Function at 0x560d50
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0x14
mov eax, 0x59bf61
call fcn.0057ba6f
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0xc]
push 0x5a409c
lea ebx, [esi + 0x1c]
push 0x20
push ebx
call fcn.0057a7c3
fld dword [0x5a3714]
fstp dword [esi + 0x368]
add esp, 0xc
mov dword [esi + 0x18], 9
test byte [edi + 6], 2
je 0x560daa
fld dword [0x5a3708]
push str.DDR3L
push 0x20
fstp dword [esi + 0x368]
push ebx
call fcn.0057a7c3
add esp, 0xc
test byte [edi + 6], 4
je 0x560dcc
fld dword [0x5a36f4]
push str.DDR3L
push 0x20
fstp dword [esi + 0x368]
push ebx
call fcn.0057a7c3
add esp, 0xc
movzx eax, byte [edi + 3]
and eax, 0xf
dec eax
je 0x560eae
dec eax
je 0x560e8f
dec eax
je 0x560e6a
dec eax
je 0x560e45
dec eax
je 0x560e1d
dec eax
jne 0x560eda
push str.Mini_UDIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00439b20
fld dword [0x5c3898]
mov dword [esi + 0x304], 0x20006
jmp 0x560ed1
push str.Mini_RDIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00439b20
fld dword [0x5c3898]
mov dword [esi + 0x304], 0x20005
jmp 0x560ed1
push 0x5c3a84
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00439b20
fld dword [0x5c3a80]
mov dword [esi + 0x304], 0x20004
jmp 0x560ed1
push str.SO_DIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00439b20
fld dword [0x5c3a7c]
mov dword [esi + 0x304], 0x20003
jmp 0x560ed1
push str.UDIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00439b20
mov dword [esi + 0x304], 0x20002
jmp 0x560ecb
push str.RDIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00439b20
mov dword [esi + 0x304], 0x20001
fld dword [0x5c3a30]
fstp dword [esi + 0x308]
add esp, 0xc
movzx eax, byte [edi + 4]
push 7
shr eax, 4
pop ebx
and eax, ebx
xor edx, edx
sub eax, edx
je 0x560f19
dec eax
je 0x560f0d
dec eax
je 0x560f01
dec eax
jne 0x560f23
mov dword [esi + 0x31c], 0x40
jmp 0x560f23
mov dword [esi + 0x31c], 0x20
jmp 0x560f23
mov dword [esi + 0x31c], 0x10
jmp 0x560f23
mov dword [esi + 0x31c], 8
movzx eax, byte [edi + 4]
or dword [ebp + 8], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
and eax, 0xf
cmp eax, 9
ja case.default.0x560f3b
jmp dword [eax*4 + 0x5617c4]
mov dword [ebp + 8], 0x100
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x200
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x400
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x800
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x1000
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x2000
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x4000
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x8000
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x10000
jmp case.default.0x560f3b
mov dword [ebp + 8], 0x20000
movzx eax, byte [edi + 7]
mov ecx, eax
and ecx, ebx
sub ecx, edx
je 0x560fca
dec ecx
je 0x560fc1
dec ecx
je 0x560fb8
dec ecx
jne 0x560fd1
mov dword [ebp - 0x14], 0x20
jmp 0x560fd1
mov dword [ebp - 0x14], 0x10
jmp 0x560fd1
mov dword [ebp - 0x14], 8
jmp 0x560fd1
mov dword [ebp - 0x14], 4
shr eax, 3
and eax, ebx
sub eax, edx
je 0x561016
dec eax
je 0x56100a
dec eax
je 0x560ffe
dec eax
je 0x560ff2
dec eax
jne 0x561020
mov dword [esi + 0x320], 8
jmp 0x561020
mov dword [esi + 0x320], 4
jmp 0x561020
mov dword [esi + 0x320], 3
jmp 0x561020
mov dword [esi + 0x320], 2
jmp 0x561020
mov dword [esi + 0x320], 1
movzx eax, byte [edi + 8]
and eax, ebx
sub eax, edx
je 0x56104e
dec eax
je 0x561045
dec eax
je 0x56103c
dec eax
jne 0x561055
mov dword [ebp - 0x10], 0x40
jmp 0x561055
mov dword [ebp - 0x10], 0x20
jmp 0x561055
mov dword [ebp - 0x10], 0x10
jmp 0x561055
mov dword [ebp - 0x10], 8
push dword [ebp + 8]
call fcn.0041c390
pop ecx
test eax, eax
je 0x5610ae
push dword [ebp - 0x10]
call fcn.0041c390
pop ecx
test eax, eax
je 0x5610ae
push dword [ebp - 0x14]
call fcn.0041c390
pop ecx
test eax, eax
je 0x5610ae
mov ebx, dword [esi + 0x320]
push ebx
call fcn.0041c390
pop ecx
test eax, eax
je 0x5610ae
mov eax, dword [ebp - 0x10]
cdq
idiv dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 8]
cdq
and edx, 7
add eax, edx
sar eax, 3
imul ecx, eax
imul ecx, ebx
