Function at 0x41b4e0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x499885
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ca09c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov edi, dword [esi + 8]
push str.DDR3
lea eax, [esi + 0x18]
push 0x20
push eax
call fcn.00481ba5
fld dword [0x4a42a4]
fstp dword [esi + 0x200]
mov dword [esi + 0x14], 9
movzx eax, byte [edi + 3]
and eax, 0xf
add eax, 0xffffffff
add esp, 0xc
cmp eax, 5
ja case.default.0x41b545
jmp dword [eax*4 + 0x41bf1c]
push 0x4a430c
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.004310e0
fld dword [0x4a4308]
mov dword [esi + 0x1a8], 0x20001
jmp 0x41b628
push str.UDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.004310e0
fld dword [0x4a4308]
mov dword [esi + 0x1a8], 0x20002
jmp 0x41b628
push 0x4a42f8
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.004310e0
fld dword [0x4a42f4]
mov dword [esi + 0x1a8], 0x20003
jmp 0x41b628
push 0x4a42e8
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.004310e0
fld dword [0x4a42e4]
mov dword [esi + 0x1a8], 0x20004
jmp 0x41b628
push str.Mini_RDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.004310e0
mov dword [esi + 0x1a8], 0x20005
jmp 0x41b622
push 0x4a42cc
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.004310e0
mov dword [esi + 0x1a8], 0x20006
fld dword [0x4a42c8]
fstp dword [esi + 0x1ac]
add esp, 0xc
movzx eax, byte [edi + 4]
shr eax, 4
and eax, 7
cmp eax, 3
ja case.default.0x41b640
jmp dword [eax*4 + 0x41bf34]
mov dword [esi + 0x1c0], 8
jmp case.default.0x41b640
mov dword [esi + 0x1c0], 0x10
jmp case.default.0x41b640
mov dword [esi + 0x1c0], 0x20
jmp case.default.0x41b640
mov dword [esi + 0x1c0], 0x40
movzx eax, byte [edi + 4]
or ebx, 0xffffffff
and eax, 0xf
cmp eax, 9
mov ebp, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
ja case.default.0x41b68e
jmp dword [eax*4 + 0x41bf44]
mov ebp, 0x100
jmp case.default.0x41b68e
mov ebp, 0x200
jmp case.default.0x41b68e
mov ebp, 0x400
jmp case.default.0x41b68e
mov ebp, 0x800
jmp case.default.0x41b68e
mov ebp, 0x1000
jmp case.default.0x41b68e
mov ebp, 0x2000
jmp case.default.0x41b68e
mov ebp, 0x4000
jmp case.default.0x41b68e
mov ebp, 0x8000
jmp case.default.0x41b68e
mov ebp, 0x10000
jmp case.default.0x41b68e
mov ebp, 0x20000
movzx eax, byte [edi + 7]
mov ecx, eax
and ecx, 7
cmp ecx, 3
mov edx, 4
ja case.default.0x41b6ec
jmp dword [ecx*4 + 0x41bf6c]
mov dword [esp + 0x28], edx
jmp case.default.0x41b6ec
mov dword [esp + 0x28], 8
jmp case.default.0x41b6ec
mov dword [esp + 0x28], 0x10
jmp case.default.0x41b6ec
mov dword [esp + 0x28], 0x20
shr eax, 3
and eax, 7
cmp eax, 3
ja case.default.0x41b720
jmp dword [eax*4 + 0x41bf7c]
mov dword [esp + 0x14], 1
jmp case.default.0x41b720
mov dword [esp + 0x14], 2
jmp case.default.0x41b720
mov dword [esp + 0x14], 3
jmp case.default.0x41b720
mov dword [esp + 0x14], edx
movzx eax, byte [edi + 8]
and eax, 7
cmp eax, 3
ja case.default.0x41b755
jmp dword [eax*4 + 0x41bf8c]
mov ebx, 8
jmp case.default.0x41b755
mov ebx, 0x10
jmp case.default.0x41b755
mov ebx, 0x20
jmp case.default.0x41b755
mov ebx, 0x40
push ebp
call fcn.0041e7b0
add esp, 4
test eax, eax
je 0x41b7d4
push ebx
call fcn.0041e7b0
add esp, 4
test eax, eax
je 0x41b7d4
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0041e7b0
add esp, 4
test eax, eax
je 0x41b7d4
mov edx, dword [esp + 0x14]
push edx
call fcn.0041e7b0
add esp, 4
test eax, eax
je 0x41b7d4
mov eax, ebx
cdq
idiv dword [esp + 0x28]
mov ecx, eax
mov eax, ebp
cdq
and edx, 7
add eax, edx
