Function at 0x41f600
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a6e85
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e3e9c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov edi, dword [esi + 8]
push str.DDR3
lea eax, [esi + 0x18]
push 0x20
push eax
call fcn.0048ef9c
fld dword [0x4ba374]
fstp dword [esi + 0x200]
mov dword [esi + 0x14], 9
movzx eax, byte [edi + 3]
and eax, 0xf
add eax, 0xffffffff
add esp, 0xc
cmp eax, 5
ja case.default.0x41f665
jmp dword [eax*4 + 0x42003c]
push 0x4ba3dc
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.00436a40
fld dword [0x4ba3d8]
mov dword [esi + 0x1a8], 0x20001
jmp 0x41f748
push str.UDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.00436a40
fld dword [0x4ba3d8]
mov dword [esi + 0x1a8], 0x20002
jmp 0x41f748
push 0x4ba3c8
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.00436a40
fld dword [0x4ba3c4]
mov dword [esi + 0x1a8], 0x20003
jmp 0x41f748
push 0x4ba3b8
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.00436a40
fld dword [0x4ba3b4]
mov dword [esi + 0x1a8], 0x20004
jmp 0x41f748
push str.Mini_RDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.00436a40
mov dword [esi + 0x1a8], 0x20005
jmp 0x41f742
push 0x4ba39c
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.00436a40
mov dword [esi + 0x1a8], 0x20006
fld dword [0x4ba398]
fstp dword [esi + 0x1ac]
add esp, 0xc
movzx eax, byte [edi + 4]
shr eax, 4
and eax, 7
cmp eax, 3
ja case.default.0x41f760
jmp dword [eax*4 + 0x420054]
mov dword [esi + 0x1c0], 8
jmp case.default.0x41f760
mov dword [esi + 0x1c0], 0x10
jmp case.default.0x41f760
mov dword [esi + 0x1c0], 0x20
jmp case.default.0x41f760
mov dword [esi + 0x1c0], 0x40
movzx eax, byte [edi + 4]
or ebx, 0xffffffff
and eax, 0xf
cmp eax, 9
mov ebp, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
ja case.default.0x41f7ae
jmp dword [eax*4 + 0x420064]
mov ebp, 0x100
jmp case.default.0x41f7ae
mov ebp, 0x200
jmp case.default.0x41f7ae
mov ebp, 0x400
jmp case.default.0x41f7ae
mov ebp, 0x800
jmp case.default.0x41f7ae
mov ebp, 0x1000
jmp case.default.0x41f7ae
mov ebp, 0x2000
jmp case.default.0x41f7ae
mov ebp, 0x4000
jmp case.default.0x41f7ae
mov ebp, 0x8000
jmp case.default.0x41f7ae
mov ebp, 0x10000
jmp case.default.0x41f7ae
mov ebp, 0x20000
movzx eax, byte [edi + 7]
mov ecx, eax
and ecx, 7
cmp ecx, 3
mov edx, 4
ja case.default.0x41f80c
jmp dword [ecx*4 + 0x42008c]
mov dword [esp + 0x28], edx
jmp case.default.0x41f80c
mov dword [esp + 0x28], 8
jmp case.default.0x41f80c
mov dword [esp + 0x28], 0x10
jmp case.default.0x41f80c
mov dword [esp + 0x28], 0x20
shr eax, 3
and eax, 7
cmp eax, 3
ja case.default.0x41f840
jmp dword [eax*4 + 0x42009c]
mov dword [esp + 0x14], 1
jmp case.default.0x41f840
mov dword [esp + 0x14], 2
jmp case.default.0x41f840
mov dword [esp + 0x14], 3
jmp case.default.0x41f840
mov dword [esp + 0x14], edx
movzx eax, byte [edi + 8]
and eax, 7
cmp eax, 3
ja case.default.0x41f875
jmp dword [eax*4 + 0x4200ac]
mov ebx, 8
jmp case.default.0x41f875
mov ebx, 0x10
jmp case.default.0x41f875
mov ebx, 0x20
jmp case.default.0x41f875
mov ebx, 0x40
push ebp
call fcn.00408510
add esp, 4
test eax, eax
je 0x41f8f4
push ebx
call fcn.00408510
add esp, 4
test eax, eax
je 0x41f8f4
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00408510
add esp, 4
test eax, eax
je 0x41f8f4
mov edx, dword [esp + 0x14]
push edx
call fcn.00408510
add esp, 4
test eax, eax
je 0x41f8f4
mov eax, ebx
cdq
idiv dword [esp + 0x28]
mov ecx, eax
mov eax, ebp
cdq
and edx, 7
add eax, edx
sar eax, 3
imul ecx, eax
imul ecx, dword [esp + 0x14]
mov dword [esi + 0x180], ecx
movzx edx, byte [edi + 0xa]
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x28], edx
movzx ecx, byte [edi + 0xc]
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x28]
fdivp st(1)
fstp dword [esp + 0x28]
