RC4 is a stream cipher. This means you have a stream of key bytes and a stream of plaintext bytes. You pair these up and XOR each pair together to get a stream

RC4 is a stream cipher. This means you have a stream of key bytes and a stream of plaintext bytes. You pair these up and XOR each pair together to get a stream of ciphertext bytes. The key stream is generated independently of the plaintext, so the attacker really only cares that the bytes he's interested in (i.e. session cookies) stay at the same offset in the stream.