Function at 0x41f6e0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a9665
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e86e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov edi, dword [esi + 8]
push str.DDR3
lea eax, [esi + 0x18]
push 0x20
push eax
call fcn.004917bc
fld dword [0x4bd344]
fstp dword [esi + 0x200]
mov dword [esi + 0x14], 9
movzx eax, byte [edi + 3]
and eax, 0xf
add eax, 0xffffffff
add esp, 0xc
cmp eax, 5
ja case.default.0x41f745
jmp dword [eax*4 + 0x42011c]
push 0x4bd3ac
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.00437120
fld dword [0x4bd3a8]
mov dword [esi + 0x1a8], 0x20001
jmp 0x41f828
push str.UDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.00437120
fld dword [0x4bd3a8]
mov dword [esi + 0x1a8], 0x20002
jmp 0x41f828
push 0x4bd398
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.00437120
fld dword [0x4bd394]
mov dword [esi + 0x1a8], 0x20003
jmp 0x41f828
push 0x4bd388
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.00437120
fld dword [0x4bd384]
mov dword [esi + 0x1a8], 0x20004
jmp 0x41f828
push str.Mini_RDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.00437120
mov dword [esi + 0x1a8], 0x20005
jmp 0x41f822
push 0x4bd36c
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.00437120
mov dword [esi + 0x1a8], 0x20006
fld dword [0x4bd368]
fstp dword [esi + 0x1ac]
add esp, 0xc
movzx eax, byte [edi + 4]
shr eax, 4
and eax, 7
cmp eax, 3
ja case.default.0x41f840
jmp dword [eax*4 + 0x420134]
mov dword [esi + 0x1c0], 8
jmp case.default.0x41f840
mov dword [esi + 0x1c0], 0x10
jmp case.default.0x41f840
mov dword [esi + 0x1c0], 0x20
jmp case.default.0x41f840
mov dword [esi + 0x1c0], 0x40
movzx eax, byte [edi + 4]
or ebx, 0xffffffff
and eax, 0xf
cmp eax, 9
mov ebp, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
ja case.default.0x41f88e
jmp dword [eax*4 + 0x420144]
mov ebp, pe_nt_image_headers32
jmp case.default.0x41f88e
mov ebp, 0x200
jmp case.default.0x41f88e
mov ebp, 0x400
jmp case.default.0x41f88e
mov ebp, 0x800
jmp case.default.0x41f88e
mov ebp, 0x1000
jmp case.default.0x41f88e
mov ebp, 0x2000
jmp case.default.0x41f88e
mov ebp, 0x4000
jmp case.default.0x41f88e
mov ebp, 0x8000
jmp case.default.0x41f88e
mov ebp, 0x10000
jmp case.default.0x41f88e
mov ebp, 0x20000
movzx eax, byte [edi + 7]
mov ecx, eax
and ecx, 7
cmp ecx, 3
mov edx, 4
ja case.default.0x41f8ec
jmp dword [ecx*4 + 0x42016c]
mov dword [esp + 0x28], edx
jmp case.default.0x41f8ec
mov dword [esp + 0x28], 8
jmp case.default.0x41f8ec
mov dword [esp + 0x28], 0x10
jmp case.default.0x41f8ec
mov dword [esp + 0x28], 0x20
shr eax, 3
and eax, 7
cmp eax, 3
ja case.default.0x41f920
jmp dword [eax*4 + 0x42017c]
mov dword [esp + 0x14], 1
jmp case.default.0x41f920
mov dword [esp + 0x14], 2
jmp case.default.0x41f920
mov dword [esp + 0x14], 3
jmp case.default.0x41f920
mov dword [esp + 0x14], edx
movzx eax, byte [edi + 8]
and eax, 7
cmp eax, 3
ja case.default.0x41f955
jmp dword [eax*4 + 0x42018c]
mov ebx, 8
jmp case.default.0x41f955
mov ebx, 0x10
jmp case.default.0x41f955
mov ebx, 0x20
jmp case.default.0x41f955
mov ebx, 0x40
push ebp
call fcn.00407dd0
add esp, 4
test eax, eax
je 0x41f9d4
push ebx
call fcn.00407dd0
add esp, 4
test eax, eax
je 0x41f9d4
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00407dd0
add esp, 4
test eax, eax
je 0x41f9d4
mov edx, dword [esp + 0x14]
push edx
call fcn.00407dd0
add esp, 4
test eax, eax
je 0x41f9d4
mov eax, ebx
cdq
idiv dword [esp + 0x28]
mov ecx, eax
mov eax, ebp
cdq
and edx, 7
add eax, edx
sar eax, 3
imul ecx, eax
imul ecx, dword [esp + 0x14]
mov dword [esi + 0x180], ecx
movzx edx, byte [edi + 0xa]
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x28], edx
movzx ecx, byte [edi + 0xc]
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x28]
fdivp st(1)
fstp dword [esp + 0x28]
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fst dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr qword [0x4b1268]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fld st(0)
fld qword [0x4bd300]
fadd st(1), st(0)
fxch st(1)
call fcn.004918a0
fxch st(1)
fadd st(0), st(0)
mov dword [esi + 0x1cc], eax
fmul qword [0x4bd2c8]
fdiv qword [0x4b1220]
fadd st(1)
call fcn.004918a0
fld qword [0x4bd360]
fdivrp st(2)
mov ebp, eax
imul ebp, ebp, 0x64
faddp st(1)
mov dword [esi + 0x1c8], ebp
call fcn.004918a0
push ebp
push 0x4bd2c0
lea ebx, [esi + 0x38]
push 0x20
push ebx
mov dword [esi + 0x1d0], eax
call fcn.00437120
add esp, 0x10
test byte [edi + 0xe], 1
je 0x41fac3
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0
je 0x41faa3
mov ecx, eax
call fcn.00419710
jmp 0x41faa5
xor eax, eax
fld dword [0x4bd2a0]
or ebp, 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
push eax
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
jmp 0x41fac6
or ebp, 0xffffffff
test byte [edi + 0xe], 2
je 0x41fb0a
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 1
je 0x41faef
mov ecx, eax
call fcn.00419710
jmp 0x41faf1
xor eax, eax
fld dword [0x4bd29c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xe], 4
je 0x41fb4e
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 2
je 0x41fb33
mov ecx, eax
call fcn.00419710
jmp 0x41fb35
xor eax, eax
fld dword [0x4bd298]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xe], 8
je 0x41fb92
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 3
je 0x41fb77
mov ecx, eax
call fcn.00419710
jmp 0x41fb79
xor eax, eax
fld dword [0x4bd294]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xe], 0x10
je 0x41fbd6
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 4
je 0x41fbbb
mov ecx, eax
call fcn.00419710
jmp 0x41fbbd
xor eax, eax
fld dword [0x4bd290]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xe], 0x20
je 0x41fc1a
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 5
je 0x41fbff
mov ecx, eax
call fcn.00419710
jmp 0x41fc01
xor eax, eax
fld dword [0x4bd28c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xe], 0x40
je 0x41fc5e
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 6
je 0x41fc43
mov ecx, eax
call fcn.00419710
jmp 0x41fc45
xor eax, eax
fld dword [0x4bd288]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xe], 0x80
je 0x41fca2
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 7
je 0x41fc87
mov ecx, eax
call fcn.00419710
jmp 0x41fc89
xor eax, eax
fld dword [0x4bd284]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xf], 1
je 0x41fce6
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 8
je 0x41fccb
mov ecx, eax
call fcn.00419710
jmp 0x41fccd
xor eax, eax
fld dword [0x4bd280]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xf], 2
je 0x41fd2a
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 9
je 0x41fd0f
mov ecx, eax
call fcn.00419710
jmp 0x41fd11
xor eax, eax
fld dword [0x4bd27c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xf], 4
je 0x41fd6e
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xa
je 0x41fd53
mov ecx, eax
call fcn.00419710
jmp 0x41fd55
xor eax, eax
fld dword [0x4bd278]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xf], 8
je 0x41fdb2
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xb
je 0x41fd97
mov ecx, eax
call fcn.00419710
jmp 0x41fd99
xor eax, eax
fld dword [0x4bd274]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xf], 0x10
je 0x41fdf6
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xc
je 0x41fddb
mov ecx, eax
call fcn.00419710
jmp 0x41fddd
xor eax, eax
fld dword [0x4bd270]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xf], 0x20
je 0x41fe3a
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xd
je 0x41fe1f
mov ecx, eax
call fcn.00419710
jmp 0x41fe21
xor eax, eax