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fst dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr qword [0x4ae2b8]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fld st(0)
fld qword [0x4ba330]
fadd st(1), st(0)
fxch st(1)
call fcn.0048f080
fxch st(1)
fadd st(0), st(0)
mov dword [esi + 0x1cc], eax
fmul qword [0x4ba2f8]
fdiv qword [0x4ae278]
fadd st(1)
call fcn.0048f080
fld qword [0x4ba390]
fdivrp st(2)
mov ebp, eax
imul ebp, ebp, 0x64
faddp st(1)
mov dword [esi + 0x1c8], ebp
call fcn.0048f080
push ebp
push 0x4ba2f0
lea ebx, [esi + 0x38]
push 0x20
push ebx
mov dword [esi + 0x1d0], eax
call fcn.00436a40
add esp, 0x10
test byte [edi + 0xe], 1
je 0x41f9e3
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0
je 0x41f9c3
mov ecx, eax
call fcn.00419670
jmp 0x41f9c5
xor eax, eax
fld dword [0x4ba2d0]
or ebp, 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
push eax
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
jmp 0x41f9e6
or ebp, 0xffffffff
test byte [edi + 0xe], 2
je 0x41fa2a
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 1
je 0x41fa0f
mov ecx, eax
call fcn.00419670
jmp 0x41fa11
xor eax, eax
fld dword [0x4ba2cc]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xe], 4
je 0x41fa6e
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 2
je 0x41fa53
mov ecx, eax
call fcn.00419670
jmp 0x41fa55
xor eax, eax
fld dword [0x4ba2c8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xe], 8
je 0x41fab2
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 3
je 0x41fa97
mov ecx, eax
call fcn.00419670
jmp 0x41fa99
xor eax, eax
fld dword [0x4ba2c4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xe], 0x10
je 0x41faf6
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 4
je 0x41fadb
mov ecx, eax
call fcn.00419670
jmp 0x41fadd
xor eax, eax
fld dword [0x4ba2c0]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xe], 0x20
je 0x41fb3a
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 5
je 0x41fb1f
mov ecx, eax
call fcn.00419670
jmp 0x41fb21
xor eax, eax
fld dword [0x4ba2bc]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xe], 0x40
je 0x41fb7e
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 6
je 0x41fb63
mov ecx, eax
call fcn.00419670
jmp 0x41fb65
xor eax, eax
fld dword [0x4ba2b8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xe], 0x80
je 0x41fbc2
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 7
je 0x41fba7
mov ecx, eax
call fcn.00419670
jmp 0x41fba9
xor eax, eax
fld dword [0x4ba2b4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xf], 1
je 0x41fc06
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 8
je 0x41fbeb
mov ecx, eax
call fcn.00419670
jmp 0x41fbed
xor eax, eax
fld dword [0x4ba2b0]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xf], 2
je 0x41fc4a
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 9
je 0x41fc2f
mov ecx, eax
call fcn.00419670
jmp 0x41fc31
xor eax, eax
fld dword [0x4ba2ac]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xf], 4
je 0x41fc8e
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xa
je 0x41fc73
mov ecx, eax
call fcn.00419670
jmp 0x41fc75
xor eax, eax
fld dword [0x4ba2a8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xf], 8
je 0x41fcd2
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xb
je 0x41fcb7
mov ecx, eax
call fcn.00419670
jmp 0x41fcb9
xor eax, eax
fld dword [0x4ba2a4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xf], 0x10
je 0x41fd16
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xc
je 0x41fcfb
mov ecx, eax
call fcn.00419670
jmp 0x41fcfd
xor eax, eax
fld dword [0x4ba2a0]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xf], 0x20
je 0x41fd5a
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xd
je 0x41fd3f
mov ecx, eax
call fcn.00419670
jmp 0x41fd41
xor eax, eax
