Function at 0x565418
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0x14
mov eax, 0x5a06e1
call fcn.00580367
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0xc]
cmp byte [edi + 2], 0xf
lea eax, [esi + 0x20]
je 0x565442
push 0x5a8fc4
push 0x20
push eax
call fcn.0057eed3
jmp 0x565456
push 0x5a8f5c
push 0x20
push eax
call fcn.0057eed3
mov dword [esi + 0x1c], 1
fld dword [0x5a8634]
add esp, 0xc
fstp dword [esi + 0x36c]
mov dword [esi + 0x18], 9
test byte [edi + 6], 2
mov ebx, str.DDR3L
je 0x565492
fld dword [0x5a8628]
push ebx
lea eax, [esi + 0x20]
fstp dword [esi + 0x36c]
push 0x20
push eax
call fcn.0057eed3
add esp, 0xc
test byte [edi + 6], 4
je 0x5654b3
fld dword [0x5a8614]
push ebx
lea eax, [esi + 0x20]
fstp dword [esi + 0x36c]
push 0x20
push eax
call fcn.0057eed3
add esp, 0xc
movzx eax, byte [edi + 3]
and eax, 0xf
dec eax
je 0x565595
dec eax
je 0x565576
dec eax
je 0x565551
dec eax
je 0x56552c
dec eax
je 0x565504
dec eax
jne 0x5655c1
push str.Mini_UDIMM
lea eax, [esi + 0x2e8]
push 0x20
push eax
call fcn.0043a290
fld dword [0x5c9010]
mov dword [esi + 0x308], 0x20006
jmp 0x5655b8
push str.Mini_RDIMM
lea eax, [esi + 0x2e8]
push 0x20
push eax
call fcn.0043a290
fld dword [0x5c9010]
mov dword [esi + 0x308], 0x20005
jmp 0x5655b8
push 0x5c91fc
lea eax, [esi + 0x2e8]
push 0x20
push eax
call fcn.0043a290
fld dword [0x5c91f8]
mov dword [esi + 0x308], 0x20004
jmp 0x5655b8
push str.SO_DIMM
lea eax, [esi + 0x2e8]
push 0x20
push eax
call fcn.0043a290
fld dword [0x5c91f4]
mov dword [esi + 0x308], 0x20003
jmp 0x5655b8
push str.UDIMM
lea eax, [esi + 0x2e8]
push 0x20
push eax
call fcn.0043a290
mov dword [esi + 0x308], 0x20002
jmp 0x5655b2
push str.RDIMM
lea eax, [esi + 0x2e8]
push 0x20
push eax
call fcn.0043a290
mov dword [esi + 0x308], 0x20001
fld dword [0x5c91a8]
fstp dword [esi + 0x30c]
add esp, 0xc
movzx eax, byte [edi + 4]
push 7
shr eax, 4
pop ebx
and eax, ebx
xor edx, edx
sub eax, edx
je 0x565600
dec eax
je 0x5655f4
dec eax
je 0x5655e8
dec eax
jne 0x56560a
mov dword [esi + 0x320], 0x40
jmp 0x56560a
mov dword [esi + 0x320], 0x20
jmp 0x56560a
mov dword [esi + 0x320], 0x10
jmp 0x56560a
mov dword [esi + 0x320], 8
movzx eax, byte [edi + 4]
or dword [ebp + 8], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
and eax, 0xf
cmp eax, 9
ja case.default.0x565622
jmp dword [eax*4 + 0x565eb0]
mov dword [ebp + 8], 0x100
jmp case.default.0x565622
mov dword [ebp + 8], 0x200
jmp case.default.0x565622
mov dword [ebp + 8], 0x400
jmp case.default.0x565622
mov dword [ebp + 8], 0x800
jmp case.default.0x565622
mov dword [ebp + 8], 0x1000
jmp case.default.0x565622
mov dword [ebp + 8], 0x2000
jmp case.default.0x565622
mov dword [ebp + 8], 0x4000
jmp case.default.0x565622
mov dword [ebp + 8], 0x8000
jmp case.default.0x565622
mov dword [ebp + 8], 0x10000
jmp case.default.0x565622
mov dword [ebp + 8], 0x20000
movzx eax, byte [edi + 7]
mov ecx, eax
and ecx, ebx
sub ecx, edx
je 0x5656b1
dec ecx
je 0x5656a8
dec ecx
je 0x56569f
dec ecx
jne 0x5656b8
mov dword [ebp - 0x14], 0x20
jmp 0x5656b8
mov dword [ebp - 0x14], 0x10
jmp 0x5656b8
mov dword [ebp - 0x14], 8