sar eax, 3
imul ecx, eax
imul ecx, dword [esp + 0x14]
mov dword [esi + 0x180], ecx
movzx edx, byte [edi + 0xa]
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x28], edx
movzx ecx, byte [edi + 0xc]
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x28]
fdivp st(1)
fstp dword [esp + 0x28]
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fst dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr qword [0x4a0288]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fld st(0)
fld qword [0x4a4260]
fadd st(1), st(0)
fxch st(1)
call fcn.00481c90
fxch st(1)
fadd st(0), st(0)
mov dword [esi + 0x1cc], eax
fmul qword [0x4a4228]
fdiv qword [0x4a0248]
fadd st(1)
call fcn.00481c90
fld qword [0x4a42c0]
fdivrp st(2)
mov ebp, eax
imul ebp, ebp, 0x64
faddp st(1)
mov dword [esi + 0x1c8], ebp
call fcn.00481c90
push ebp
push 0x4a421c
lea ebx, [esi + 0x38]
push 0x20
push ebx
mov dword [esi + 0x1d0], eax
call fcn.004310e0
add esp, 0x10
test byte [edi + 0xe], 1
je 0x41b8c3
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0
je 0x41b8a3
mov ecx, eax
call fcn.00415600
jmp 0x41b8a5
xor eax, eax
fld dword [0x4a41fc]
or ebp, 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
push eax
mov dword [esp + 0x24], ebp
call fcn.00419fa0
jmp 0x41b8c6
or ebp, 0xffffffff
test byte [edi + 0xe], 2
je 0x41b90a
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 1
je 0x41b8ef
mov ecx, eax
call fcn.00415600
jmp 0x41b8f1
xor eax, eax
fld dword [0x4a41f8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xe], 4
je 0x41b94e
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 2
je 0x41b933
mov ecx, eax
call fcn.00415600
jmp 0x41b935
xor eax, eax
fld dword [0x4a41f4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xe], 8
je 0x41b992
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 3
je 0x41b977
mov ecx, eax
call fcn.00415600
jmp 0x41b979
xor eax, eax
fld dword [0x4a41f0]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xe], 0x10
je 0x41b9d6
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 4
je 0x41b9bb
mov ecx, eax
call fcn.00415600
jmp 0x41b9bd
xor eax, eax
fld dword [0x4a41ec]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xe], 0x20
je 0x41ba1a
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 5
je 0x41b9ff
mov ecx, eax
call fcn.00415600
jmp 0x41ba01
xor eax, eax
fld dword [0x4a41e8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xe], 0x40
je 0x41ba5e
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 6
je 0x41ba43
mov ecx, eax
call fcn.00415600
jmp 0x41ba45
xor eax, eax
fld dword [0x4a41e4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xe], 0x80
je 0x41baa2
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 7
je 0x41ba87
mov ecx, eax
call fcn.00415600
jmp 0x41ba89
xor eax, eax
fld dword [0x4a41e0]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xf], 1
je 0x41bae6
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 8
je 0x41bacb
mov ecx, eax
call fcn.00415600
jmp 0x41bacd
xor eax, eax
fld dword [0x4a41dc]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xf], 2
je 0x41bb2a
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 9
je 0x41bb0f
mov ecx, eax
call fcn.00415600
jmp 0x41bb11
xor eax, eax
fld dword [0x4a41d8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xf], 4
je 0x41bb6e
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xa
je 0x41bb53
mov ecx, eax
call fcn.00415600
jmp 0x41bb55
xor eax, eax
fld dword [0x4a41d4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xf], 8
je 0x41bbb2