mov dword [esi + 0x2dc], ecx
mov al, byte [edi + 0xb]
test al, al
jbe 0x5610cc
movzx ecx, byte [edi + 0xa]
mov dword [ebp + 8], ecx
movzx eax, al
fild dword [ebp + 8]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fdivp st(1)
jmp 0x5610d2
fld dword [0x5c3890]
movzx eax, byte [edi + 0xc]
fstp dword [ebp - 0x14]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fmul dword [ebp - 0x14]
fst dword [ebp + 8]
fld dword [ebp + 8]
fdivr qword [0x5dcff8]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fld qword [0x5dcfb0]
fadd st(1), st(0)
fxch st(1)
call fcn.0057b7d0
fld dword [ebp + 8]
fadd st(0), st(0)
mov dword [esi + 0x330], eax
fmul qword [0x5dd038]
fdiv qword [0x5dd010]
fadd st(1)
call fcn.0057b7d0
fld qword [0x5aa748]
fdivrp st(2)
mov ebx, eax
imul ebx, ebx, 0x64
faddp st(1)
mov dword [esi + 0x32c], ebx
call fcn.0057b7d0
push ebx
push str.PC3__d
mov dword [esi + 0x334], eax
lea eax, [esi + 0x3c]
push 0x20
push eax
call fcn.00439b20
add esp, 0x10
test byte [edi + 0xe], 1
push 0xc
pop ebx
je 0x561194
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
test eax, eax
je 0x561179
mov ecx, eax
call fcn.00554347
jmp 0x56117b
xor eax, eax
fld dword [0x5a3684]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xe], 2
je 0x5611d3
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x5611b8
mov ecx, eax
call fcn.00554347
jmp 0x5611ba
xor eax, eax
fld dword [0x5a36b8]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xe], 4
je 0x561212
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x5611f7
mov ecx, eax
call fcn.00554347
jmp 0x5611f9
xor eax, eax
fld dword [0x5a36b0]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xe], 8
je 0x561251
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x561236
mov ecx, eax
call fcn.00554347
jmp 0x561238
xor eax, eax
fld dword [0x5a36a8]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xe], 0x10
je 0x561290
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x561275
mov ecx, eax
call fcn.00554347
jmp 0x561277
xor eax, eax
fld dword [0x59f884]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xe], 0x20
je 0x5612cf
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x5612b4
mov ecx, eax
call fcn.00554347
jmp 0x5612b6
xor eax, eax
fld dword [0x5a369c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xe], 0x40
je 0x56130e
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 6
test eax, eax
je 0x5612f3
mov ecx, eax
call fcn.00554347
jmp 0x5612f5
xor eax, eax
fld dword [0x5a3694]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xe], 0x80
je 0x56134d
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 7
test eax, eax
je 0x561332
mov ecx, eax
call fcn.00554347
jmp 0x561334
xor eax, eax
fld dword [0x5a36c8]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xf], 1
je 0x56138c
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 8
test eax, eax
je 0x561371
mov ecx, eax
call fcn.00554347
jmp 0x561373
xor eax, eax
fld dword [0x5a36c0]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xf], 2
je 0x5613cb
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 9
test eax, eax
je 0x5613b0
mov ecx, eax
call fcn.00554347
jmp 0x5613b2
xor eax, eax
fld dword [0x5a367c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xf], 4
je 0x56140a
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xa
test eax, eax
je 0x5613ef
mov ecx, eax
call fcn.00554347
jmp 0x5613f1
xor eax, eax
fld dword [0x5a3674]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xf], 8
je 0x561449
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xb
test eax, eax
je 0x56142e
mov ecx, eax
call fcn.00554347
jmp 0x561430
xor eax, eax
fld dword [0x5a366c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xf], 0x10
je 0x561484
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x561469
mov ecx, eax
call fcn.00554347
jmp 0x56146b
xor eax, eax
fld dword [0x5a3664]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xf], 0x20
je 0x5614c3
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xd
test eax, eax
je 0x5614a8
mov ecx, eax
call fcn.00554347
jmp 0x5614aa
xor eax, eax
