Function at 0x41f770
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4af9d5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4efd34]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov edi, dword [esi + 8]
push str.DDR3
lea eax, [esi + 0x18]
push 0x20
push eax
call fcn.004979df
fld dword [0x4c33bc]
fstp dword [esi + 0x200]
mov dword [esi + 0x14], 9
movzx eax, byte [edi + 3]
and eax, 0xf
add eax, 0xffffffff
add esp, 0xc
cmp eax, 5
ja case.default.0x41f7d5
jmp dword [eax*4 + 0x4201ac]
push 0x4c3424
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.004374b0
fld dword [0x4c3420]
mov dword [esi + 0x1a8], 0x20001
jmp 0x41f8b8
push str.UDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.004374b0
fld dword [0x4c3420]
mov dword [esi + 0x1a8], 0x20002
jmp 0x41f8b8
push 0x4c3410
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.004374b0
fld dword [0x4c340c]
mov dword [esi + 0x1a8], 0x20003
jmp 0x41f8b8
push 0x4c3400
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.004374b0
fld dword [0x4c33fc]
mov dword [esi + 0x1a8], 0x20004
jmp 0x41f8b8
push str.Mini_RDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.004374b0
mov dword [esi + 0x1a8], 0x20005
jmp 0x41f8b2
push 0x4c33e4
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.004374b0
mov dword [esi + 0x1a8], 0x20006
fld dword [0x4c33e0]
fstp dword [esi + 0x1ac]
add esp, 0xc
movzx eax, byte [edi + 4]
shr eax, 4
and eax, 7
cmp eax, 3
ja case.default.0x41f8d0
jmp dword [eax*4 + 0x4201c4]
mov dword [esi + 0x1c0], 8
jmp case.default.0x41f8d0
mov dword [esi + 0x1c0], 0x10
jmp case.default.0x41f8d0
mov dword [esi + 0x1c0], 0x20
jmp case.default.0x41f8d0
mov dword [esi + 0x1c0], 0x40
movzx eax, byte [edi + 4]
or ebx, 0xffffffff
and eax, 0xf
cmp eax, 9
mov ebp, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
ja case.default.0x41f91e
jmp dword [eax*4 + 0x4201d4]
mov ebp, 0x100
jmp case.default.0x41f91e
mov ebp, 0x200
jmp case.default.0x41f91e
mov ebp, 0x400
jmp case.default.0x41f91e
mov ebp, 0x800
jmp case.default.0x41f91e
mov ebp, 0x1000
jmp case.default.0x41f91e
mov ebp, 0x2000
jmp case.default.0x41f91e
mov ebp, 0x4000
jmp case.default.0x41f91e
mov ebp, 0x8000
jmp case.default.0x41f91e
mov ebp, 0x10000
jmp case.default.0x41f91e
mov ebp, 0x20000
movzx eax, byte [edi + 7]
mov ecx, eax
and ecx, 7
cmp ecx, 3
mov edx, 4
ja case.default.0x41f97c
jmp dword [ecx*4 + 0x4201fc]
mov dword [esp + 0x28], edx
jmp case.default.0x41f97c
mov dword [esp + 0x28], 8
jmp case.default.0x41f97c
mov dword [esp + 0x28], 0x10
jmp case.default.0x41f97c
mov dword [esp + 0x28], 0x20
shr eax, 3
and eax, 7
cmp eax, 3
ja case.default.0x41f9b0
jmp dword [eax*4 + 0x42020c]
mov dword [esp + 0x14], 1
jmp case.default.0x41f9b0
mov dword [esp + 0x14], 2
jmp case.default.0x41f9b0
mov dword [esp + 0x14], 3
jmp case.default.0x41f9b0
mov dword [esp + 0x14], edx
movzx eax, byte [edi + 8]
and eax, 7
cmp eax, 3
ja case.default.0x41f9e5
jmp dword [eax*4 + 0x42021c]
mov ebx, 8
jmp case.default.0x41f9e5
mov ebx, 0x10
jmp case.default.0x41f9e5
mov ebx, 0x20
jmp case.default.0x41f9e5
mov ebx, 0x40
push ebp
call fcn.00407ba0
add esp, 4
test eax, eax
je 0x41fa64
push ebx
call fcn.00407ba0
add esp, 4
test eax, eax
je 0x41fa64
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00407ba0
add esp, 4
test eax, eax
je 0x41fa64
mov edx, dword [esp + 0x14]
push edx
call fcn.00407ba0
add esp, 4
test eax, eax
je 0x41fa64
mov eax, ebx
cdq
idiv dword [esp + 0x28]
mov ecx, eax
mov eax, ebp
cdq
and edx, 7
add eax, edx
sar eax, 3
imul ecx, eax
imul ecx, dword [esp + 0x14]
mov dword [esi + 0x180], ecx
movzx edx, byte [edi + 0xa]
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x28], edx
movzx ecx, byte [edi + 0xc]
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x28]
fdivp st(1)
fstp dword [esp + 0x28]
