Function at 0x4091ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov word [ebp - 2], 0xa
mov eax, dword [ebp + 0x18]
sub eax, 2
je 0x40901f
sub eax, 4
je 0x40902a
sub eax, 2
je 0x409035
jmp 0x40904b
mov edx, dword [ebp + 8]
fld dword [edx]
fstp xword [ebp - 0xc]
wait
jmp 0x40904b
mov ecx, dword [ebp + 8]
fld qword [ecx]
fstp xword [ebp - 0xc]
wait
jmp 0x40904b
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 4]
mov dword [ebp - 8], edx
mov dx, word [eax + 8]
mov word [ebp - 4], dx
lea eax, [ebp - 0xc]
lea edx, [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov bx, word [eax + 8]
mov edx, ebx
and dx, 0x7fff
mov word [eax + 8], dx
test bh, 0x80
setne al
and eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00407cf0
and ax, 0x4700
pop ecx
cmp ax, 0x4000
jne 0x4090b9
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jg 0x40908f
neg ebx
inc ebx
cmp ebx, 0x28
jle 0x409099
mov ebx, 0x28
push ebx
push 0x30
mov eax, dword [ebp + 0x14]
push eax
call fcn.00405bec
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov byte [edx + ebx], 0
mov eax, 1
jmp 0x4092c7
cmp ax, 0x500
jne 0x4090c9
mov eax, 0x7fff
jmp 0x4092c7
cmp ax, 0x100
jne 0x4090d9
mov eax, 0x7ffe
jmp 0x4092c7
movzx eax, bx
and eax, 0x7fff
mov ecx, dword [ebp - 0x10]
add eax, 0xffffc001
imul edx, eax, 0x4d10
mov eax, edx
xor edx, edx
mov dl, byte [ecx + 7]
add edx, edx
and edx, 0xff
mov ecx, edx
lea edx, [ecx + edx*8]
lea edx, [ecx + edx*2]
lea edx, [ecx + edx*4]
movsx edx, dx
and edx, 0xffff
add eax, edx
mov ecx, eax
sar ecx, 0x10
test eax, 0xffff
mov dword [ebp - 0x14], ecx
je 0x409126
inc dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
test edi, edi
jg 0x40913b
mov edi, dword [ebp - 0x14]
sub edi, dword [ebp + 0xc]
test edi, edi
jl 0x409085
cmp edi, 0x13
jle 0x409145
mov edi, 0x13
mov esi, edi
sub esi, dword [ebp - 0x14]
test esi, esi
je 0x409196
mov ebx, esi
test esi, esi
jge 0x409158
mov ebx, esi
neg ebx
cmp ebx, 0x1344
jle 0x409165
mov ebx, 0x1344
push ebx
call fcn.00407a10
pop ecx
fstp xword [ebp - 0x20]
wait
test esi, esi
jge 0x409184
fld xword [ebp - 0x20]
fld xword [ebp - 0xc]
fdivrp st(1)
fstp xword [ebp - 0xc]
wait
add esi, ebx
jmp 0x409192
fld xword [ebp - 0x20]
fld xword [ebp - 0xc]
fmulp st(1)
fstp xword [ebp - 0xc]
wait
sub esi, ebx
test esi, esi
jne 0x40914e
push edi
call fcn.00407a10
pop ecx
fstp xword [ebp - 0x20]
wait
fld xword [ebp - 0xc]
fld xword [ebp - 0x20]
fcompp
fnstsw ax
sahf
jae 0x4091d3
inc dword [ebp - 0x14]
inc edi
cmp edi, 0x13
jg 0x40920c
cmp dword [ebp + 0xc], 0
jle 0x40920c
movsx edx, word [ebp - 2]
mov dword [ebp - 0x28], edx
fild dword [ebp - 0x28]
fld xword [ebp - 0xc]
fdivrp st(1)
fstp xword [ebp - 0xc]
wait
dec edi
jmp 0x40920c
lea ecx, [edi - 1]
push ecx
call fcn.00407a10
pop ecx
fstp xword [ebp - 0x20]
wait
fld xword [ebp - 0xc]
fld xword [ebp - 0x20]
fcompp
fnstsw ax
sahf
jbe 0x40920c
dec dword [ebp - 0x14]
dec edi
cmp dword [ebp + 0xc], 0
jle 0x40920c
movsx edx, word [ebp - 2]
mov dword [ebp - 0x28], edx
fild dword [ebp - 0x28]
fld xword [ebp - 0xc]
fmulp st(1)
fstp xword [ebp - 0xc]
wait
inc edi
test edi, edi
jl 0x409085
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.00407ccc
mov edx, dword [ebp + 0x14]
add esp, 8
add edx, edi
xor esi, esi
mov ebx, edx
mov dword [ebp - 0x24], edx
mov byte [ebx], 0
dec ebx
test edi, edi
jne 0x409251
mov eax, dword [ebp - 0x10]
movzx esi, byte [eax]
and esi, 0xff
xor esi, 1
test esi, esi
jne 0x409085
jmp 0x40926b
lea eax, [ebp - 0xc]
push eax
call fcn.00407f20
pop ecx
movsx edx, al
or esi, edx
add eax, 0x30
mov byte [ebx], al
dec ebx
dec edi
je 0x40926b
jmp 0x409251
test esi, esi
jne 0x409285
inc dword [ebp - 0x14]
cmp dword [ebp + 0xc], 0
jg 0x40927e
mov edx, dword [ebp - 0x24]
mov byte [edx], 0x30
inc dword [ebp - 0x24]
mov byte [ebx + 1], 0x31
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jg 0x409292
mov ebx, dword [ebp - 0x14]
sub ebx, dword [ebp + 0xc]
cmp ebx, 0x28
jle 0x40929c
mov ebx, 0x28
mov eax, dword [ebp - 0x24]
mov byte [eax], 0
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp + 0x14]
sub ebx, edx
test ebx, ebx
jle 0x4092c4
push ebx
push 0x30
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00405bec
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov byte [eax + ebx], 0
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret