Function at 0x43951e
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0x14
mov eax, 0x584453
call fcn.00565102
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0xc]
push 0x58fd48
lea ebx, [esi + 0x1c]
push 0x20
push ebx
call fcn.00564635
fld dword [0x58fba0]
fstp dword [esi + 0x368]
add esp, 0xc
mov dword [esi + 0x18], 9
test byte [edi + 6], 2
je 0x439578
fld dword [0x58fd44]
push str.DDR3L
push 0x20
fstp dword [esi + 0x368]
push ebx
call fcn.00564635
add esp, 0xc
test byte [edi + 6], 4
je 0x43959a
fld dword [0x58fcc4]
push str.DDR3L
push 0x20
fstp dword [esi + 0x368]
push ebx
call fcn.00564635
add esp, 0xc
movzx eax, byte [edi + 3]
and eax, 0xf
dec eax
je 0x43967c
dec eax
je 0x43965d
dec eax
je 0x439638
dec eax
je 0x439613
dec eax
je 0x4395eb
dec eax
jne 0x4396a8
push str.Mini_UDIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00460090
fld dword [0x58fab0]
mov dword [esi + 0x304], 0x20006
jmp 0x43969f
push str.Mini_RDIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00460090
fld dword [0x58fab0]
mov dword [esi + 0x304], 0x20005
jmp 0x43969f
push 0x58fd30
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00460090
fld dword [0x58fd2c]
mov dword [esi + 0x304], 0x20004
jmp 0x43969f
push str.SO_DIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00460090
fld dword [0x58fd28]
mov dword [esi + 0x304], 0x20003
jmp 0x43969f
push str.UDIMM
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00460090
mov dword [esi + 0x304], 0x20002
jmp 0x439699
push 0x58fbf8
lea eax, [esi + 0x2e4]
push 0x20
push eax
call fcn.00460090
mov dword [esi + 0x304], 0x20001
fld dword [0x58fcc0]
fstp dword [esi + 0x308]
add esp, 0xc
movzx eax, byte [edi + 4]
push 7
shr eax, 4
pop ebx
and eax, ebx
xor edx, edx
sub eax, edx
je 0x4396e7
dec eax
je 0x4396db
dec eax
je 0x4396cf
dec eax
jne 0x4396f1
mov dword [esi + 0x31c], 0x40
jmp 0x4396f1
mov dword [esi + 0x31c], 0x20
jmp 0x4396f1
mov dword [esi + 0x31c], 0x10
jmp 0x4396f1
mov dword [esi + 0x31c], 8
movzx eax, byte [edi + 4]
or dword [ebp + 8], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
and eax, 0xf
cmp eax, 9
ja case.default.0x439709
jmp dword [eax*4 + 0x439f92]
mov dword [ebp + 8], 0x100
jmp case.default.0x439709
mov dword [ebp + 8], 0x200
jmp case.default.0x439709
mov dword [ebp + 8], 0x400
jmp case.default.0x439709
mov dword [ebp + 8], 0x800
jmp case.default.0x439709
mov dword [ebp + 8], 0x1000
jmp case.default.0x439709
mov dword [ebp + 8], 0x2000
jmp case.default.0x439709
mov dword [ebp + 8], 0x4000
jmp case.default.0x439709
mov dword [ebp + 8], 0x8000
jmp case.default.0x439709
mov dword [ebp + 8], 0x10000
jmp case.default.0x439709
mov dword [ebp + 8], 0x20000
movzx eax, byte [edi + 7]
mov ecx, eax
and ecx, ebx
sub ecx, edx
je 0x439798
dec ecx
je 0x43978f
dec ecx
je 0x439786
dec ecx
jne 0x43979f
mov dword [ebp - 0x14], 0x20
jmp 0x43979f
mov dword [ebp - 0x14], 0x10
jmp 0x43979f
mov dword [ebp - 0x14], 8
jmp 0x43979f
mov dword [ebp - 0x14], 4
shr eax, 3
and eax, ebx
sub eax, edx
je 0x4397e4
dec eax
je 0x4397d8
dec eax
je 0x4397cc
dec eax
je 0x4397c0
dec eax
jne 0x4397ee
mov dword [esi + 0x320], 8
jmp 0x4397ee
mov dword [esi + 0x320], 4
jmp 0x4397ee
mov dword [esi + 0x320], 3
jmp 0x4397ee
mov dword [esi + 0x320], 2
jmp 0x4397ee
mov dword [esi + 0x320], 1
movzx eax, byte [edi + 8]
and eax, ebx
sub eax, edx
je 0x43981c
dec eax
je 0x439813
dec eax
je 0x43980a
dec eax
jne 0x439823
mov dword [ebp - 0x10], 0x40
jmp 0x439823
mov dword [ebp - 0x10], 0x20
jmp 0x439823
mov dword [ebp - 0x10], 0x10
jmp 0x439823
mov dword [ebp - 0x10], 8
push dword [ebp + 8]
call fcn.0040448b
pop ecx
test eax, eax
je 0x43987c
push dword [ebp - 0x10]
call fcn.0040448b
pop ecx
test eax, eax
je 0x43987c
push dword [ebp - 0x14]
call fcn.0040448b
pop ecx
test eax, eax
je 0x43987c
mov ebx, dword [esi + 0x320]
push ebx
call fcn.0040448b
pop ecx
test eax, eax
je 0x43987c
mov eax, dword [ebp - 0x10]
cdq
idiv dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 8]
cdq
and edx, 7
add eax, edx
sar eax, 3
imul ecx, eax
imul ecx, ebx
mov dword [esi + 0x2dc], ecx
mov al, byte [edi + 0xb]
test al, al
jbe 0x43989a
movzx ecx, byte [edi + 0xa]
mov dword [ebp + 8], ecx
movzx eax, al
fild dword [ebp + 8]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fdivp st(1)
jmp 0x4398a0
fld dword [0x58faa8]
movzx eax, byte [edi + 0xc]
fstp dword [ebp - 0x14]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fmul dword [ebp - 0x14]
fst dword [ebp + 8]
fld dword [ebp + 8]
fdivr qword [0x5cae70]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fld qword [0x5cae18]
fadd st(1), st(0)
fxch st(1)
call fcn.005652a0
fld dword [ebp + 8]
fadd st(0), st(0)
mov dword [esi + 0x330], eax
fmul qword [0x5caeb0]
fdiv qword [0x5cae88]
fadd st(1)
call fcn.005652a0
fld qword [0x58fd20]
fdivrp st(2)
mov ebx, eax
imul ebx, ebx, 0x64
faddp st(1)
mov dword [esi + 0x32c], ebx
call fcn.005652a0
push ebx
push str.PC3__d
mov dword [esi + 0x334], eax
lea eax, [esi + 0x3c]
push 0x20
push eax
call fcn.00460090
add esp, 0x10
test byte [edi + 0xe], 1
push 0xc
pop ebx
je 0x439962
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
test eax, eax
je 0x439947
mov ecx, eax
call fcn.0042d0f0
jmp 0x439949
xor eax, eax
fld dword [0x58fa64]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xe], 2
je 0x4399a1
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x439986
mov ecx, eax
call fcn.0042d0f0
jmp 0x439988
xor eax, eax
fld dword [0x58fa60]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xe], 4
je 0x4399e0
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x4399c5
mov ecx, eax
call fcn.0042d0f0
jmp 0x4399c7
xor eax, eax
fld dword [0x58fa5c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xe], 8
je 0x439a1f
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x439a04
mov ecx, eax
call fcn.0042d0f0
jmp 0x439a06
xor eax, eax
fld dword [0x58fa58]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xe], 0x10
je 0x439a5e
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x439a43
mov ecx, eax
call fcn.0042d0f0
jmp 0x439a45
xor eax, eax
fld dword [0x58d884]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xe], 0x20
je 0x439a9d
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x439a82
mov ecx, eax
call fcn.0042d0f0
jmp 0x439a84
xor eax, eax
fld dword [0x58fa54]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xe], 0x40
je 0x439adc
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 6
test eax, eax
je 0x439ac1
mov ecx, eax
call fcn.0042d0f0
jmp 0x439ac3
xor eax, eax
fld dword [0x58fa50]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xe], 0x80
je 0x439b1b
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 7
test eax, eax
je 0x439b00
mov ecx, eax
call fcn.0042d0f0
jmp 0x439b02
xor eax, eax
fld dword [0x58fa4c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xf], 1
je 0x439b5a
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 8
test eax, eax
je 0x439b3f
mov ecx, eax
call fcn.0042d0f0
jmp 0x439b41
xor eax, eax
fld dword [0x58fa48]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xf], 2
je 0x439b99
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 9
test eax, eax
je 0x439b7e
mov ecx, eax
call fcn.0042d0f0
jmp 0x439b80
xor eax, eax
fld dword [0x58fa44]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xf], 4
je 0x439bd8
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xa
test eax, eax
je 0x439bbd
mov ecx, eax
call fcn.0042d0f0
jmp 0x439bbf
xor eax, eax
fld dword [0x58fa40]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xf], 8
je 0x439c17
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xb
test eax, eax
je 0x439bfc
mov ecx, eax
call fcn.0042d0f0
jmp 0x439bfe
xor eax, eax
fld dword [0x58fa3c]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xf], 0x10
je 0x439c52
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x439c37
mov ecx, eax
call fcn.0042d0f0
jmp 0x439c39
xor eax, eax
fld dword [0x58fa38]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xf], 0x20
je 0x439c91
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xd
test eax, eax
je 0x439c76
mov ecx, eax
call fcn.0042d0f0
jmp 0x439c78
xor eax, eax
fld dword [0x58fa34]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