fld dword [0x4ba29c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
test byte [edi + 0xf], 0x40
je 0x41fd9e
push 0xc
call fcn.0047fb47
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xe
je 0x41fd83
mov ecx, eax
call fcn.00419670
jmp 0x41fd85
xor eax, eax
fld dword [0x4ba298]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041e0c0
movzx ecx, byte [edi + 0x10]
mov eax, dword [esi + 0x1cc]
cmp eax, 0x29b
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fstp dword [esp + 0x14]
jg 0x41fe25
je 0x41fe01
cmp eax, 0x190
je 0x41fde9
cmp eax, 0x215
jne case.0x41fe3b.81
cmp ecx, 0x5a
je 0x41fdf3
cmp ecx, 0x69
je case.0x41fe10.84
cmp ecx, 0x78
jne case.0x41fe3b.81
push 0x4ba2ec
jmp 0x41fe4e
cmp ecx, 0x64
je 0x41fdfa
cmp ecx, 0x78
jne case.0x41fe3b.81
push 0x4ba2e4
jmp 0x41fe4e
push 0x4ba2e0
jmp 0x41fe4e
lea eax, [ecx - 0x54]
cmp eax, 0x24
ja case.0x41fe3b.81
movzx edx, byte [eax + 0x4200d0]
jmp dword [edx*4 + 0x4200bc]
push 0x4ba2e8
jmp 0x41fe4e
push 0x4ba2d8
jmp 0x41fe4e
cmp eax, 0x320
jne case.0x41fe3b.81
lea eax, [ecx - 0x50]
cmp eax, 0x1e
ja case.0x41fe3b.81
movzx eax, byte [eax + 0x42010c]
jmp dword [eax*4 + 0x4200f8]
push 0x4ba2dc
jmp 0x41fe4e
push str.KJHDEFG
push 0x20
push ebx
call fcn.00436830
add esp, 0xc
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x41fed0
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x41fed0
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x41fed0
fld dword [esp + 0x14]
fldz
fld qword [0x4ae2b8]
fld qword [0x4ba330]
jmp 0x41fe87
fxch st(2)
fxch st(2)
fcom dword [ebp + 4]
fnstsw ax
test ah, 5
jp 0x41feb4
fld st(3)
fdiv dword [ebp + 4]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr st(2)
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fadd st(3)
call fcn.0048f080
mov dword [ebp + 8], eax
test ebx, ebx
je 0x41fec8
mov eax, dword [ebx + 8]
test eax, eax
je 0x41fec8
mov ebp, dword [eax + 4]
test ebp, ebp
mov ebx, eax
jne 0x41fe85
fstp st(3)
fstp st(0)
fstp st(0)
fstp st(0)
movzx ecx, byte [edi + 0x12]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fld dword [esp + 0x28]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esi + 0x1d8]
movzx edx, byte [edi + 0x13]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1dc]
movzx eax, byte [edi + 0x14]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e0]
movzx ecx, byte [edi + 0x15]
movzx edx, byte [edi + 0x16]
and ecx, 0xf
shl ecx, 8
add ecx, edx
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e4]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x17]
shr eax, 4
shl eax, 8
add eax, ecx
mov dword [esp + 0x28], eax
fimul dword [esp + 0x28]
fstp dword [esi + 0x1e8]
movzx edx, byte [edi + 0x3c]
and edx, 0x1f
mov dword [esi + 0x1b0], edx
movzx eax, byte [edi + 0x75]
and eax, 0x7f
mov ebp, eax
cmp ebp, 7
jle 0x41ff72
mov ebp, 7
xor eax, eax
test ebp, ebp
jle 0x41ff89
push ebp
lea eax, [esi + 0x58]
push 0x7f
push eax
call fcn.0048f440
add esp, 0xc
mov eax, ebp
movzx ecx, byte [edi + 0x76]
lea edx, [esi + 0x60]
mov byte [eax + esi + 0x58], cl
push edx
lea eax, [esi + 0x58]
push eax
call fcn.0041bbb0
mov cl, byte [edi + 0x78]
mov al, cl
shr al, 4
mov dl, 0xa
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fc], al
mov cl, byte [edi + 0x79]
mov al, cl
shr al, 4
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fd], al
movzx eax, byte [edi + 0x7d]
movzx ecx, byte [edi + 0x7c]
movzx edx, byte [edi + 0x7b]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7a]
shl eax, 8
add eax, edx
shl eax, 8
add esp, 8
add eax, ecx
lea ecx, [edi + 0x80]
mov dword [esi + 0x184], eax
lea ebp, [esi + 0x160]
mov edi, 0x12
movzx eax, byte [ecx]
cmp al, 0xff
sete dl
sub dl, 1
add ecx, 1
add ebp, 1
and edx, eax
sub edi, 1
mov byte [ebp - 1], dl
jne 0x420003
mov byte [esi + 0x172], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4