fld dword [0x4bd26c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
test byte [edi + 0xf], 0x40
je 0x41fe7e
push 0xc
call fcn.00482367
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xe
je 0x41fe63
mov ecx, eax
call fcn.00419710
jmp 0x41fe65
xor eax, eax
fld dword [0x4bd268]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e1a0
movzx ecx, byte [edi + 0x10]
mov eax, dword [esi + 0x1cc]
cmp eax, 0x29b
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fstp dword [esp + 0x14]
jg 0x41ff05
je 0x41fee1
cmp eax, 0x190
je 0x41fec9
cmp eax, 0x215
jne case.0x41ff1b.81
cmp ecx, 0x5a
je 0x41fed3
cmp ecx, 0x69
je case.0x41fef0.84
cmp ecx, 0x78
jne case.0x41ff1b.81
push 0x4bd2bc
jmp 0x41ff2e
cmp ecx, 0x64
je 0x41feda
cmp ecx, 0x78
jne case.0x41ff1b.81
push 0x4bd2b4
jmp 0x41ff2e
push 0x4bd2b0
jmp 0x41ff2e
lea eax, [ecx - 0x54]
cmp eax, 0x24
ja case.0x41ff1b.81
movzx edx, byte [eax + 0x4201b0]
jmp dword [edx*4 + 0x42019c]
push 0x4bd2b8
jmp 0x41ff2e
push 0x4bd2a8
jmp 0x41ff2e
cmp eax, 0x320
jne case.0x41ff1b.81
lea eax, [ecx - 0x50]
cmp eax, 0x1e
ja case.0x41ff1b.81
movzx eax, byte [eax + 0x4201ec]
jmp dword [eax*4 + 0x4201d8]
push 0x4bd2ac
jmp 0x41ff2e
push str.KJHDEFG
push 0x20
push ebx
call fcn.00437060
add esp, 0xc
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x41ffb0
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x41ffb0
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x41ffb0
fld dword [esp + 0x14]
fldz
fld qword [0x4b1268]
fld qword [0x4bd300]
jmp 0x41ff67
fxch st(2)
fxch st(2)
fcom dword [ebp + 4]
fnstsw ax
test ah, 5
jp 0x41ff94
fld st(3)
fdiv dword [ebp + 4]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr st(2)
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fadd st(3)
call fcn.004918a0
mov dword [ebp + 8], eax
test ebx, ebx
je 0x41ffa8
mov eax, dword [ebx + 8]
test eax, eax
je 0x41ffa8
mov ebp, dword [eax + 4]
test ebp, ebp
mov ebx, eax
jne 0x41ff65
fstp st(3)
fstp st(0)
fstp st(0)
fstp st(0)
movzx ecx, byte [edi + 0x12]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fld dword [esp + 0x28]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esi + 0x1d8]
movzx edx, byte [edi + 0x13]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1dc]
movzx eax, byte [edi + 0x14]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e0]
movzx ecx, byte [edi + 0x15]
movzx edx, byte [edi + 0x16]
and ecx, 0xf
shl ecx, 8
add ecx, edx
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e4]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x17]
shr eax, 4
shl eax, 8
add eax, ecx
mov dword [esp + 0x28], eax
fimul dword [esp + 0x28]
fstp dword [esi + 0x1e8]
movzx edx, byte [edi + 0x3c]
and edx, 0x1f
mov dword [esi + 0x1b0], edx
movzx eax, byte [edi + 0x75]
and eax, 0x7f
mov ebp, eax
cmp ebp, 7
jle 0x420052
mov ebp, 7
xor eax, eax
test ebp, ebp
jle 0x420069
push ebp
lea eax, [esi + 0x58]
push 0x7f
push eax
call fcn.00491b30
add esp, 0xc
mov eax, ebp
movzx ecx, byte [edi + 0x76]
lea edx, [esi + 0x60]
mov byte [eax + esi + 0x58], cl
push edx
lea eax, [esi + 0x58]
push eax
call fcn.0041bc90
mov cl, byte [edi + 0x78]
mov al, cl
shr al, 4
mov dl, 0xa
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fc], al
mov cl, byte [edi + 0x79]
mov al, cl
shr al, 4
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fd], al
movzx eax, byte [edi + 0x7d]
movzx ecx, byte [edi + 0x7c]
movzx edx, byte [edi + 0x7b]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7a]
shl eax, 8
add eax, edx
shl eax, 8
add esp, 8
add eax, ecx
lea ecx, [edi + 0x80]
mov dword [esi + 0x184], eax
lea ebp, [esi + 0x160]
mov edi, 0x12
movzx eax, byte [ecx]
cmp al, 0xff
sete dl
sub dl, 1
add ecx, 1
add ebp, 1
and edx, eax
sub edi, 1
mov byte [ebp - 1], dl
jne 0x4200e3
mov byte [esi + 0x172], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4