test byte [edi + 0xf], 0x40
je 0x439cd0
push ebx
call fcn.00551d80
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xe
test eax, eax
je 0x439cb5
mov ecx, eax
call fcn.0042d0f0
jmp 0x439cb7
xor eax, eax
fld dword [0x58fa30]
or dword [ebp - 4], 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x338]
push eax
call fcn.004339c2
movzx eax, byte [edi + 0x10]
mov ecx, dword [esi + 0x330]
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fmul dword [ebp - 0x14]
fstp dword [ebp - 0x18]
cmp ecx, 0x190
je 0x439d60
cmp ecx, 0x215
je 0x439d4a
cmp ecx, 0x29b
je 0x439d28
cmp ecx, 0x320
jne 0x439d84
cmp eax, 0x50
je 0x439d59
cmp eax, 0x5a
je 0x439d21
cmp eax, 0x64
je 0x439d3c
cmp eax, 0x6e
jne 0x439d84
push 0x58fa7c
jmp 0x439d76
push 0x58fa78
jmp 0x439d76
cmp eax, 0x54
je 0x439d43
cmp eax, 0x60
je 0x439d59
cmp eax, 0x6c
je 0x439d21
cmp eax, 0x78
jne 0x439d84
push 0x58fa74
jmp 0x439d76
push 0x58fa70
jmp 0x439d76
cmp eax, 0x5a
je 0x439d6a
cmp eax, 0x69
je 0x439d43
cmp eax, 0x78
jne 0x439d84
push 0x58fa6c
jmp 0x439d76
cmp eax, 0x64
je 0x439d71
cmp eax, 0x78
jne 0x439d84
push str.EGFJHK
jmp 0x439d76
push 0x58db3c
lea eax, [esi + 0x3c]
push 0x20
push eax
call fcn.00460170
add esp, 0xc
mov eax, dword [esi + 0x338]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
call fcn.0042d792
jmp 0x439ddf
fldz
fcomp dword [ecx + 4]
fnstsw ax
test ah, 5
jp 0x439dd7
fld dword [ebp - 0x18]
fdiv dword [ecx + 4]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fdivr qword [0x5cae70]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fstp dword [ecx + 8]
fld dword [ebp - 0x10]
fld dword [ebp + 8]
fcompp
fnstsw ax
test ah, 5
jp 0x439dd7
fld dword [ebp + 8]
fstp dword [ecx + 8]
lea ecx, [ebp - 0x20]
call fcn.0042d7a9
mov ecx, eax
test ecx, ecx
jne 0x439d9b
movzx eax, byte [edi + 0x12]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld dword [ebp - 0x14]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esi + 0x33c]
movzx eax, byte [edi + 0x13]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x340]
movzx eax, byte [edi + 0x14]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x344]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x16]
and eax, 0xf
shl eax, 8
add eax, ecx
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld st(1)
fmulp st(1)
fstp dword [esi + 0x348]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x17]
shr eax, 4
shl eax, 8
add eax, ecx
mov dword [ebp + 8], eax
fimul dword [ebp + 8]
fstp dword [esi + 0x34c]
movzx eax, byte [edi + 0x3c]
and eax, 0x1f
mov dword [esi + 0x30c], eax
movzx ebx, byte [edi + 0x75]
and ebx, 0x7f
cmp ebx, 0xf
jle 0x439e7e
push 0xf
pop ebx
xor eax, eax
test ebx, ebx
jle 0x439e95
push ebx
lea eax, [esi + 0x5c]
push 0x7f
push eax
call fcn.005635a0
add esp, 0xc
mov eax, ebx
mov cl, byte [edi + 0x76]
mov byte [eax + esi + 0x5c], cl
lea eax, [esi + 0x9c]
push eax
lea eax, [esi + 0x5c]
push eax
call fcn.004312f4
mov cl, byte [edi + 0x78]
mov al, cl
shr al, 4
mov dl, 0xa
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x364], al
mov cl, byte [edi + 0x79]
mov al, cl
shr al, 4
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x365], al
movzx eax, byte [edi + 0x7a]
movzx ecx, byte [edi + 0x7b]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7c]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7d]
shl eax, 8
add eax, ecx
push eax
push 0x58dbd8
mov dword [esi + 0x2e0], eax
lea eax, [esi + 0x2bc]
push 0x20
push eax
call fcn.00460090
add esp, 0x18
lea ecx, [esi + 0x29c]
lea eax, [edi + 0x80]
mov dword [ebp + 8], 0x12
mov dl, byte [eax]
cmp dl, 0xff
sete bl
dec bl
and bl, dl
inc eax
mov byte [ecx], bl
inc ecx
dec dword [ebp + 8]
jne 0x439f27
mov byte [esi + 0x2ae], 0
movzx ebx, byte [edi + 0x94]
and ebx, 0x7f
cmp ebx, 0xf
jle 0x439f55
push 0xf
pop ebx
xor eax, eax
test ebx, ebx
jle 0x439f6c
push ebx
lea eax, [esi + 0x7c]
push 0x7f
push eax
call fcn.005635a0
add esp, 0xc
mov eax, ebx
mov cl, byte [edi + 0x95]
mov byte [eax + esi + 0x7c], cl
lea eax, [esi + 0x19c]
push eax
add esi, 0x7c
push esi
call fcn.004312f4
pop ecx
pop ecx
call fcn.005651da
ret 4