jmp 0x5656b8
mov dword [ebp - 0x14], 4
shr eax, 3
and eax, ebx
sub eax, edx
je 0x5656fd
dec eax
je 0x5656f1
dec eax
je 0x5656e5
dec eax
je 0x5656d9
dec eax
jne 0x565707
mov dword [esi + 0x324], 8
jmp 0x565707
mov dword [esi + 0x324], 4
jmp 0x565707
mov dword [esi + 0x324], 3
jmp 0x565707
mov dword [esi + 0x324], 2
jmp 0x565707
mov dword [esi + 0x324], 1
movzx eax, byte [edi + 8]
and eax, ebx
sub eax, edx
je 0x565735
dec eax
je 0x56572c
dec eax
je 0x565723
dec eax
jne 0x56573c
mov dword [ebp - 0x10], 0x40
jmp 0x56573c
mov dword [ebp - 0x10], 0x20
jmp 0x56573c
mov dword [ebp - 0x10], 0x10
jmp 0x56573c
mov dword [ebp - 0x10], 8
push dword [ebp + 8]
call fcn.004059c0
pop ecx
test eax, eax
je 0x565795
push dword [ebp - 0x10]
call fcn.004059c0
pop ecx
test eax, eax
je 0x565795
push dword [ebp - 0x14]
call fcn.004059c0
pop ecx
test eax, eax
je 0x565795
mov ebx, dword [esi + 0x324]
push ebx
call fcn.004059c0
pop ecx
test eax, eax
je 0x565795
mov eax, dword [ebp - 0x10]
cdq
idiv dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 8]
cdq
and edx, 7
add eax, edx
sar eax, 3
imul ecx, eax
imul ecx, ebx
mov dword [esi + 0x2e0], ecx
mov al, byte [edi + 0xb]
test al, al
jbe 0x5657b3
movzx ecx, byte [edi + 0xa]
mov dword [ebp + 8], ecx
movzx eax, al
fild dword [ebp + 8]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fdivp st(1)
jmp 0x5657b9
fld dword [0x5c9008]
movzx eax, byte [edi + 0xc]
fstp dword [ebp - 0x14]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fmul dword [ebp - 0x14]
fst dword [ebp + 8]
fld dword [ebp + 8]
fdivr qword [0x5e29c0]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fld qword [0x5e2968]
fadd st(1), st(0)
fxch st(1)
call fcn.0057fee0
fld dword [ebp + 8]
fadd st(0), st(0)
mov dword [esi + 0x334], eax
fmul qword [0x5e2a00]
fdiv qword [0x5e29d8]
fadd st(1)
call fcn.0057fee0
fld qword [0x5afa40]
fdivrp st(2)
mov ebx, eax
imul ebx, ebx, 0x64
faddp st(1)
mov dword [esi + 0x330], ebx
call fcn.0057fee0
push ebx
push str.PC3__d
mov dword [esi + 0x338], eax
lea eax, [esi + 0x40]
push 0x20
push eax
call fcn.0043a290
add esp, 0x10
test byte [edi + 0xe], 1
push 0xc
pop ebx
je 0x56587b
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
test eax, eax
je 0x565860
mov ecx, eax
call fcn.00558927
jmp 0x565862
xor eax, eax
fld dword [0x5a85a4]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xe], 2
je 0x5658ba
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x56589f
mov ecx, eax
call fcn.00558927
jmp 0x5658a1
xor eax, eax
fld dword [0x5a85d8]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xe], 4
je 0x5658f9
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x5658de
mov ecx, eax
call fcn.00558927
jmp 0x5658e0
xor eax, eax
fld dword [0x5a85d0]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xe], 8
je 0x565938
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x56591d
mov ecx, eax
call fcn.00558927
jmp 0x56591f
xor eax, eax
fld dword [0x5a85c8]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xe], 0x10
je 0x565977
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x56595c
mov ecx, eax