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fst dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr qword [0x4b73b0]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fld st(0)
fld qword [0x4c3378]
fadd st(1), st(0)
fxch st(1)
call fcn.00497ad0
fxch st(1)
fadd st(0), st(0)
mov dword [esi + 0x1cc], eax
fmul qword [0x4c3340]
fdiv qword [0x4b7368]
fadd st(1)
call fcn.00497ad0
fld qword [0x4c33d8]
fdivrp st(2)
mov ebp, eax
imul ebp, ebp, 0x64
faddp st(1)
mov dword [esi + 0x1c8], ebp
call fcn.00497ad0
push ebp
push 0x4c3334
lea ebx, [esi + 0x38]
push 0x20
push ebx
mov dword [esi + 0x1d0], eax
call fcn.004374b0
add esp, 0x10
test byte [edi + 0xe], 1
je 0x41fb53
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0
je 0x41fb33
mov ecx, eax
call fcn.00419660
jmp 0x41fb35
xor eax, eax
fld dword [0x4c3314]
or ebp, 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
push eax
mov dword [esp + 0x24], ebp
call fcn.0041e230
jmp 0x41fb56
or ebp, 0xffffffff
test byte [edi + 0xe], 2
je 0x41fb9a
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 1
je 0x41fb7f
mov ecx, eax
call fcn.00419660
jmp 0x41fb81
xor eax, eax
fld dword [0x4c3310]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xe], 4
je 0x41fbde
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 2
je 0x41fbc3
mov ecx, eax
call fcn.00419660
jmp 0x41fbc5
xor eax, eax
fld dword [0x4c330c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xe], 8
je 0x41fc22
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 3
je 0x41fc07
mov ecx, eax
call fcn.00419660
jmp 0x41fc09
xor eax, eax
fld dword [0x4c3308]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xe], 0x10
je 0x41fc66
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 4
je 0x41fc4b
mov ecx, eax
call fcn.00419660
jmp 0x41fc4d
xor eax, eax
fld dword [0x4c3304]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xe], 0x20
je 0x41fcaa
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 5
je 0x41fc8f
mov ecx, eax
call fcn.00419660
jmp 0x41fc91
xor eax, eax
fld dword [0x4c3300]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xe], 0x40
je 0x41fcee
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 6
je 0x41fcd3
mov ecx, eax
call fcn.00419660
jmp 0x41fcd5
xor eax, eax
fld dword [0x4c32fc]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xe], 0x80
je 0x41fd32
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 7
je 0x41fd17
mov ecx, eax
call fcn.00419660
jmp 0x41fd19
xor eax, eax
fld dword [0x4c32f8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xf], 1
je 0x41fd76
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 8
je 0x41fd5b
mov ecx, eax
call fcn.00419660
jmp 0x41fd5d
xor eax, eax
fld dword [0x4c32f4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xf], 2
je 0x41fdba
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 9
je 0x41fd9f
mov ecx, eax
call fcn.00419660
jmp 0x41fda1
xor eax, eax
fld dword [0x4c32f0]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xf], 4
je 0x41fdfe
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xa
je 0x41fde3
mov ecx, eax
call fcn.00419660
jmp 0x41fde5
xor eax, eax
fld dword [0x4c32ec]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xf], 8
je 0x41fe42
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xb
je 0x41fe27
mov ecx, eax
call fcn.00419660
jmp 0x41fe29
xor eax, eax
fld dword [0x4c32e8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xf], 0x10
je 0x41fe86
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xc
je 0x41fe6b
mov ecx, eax
call fcn.00419660
jmp 0x41fe6d
xor eax, eax
fld dword [0x4c32e4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xf], 0x20
je 0x41feca
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xd
je 0x41feaf
mov ecx, eax
call fcn.00419660
jmp 0x41feb1
xor eax, eax