fld dword [0x5a365c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
test byte [edi + 0xf], 0x40
je 0x561502
push ebx
call fcn.00568473
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xe
test eax, eax
je 0x5614e7
mov ecx, eax
call fcn.00554347
jmp 0x5614e9
xor eax, eax
fld dword [0x5a3658]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.0055b1f4
movzx eax, byte [edi + 0x10]
mov ecx, dword [esi + 0x330]
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fmul dword [ebp - 0x14]
fstp dword [ebp - 0x18]
cmp ecx, 0x190
je 0x561592
cmp ecx, 0x215
je 0x56157c
cmp ecx, 0x29b
je 0x56155a
cmp ecx, 0x320
jne 0x5615b6
cmp eax, 0x50
je 0x56158b
cmp eax, 0x5a
je 0x561553
cmp eax, 0x64
je 0x56156e
cmp eax, 0x6e
jne 0x5615b6
push 0x5b67ac
jmp 0x5615a8
push 0x5c3878
jmp 0x5615a8
cmp eax, 0x54
je 0x561575
cmp eax, 0x60
je 0x56158b
cmp eax, 0x6c
je 0x561553
cmp eax, 0x78
jne 0x5615b6
push 0x5c3874
jmp 0x5615a8
push 0x5c3870
jmp 0x5615a8
cmp eax, 0x5a
je 0x56159c
cmp eax, 0x69
je 0x561575
cmp eax, 0x78
jne 0x5615b6
push 0x5c386c
jmp 0x5615a8
cmp eax, 0x64
je 0x5615a3
cmp eax, 0x78
jne 0x5615b6
push str.EGFJH
jmp 0x5615a8
push 0x59fb3c
lea eax, [esi + 0x3c]
push 0x20
push eax
call fcn.00439c00
add esp, 0xc
mov eax, dword [esi + 0x338]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
call fcn.005549ff
jmp 0x561611
fldz
fcomp dword [ecx + 4]
fnstsw ax
test ah, 5
jp 0x561609
fld dword [ebp - 0x18]
fdiv dword [ecx + 4]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fdivr qword [0x5dcff8]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fstp dword [ecx + 8]
fld dword [ebp - 0x10]
fld dword [ebp + 8]
fcompp
fnstsw ax
test ah, 5
jp 0x561609
fld dword [ebp + 8]
fstp dword [ecx + 8]
lea ecx, [ebp - 0x20]
call fcn.0052ef4d
mov ecx, eax
test ecx, ecx
jne 0x5615cd
movzx eax, byte [edi + 0x12]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld dword [ebp - 0x14]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esi + 0x33c]
movzx eax, byte [edi + 0x13]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x340]
movzx eax, byte [edi + 0x14]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x344]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x16]
and eax, 0xf
shl eax, 8
add eax, ecx
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x348]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x17]
shr eax, 4
shl eax, 8
add eax, ecx
mov dword [ebp + 8], eax
fimul dword [ebp + 8]
fstp dword [esi + 0x34c]
movzx eax, byte [edi + 0x3c]
and eax, 0x1f
mov dword [esi + 0x30c], eax
movzx ebx, byte [edi + 0x75]
and ebx, 0x7f
cmp ebx, 0xf
jle 0x5616b0
push 0xf
pop ebx
xor eax, eax
test ebx, ebx
jle 0x5616c7
push ebx
lea eax, [esi + 0x5c]
push 0x7f
push eax
call fcn.0057ad60
add esp, 0xc
mov eax, ebx
mov cl, byte [edi + 0x76]
mov byte [eax + esi + 0x5c], cl
lea eax, [esi + 0x9c]
push eax
lea eax, [esi + 0x5c]
push eax
call fcn.00558ab6
mov cl, byte [edi + 0x78]
mov al, cl
shr al, 4
mov dl, 0xa
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x364], al
mov cl, byte [edi + 0x79]
mov al, cl
shr al, 4
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x365], al
movzx eax, byte [edi + 0x7a]
movzx ecx, byte [edi + 0x7b]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7c]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7d]
shl eax, 8
add eax, ecx
push eax
push 0x5b95bc
mov dword [esi + 0x2e0], eax
lea eax, [esi + 0x2bc]
push 0x20
push eax
call fcn.00439b20
add esp, 0x18
lea ecx, [esi + 0x29c]
lea eax, [edi + 0x80]
mov dword [ebp + 8], 0x12
mov dl, byte [eax]
cmp dl, 0xff
sete bl
dec bl
and bl, dl
inc eax
mov byte [ecx], bl
inc ecx
dec dword [ebp + 8]
jne 0x561759
mov byte [esi + 0x2ae], 0
movzx ebx, byte [edi + 0x94]
and ebx, 0x7f
cmp ebx, 0xf
jle 0x561787
push 0xf
pop ebx
xor eax, eax
test ebx, ebx
jle 0x56179e
push ebx
lea eax, [esi + 0x7c]
push 0x7f
push eax
call fcn.0057ad60
add esp, 0xc
mov eax, ebx
mov cl, byte [edi + 0x95]
mov byte [eax + esi + 0x7c], cl
lea eax, [esi + 0x19c]
push eax
add esi, 0x7c
push esi
call fcn.00558ab6
pop ecx
pop ecx
call fcn.0057bb47
ret 4