call fcn.00558927
jmp 0x56595e
xor eax, eax
fld dword [0x5a48a4]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xe], 0x20
je 0x5659b6
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x56599b
mov ecx, eax
call fcn.00558927
jmp 0x56599d
xor eax, eax
fld dword [0x5a85bc]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xe], 0x40
je 0x5659f5
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 6
test eax, eax
je 0x5659da
mov ecx, eax
call fcn.00558927
jmp 0x5659dc
xor eax, eax
fld dword [0x5a85b4]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xe], 0x80
je 0x565a34
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 7
test eax, eax
je 0x565a19
mov ecx, eax
call fcn.00558927
jmp 0x565a1b
xor eax, eax
fld dword [0x5a85e8]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xf], 1
je 0x565a73
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 8
test eax, eax
je 0x565a58
mov ecx, eax
call fcn.00558927
jmp 0x565a5a
xor eax, eax
fld dword [0x5a85e0]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xf], 2
je 0x565ab2
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 9
test eax, eax
je 0x565a97
mov ecx, eax
call fcn.00558927
jmp 0x565a99
xor eax, eax
fld dword [0x5a859c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xf], 4
je 0x565af1
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xa
test eax, eax
je 0x565ad6
mov ecx, eax
call fcn.00558927
jmp 0x565ad8
xor eax, eax
fld dword [0x5a8594]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xf], 8
je 0x565b30
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xb
test eax, eax
je 0x565b15
mov ecx, eax
call fcn.00558927
jmp 0x565b17
xor eax, eax
fld dword [0x5a858c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xf], 0x10
je 0x565b6b
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x565b50
mov ecx, eax
call fcn.00558927
jmp 0x565b52
xor eax, eax
fld dword [0x5a8584]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xf], 0x20
je 0x565baa
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xd
test eax, eax
je 0x565b8f
mov ecx, eax
call fcn.00558927
jmp 0x565b91
xor eax, eax
fld dword [0x5a857c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
test byte [edi + 0xf], 0x40
je 0x565be9
push ebx
call fcn.0056cb85
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xe
test eax, eax
je 0x565bce
mov ecx, eax
call fcn.00558927
jmp 0x565bd0
xor eax, eax
fld dword [0x5a8578]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x33c]
push eax
call fcn.0055f860
movzx eax, byte [edi + 0x10]
mov ecx, dword [esi + 0x334]
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fmul dword [ebp - 0x14]
fstp dword [ebp - 0x18]
cmp ecx, 0x190
je 0x565c79
cmp ecx, 0x215
je 0x565c63
cmp ecx, 0x29b
je 0x565c41
cmp ecx, 0x320
jne 0x565c9d
cmp eax, 0x50
je 0x565c72
cmp eax, 0x5a
je 0x565c3a
cmp eax, 0x64
je 0x565c55
cmp eax, 0x6e
jne 0x565c9d
push 0x5bbdac
jmp 0x565c8f
push 0x5c8ff0
jmp 0x565c8f
cmp eax, 0x54
je 0x565c5c
cmp eax, 0x60
je 0x565c72
cmp eax, 0x6c
je 0x565c3a
cmp eax, 0x78
jne 0x565c9d
push 0x5c8fec
jmp 0x565c8f
push 0x5c8fe8
jmp 0x565c8f
cmp eax, 0x5a
je 0x565c83
