Function at 0x476660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x476977
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
xor edx, edx
xor ebx, ebx
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x4766a8
dec ecx
mov dword [esp + 0x38], ecx
neg ecx
sar ecx, 0x1f
and ecx, 1
add ecx, esi
mov esi, dword [esp + 0x38]
mov esi, eax
mov eax, ecx
mov ecx, dword [esp + 0x38]
test ecx, ecx
jle 0x476930
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], eax
xchg edi, eax
mov byte [esp + 0x22], al
xchg edi, eax
movzx eax, byte [eax]
mov byte [esp + 0x23], al
cmp al, 0x20
jbe 0x4768ca
cmp al, 0x22
je 0x47676e
cmp al, 0x5c
jne 0x4766ed
lea eax, [esi + 1]
mov esi, dword [esp + 0x34]
cmp ecx, 1
jae 0x47668d
jmp 0x476970
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
call fcn.004765c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea ebx, [ecx + 1]
cmp ebx, edx
jg 0x476737
movzx ebp, byte [esp + 0x23]
xchg ebp, ebx
mov byte [eax + ecx], bl
xchg ebp, ebx
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov ebp, ebx
movzx edi, byte [esp + 0x22]
mov ebx, edx
mov edx, eax
xor eax, eax
jmp 0x4766e3
mov dword [esp + 0x28], ecx
lea ebp, [0x5b38a0]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
call fcn.00437cd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebx, [ecx + 1]
mov ecx, dword [esp + 0x28]
jmp 0x476714
mov dword [esp + 0x24], esi
mov eax, esi
sar esi, 0x1f
shr esi, 0x1f
lea ecx, [eax + esi]
sar ecx, 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], ecx
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call fcn.004765c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
shl ebx, 1
mov ebp, dword [esp + 0x24]
cmp ebp, ebx
jne 0x476870
movzx ebx, byte [esp + 0x22]
test bl, bl
je 0x476866
mov ebp, dword [esp + 0x38]
cmp ebp, 1
jle 0x476860
mov esi, dword [esp + 0x34]
movzx edi, byte [esi + 1]
xchg edi, eax
cmp al, 0x22
xchg edi, eax
jne 0x476856
lea edi, [ecx + 1]
cmp edi, edx
jg 0x476816
movzx ebx, byte [esp + 0x23]
mov byte [eax + ecx], bl
lea ecx, [esi + 1]
lea ebx, [ebp - 1]
movzx ebp, byte [esp + 0x22]
xor ebp, 1
mov esi, ecx
mov ecx, ebx
mov ebx, edx
mov edx, eax
xor eax, eax
mov eax, ebp
mov ebp, edi
mov edi, eax
xor eax, eax
jmp 0x4766e3
lea ebx, [0x5b38a0]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edi
call fcn.00437cd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea edi, [ecx + 1]
mov ecx, dword [esp + 0x28]
movzx ebx, byte [esp + 0x22]
mov ebp, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
jmp 0x4767e9
mov ecx, esi
mov ebx, ebp
mov edi, dword [esp + 0x28]
jmp 0x4767f7
mov esi, dword [esp + 0x34]
jmp 0x476856
mov ebp, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
jmp 0x476856
lea ebx, [ecx + 1]
cmp ebx, edx
jg 0x476897
movzx esi, byte [esp + 0x23]
xchg esi, ebx
mov byte [eax + ecx], bl
xchg esi, ebx
mov ecx, dword [esp + 0x34]
mov edi, ebx
movzx ebp, byte [esp + 0x22]
mov ebx, dword [esp + 0x38]
jmp 0x4767ff
lea ebp, [0x5b38a0]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
call fcn.00437cd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebx, [ecx + 1]
mov ecx, dword [esp + 0x28]
jmp 0x476877
cmp al, 9
jne 0x476926
xchg edi, eax
test al, al
xchg edi, eax
jne 0x4766ed
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
call fcn.004765c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x38]
dec eax
mov ecx, eax
neg eax
sar eax, 0x1f
and eax, 1
mov edx, dword [esp + 0x34]
add eax, edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x30
ret
cmp al, 0x20
je 0x4768cf
jmp 0x4766ed
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
call fcn.004765c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add esp, 0x30
ret
call fcn.00425a00
ud2
call fcn.00449da0
jmp fcn.00476660