fld dword [0x4c32e0]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
test byte [edi + 0xf], 0x40
je 0x41ff0e
push 0xc
call fcn.00488f77
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xe
je 0x41fef3
mov ecx, eax
call fcn.00419660
jmp 0x41fef5
xor eax, eax
fld dword [0x4c32dc]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e230
movzx ecx, byte [edi + 0x10]
mov eax, dword [esi + 0x1cc]
cmp eax, 0x29b
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fstp dword [esp + 0x14]
jg 0x41ff95
je 0x41ff71
cmp eax, 0x190
je 0x41ff59
cmp eax, 0x215
jne case.0x41ffab.81
cmp ecx, 0x5a
je 0x41ff63
cmp ecx, 0x69
je case.0x41ff80.84
cmp ecx, 0x78
jne case.0x41ffab.81
push 0x4c3330
jmp 0x41ffbe
cmp ecx, 0x64
je 0x41ff6a
cmp ecx, 0x78
jne case.0x41ffab.81
push 0x4c3328
jmp 0x41ffbe
push 0x4c3324
jmp 0x41ffbe
lea eax, [ecx - 0x54]
cmp eax, 0x24
ja case.0x41ffab.81
movzx edx, byte [eax + 0x420240]
jmp dword [edx*4 + 0x42022c]
push 0x4c332c
jmp 0x41ffbe
push 0x4c331c
jmp 0x41ffbe
cmp eax, 0x320
jne case.0x41ffab.81
lea eax, [ecx - 0x50]
cmp eax, 0x1e
ja case.0x41ffab.81
movzx eax, byte [eax + 0x42027c]
jmp dword [eax*4 + 0x420268]
push 0x4c3320
jmp 0x41ffbe
push str.KJHDEFG
push 0x20
push ebx
call fcn.004373f0
add esp, 0xc
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x420040
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x420040
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x420040
fld dword [esp + 0x14]
fldz
fld qword [0x4b73b0]
fld qword [0x4c3378]
jmp 0x41fff7
fxch st(2)
fxch st(2)
fcom dword [ebp + 4]
fnstsw ax
test ah, 5
jp 0x420024
fld st(3)
fdiv dword [ebp + 4]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr st(2)
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fadd st(3)
call fcn.00497ad0
mov dword [ebp + 8], eax
test ebx, ebx
je 0x420038
mov eax, dword [ebx + 8]
test eax, eax
je 0x420038
mov ebp, dword [eax + 4]
test ebp, ebp
mov ebx, eax
jne 0x41fff5
fstp st(3)
fstp st(0)
fstp st(0)
fstp st(0)
movzx ecx, byte [edi + 0x12]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fld dword [esp + 0x28]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esi + 0x1d8]
movzx edx, byte [edi + 0x13]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1dc]
movzx eax, byte [edi + 0x14]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e0]
movzx ecx, byte [edi + 0x15]
movzx edx, byte [edi + 0x16]
and ecx, 0xf
shl ecx, 8
add ecx, edx
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e4]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x17]
shr eax, 4
shl eax, 8
add eax, ecx
mov dword [esp + 0x28], eax
fimul dword [esp + 0x28]
fstp dword [esi + 0x1e8]
movzx edx, byte [edi + 0x3c]
and edx, 0x1f
mov dword [esi + 0x1b0], edx
movzx eax, byte [edi + 0x75]
and eax, 0x7f
mov ebp, eax
cmp ebp, 7
jle 0x4200e2
mov ebp, 7
xor eax, eax
test ebp, ebp
jle 0x4200f9
push ebp
lea eax, [esi + 0x58]
push 0x7f
push eax
call fcn.00497ff0
add esp, 0xc
mov eax, ebp
movzx ecx, byte [edi + 0x76]
lea edx, [esi + 0x60]
mov byte [eax + esi + 0x58], cl
push edx
lea eax, [esi + 0x58]
push eax
call fcn.0041bc50
mov cl, byte [edi + 0x78]
mov al, cl
shr al, 4
mov dl, 0xa
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fc], al
mov cl, byte [edi + 0x79]
mov al, cl
shr al, 4
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fd], al
movzx eax, byte [edi + 0x7d]
movzx ecx, byte [edi + 0x7c]
movzx edx, byte [edi + 0x7b]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7a]
shl eax, 8
add eax, edx
shl eax, 8
add esp, 8
add eax, ecx
lea ecx, [edi + 0x80]
mov dword [esi + 0x184], eax
lea ebp, [esi + 0x160]
mov edi, 0x12
movzx eax, byte [ecx]
cmp al, 0xff
sete dl
sub dl, 1
add ecx, 1
add ebp, 1
and edx, eax
sub edi, 1
mov byte [ebp - 1], dl
jne 0x420173
mov byte [esi + 0x172], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4