov eax, dword [esi + 0x1f0]
mov ecx, dword [esi + 0x18]
add eax, 0x363a
lea edx, [esi + eax*2]
lea eax, [ebx - 2]
mov dword [esi + ecx*4 + 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [esi + eax*4 + 0x108], edx
inc dword [esi + 0x18]
cmp ebx, 3
jne 0x4bf9ae
mov eax, dword [esi + 0x1fc]
mov dword [esi + 0x200], eax
mov eax, dword [esi + 0x1f8]
mov dword [esi + 0x1fc], eax
mov eax, dword [esi + 0x1f4]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 0x1f8], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x1f4], eax
cmp ebx, 1
jne 0x4bf9fb
xor eax, eax
cmp dword [esi + 0x1f0], 7
pop edi
setge al
lea eax, [eax*2 + 9]
mov dword [esi + 0x1f0], eax
mov eax, dword [ebp + 0xc]
pop esi
sub dword [eax + 0x18], ebx
pop ebx
pop ebp
ret
movzx eax, byte [esi + 0xa9c]
push eax
push ebx
push edi
lea eax, [esi + 0xb958]
push eax
push esi
call fcn.004bfa70
add esp, 0x14
mov eax, 0xb
cmp dword [esi + 0x1f0], 7
mov ecx, 8
cmovl eax, ecx
mov dword [esi + 0x1f0], eax
mov eax, dword [ebp + 0xc]
pop edi
pop esi
sub dword [eax + 0x18], ebx
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0x14]
mov dword [ecx + 0x20], 0
mov eax, dword [esi + 0x18]
push edi
mov dword [esi + eax*4 + 0x108], edx
lea eax, [ebx - 4]
inc dword [esi + 0x18]
push eax
push dword [ebp + 8]
push esi
call fcn.004c06f0
mov eax, dword [ebp + 0xc]
add esp, 0x10
sub dword [eax + 0x18], edi
pop edi
pop esi
pop ebx
pop ebp
ret