cmp eax, 0x69
je 0x565c5c
cmp eax, 0x78
jne 0x565c9d
push 0x5c8fe4
jmp 0x565c8f
cmp eax, 0x64
je 0x565c8a
cmp eax, 0x78
jne 0x565c9d
push str.EGFJH
jmp 0x565c8f
push 0x5a4b1c
lea eax, [esi + 0x40]
push 0x20
push eax
call fcn.0043a370
add esp, 0xc
mov eax, dword [esi + 0x33c]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
call fcn.00558fcf
jmp 0x565cf8
fldz
fcomp dword [ecx + 4]
fnstsw ax
test ah, 5
jp 0x565cf0
fld dword [ebp - 0x18]
fdiv dword [ecx + 4]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fdivr qword [0x5e29c0]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fstp dword [ecx + 8]
fld dword [ebp - 0x10]
fld dword [ebp + 8]
fcompp
fnstsw ax
test ah, 5
jp 0x565cf0
fld dword [ebp + 8]
fstp dword [ecx + 8]
lea ecx, [ebp - 0x20]
call fcn.00558fe6
mov ecx, eax
test ecx, ecx
jne 0x565cb4
movzx eax, byte [edi + 0x12]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld dword [ebp - 0x14]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esi + 0x340]
movzx eax, byte [edi + 0x13]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x344]
movzx eax, byte [edi + 0x14]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x348]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x16]
and eax, 0xf
shl eax, 8
add eax, ecx
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x34c]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x17]
shr eax, 4
shl eax, 8
add eax, ecx
mov dword [ebp + 8], eax
fimul dword [ebp + 8]
fstp dword [esi + 0x350]
movzx eax, byte [edi + 0x3c]
and eax, 0x1f
mov dword [esi + 0x310], eax
movzx ebx, byte [edi + 0x75]
and ebx, 0x7f
cmp ebx, 0xf
jle 0x565d97
push 0xf
pop ebx
xor eax, eax
test ebx, ebx
jle 0x565dae
push ebx
lea eax, [esi + 0x60]
push 0x7f
push eax
call fcn.0057f470
add esp, 0xc
mov eax, ebx
mov cl, byte [edi + 0x76]
mov byte [eax + esi + 0x60], cl
lea eax, [esi + 0xa0]
push eax
lea eax, [esi + 0x60]
push eax
call fcn.0055d096
mov cl, byte [edi + 0x78]
mov al, cl
shr al, 4
mov dl, 0xa
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x368], al
mov cl, byte [edi + 0x79]
mov al, cl
shr al, 4
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x369], al
movzx eax, byte [edi + 0x7a]
movzx ecx, byte [edi + 0x7b]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7c]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7d]
shl eax, 8
add eax, ecx
push eax
push 0x5bec28
mov dword [esi + 0x2e4], eax
lea eax, [esi + 0x2c0]
push 0x20
push eax
call fcn.0043a290
add esp, 0x18
lea ecx, [esi + 0x2a0]
lea eax, [edi + 0x80]
mov dword [ebp + 8], 0x12
mov dl, byte [eax]
cmp dl, 0xff
sete bl
dec bl
and bl, dl
inc eax
mov byte [ecx], bl
inc ecx
dec dword [ebp + 8]
jne 0x565e40
mov byte [esi + 0x2b2], 0
movzx ebx, byte [edi + 0x94]
and ebx, 0x7f
cmp ebx, 0xf
jle 0x565e6e
push 0xf
pop ebx
xor eax, eax
test ebx, ebx
jle 0x565e88
push ebx
lea eax, [esi + 0x80]
push 0x7f
push eax
call fcn.0057f470
add esp, 0xc
mov eax, ebx
mov cl, byte [edi + 0x95]
mov byte [eax + esi + 0x80], cl
lea eax, [esi + 0x1a0]
push eax
sub esi, 0xffffff80
push esi
call fcn.0055d096
pop ecx
pop ecx
call fcn.0058043f
ret 4