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xb
je 0x41bb97
mov ecx, eax
call fcn.00415600
jmp 0x41bb99
xor eax, eax
fld dword [0x4a41d0]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xf], 0x10
je 0x41bbf6
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xc
je 0x41bbdb
mov ecx, eax
call fcn.00415600
jmp 0x41bbdd
xor eax, eax
fld dword [0x4a41cc]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xf], 0x20
je 0x41bc3a
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xd
je 0x41bc1f
mov ecx, eax
call fcn.00415600
jmp 0x41bc21
xor eax, eax
fld dword [0x4a41c8]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
test byte [edi + 0xf], 0x40
je 0x41bc7e
push 0xc
call fcn.00472897
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xe
je 0x41bc63
mov ecx, eax
call fcn.00415600
jmp 0x41bc65
xor eax, eax
fld dword [0x4a41c4]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.00419fa0
movzx ecx, byte [edi + 0x10]
mov eax, dword [esi + 0x1cc]
cmp eax, 0x29b
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fstp dword [esp + 0x14]
jg 0x41bd05
je 0x41bce1
cmp eax, 0x190
je 0x41bcc9
cmp eax, 0x215
jne case.0x41bd1b.81
cmp ecx, 0x5a
je 0x41bcd3
cmp ecx, 0x69
je case.0x41bcf0.84
cmp ecx, 0x78
jne case.0x41bd1b.81
push 0x4a4218
jmp 0x41bd2e
cmp ecx, 0x64
je 0x41bcda
cmp ecx, 0x78
jne case.0x41bd1b.81
push 0x4a4210
jmp 0x41bd2e
push 0x4a420c
jmp 0x41bd2e
lea eax, [ecx - 0x54]
cmp eax, 0x24
ja case.0x41bd1b.81
movzx edx, byte [eax + 0x41bfb0]
jmp dword [edx*4 + 0x41bf9c]
push 0x4a4214
jmp 0x41bd2e
push 0x4a4204
jmp 0x41bd2e
cmp eax, 0x320
jne case.0x41bd1b.81
lea eax, [ecx - 0x50]
cmp eax, 0x1e
ja case.0x41bd1b.81
movzx eax, byte [eax + 0x41bfec]
jmp dword [eax*4 + 0x41bfd8]
push 0x4a4208
jmp 0x41bd2e
push str.KJHDEFG
push 0x20
push ebx
call fcn.00430eb0
add esp, 0xc
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x41bdb0
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x41bdb0
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x41bdb0
fld dword [esp + 0x14]
fldz
fld qword [0x4a4260]
fld qword [0x4a0288]
jmp 0x41bd67
fxch st(2)
fxch st(2)
fcom dword [ebp + 4]
fnstsw ax
test ah, 5
jp 0x41bd94
fld st(3)
fdiv dword [ebp + 4]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr st(3)
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fadd st(2)
call fcn.00481c90
mov dword [ebp + 8], eax
test ebx, ebx
je 0x41bda8
mov eax, dword [ebx + 8]
test eax, eax
je 0x41bda8
mov ebp, dword [eax + 4]
test ebp, ebp
mov ebx, eax
jne 0x41bd65
fstp st(3)
fstp st(1)
fstp st(0)
fstp st(0)
movzx ecx, byte [edi + 0x12]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fld dword [esp + 0x28]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esi + 0x1d8]
movzx edx, byte [edi + 0x13]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1dc]
movzx eax, byte [edi + 0x14]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e0]
movzx ecx, byte [edi + 0x15]
movzx edx, byte [edi + 0x16]
and ecx, 0xf
shl ecx, 8
add ecx, edx
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e4]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x17]
shr eax, 4
shl eax, 8
add eax, ecx
mov dword [esp + 0x28], eax
fimul dword [esp + 0x28]
fstp dword [esi + 0x1e8]
movzx edx, byte [edi + 0x3c]
and edx, 0x1f
mov dword [esi + 0x1b0], edx
movzx eax, byte [edi + 0x75]
and eax, 0x7f
mov ebp, eax
cmp ebp, 7
jle 0x41be52
mov ebp, 7
xor eax, eax
test ebp, ebp
jle 0x41be69
push ebp
lea eax, [esi + 0x58]
push 0x7f
push eax
call fcn.00481f20
add esp, 0xc
mov eax, ebp
movzx ecx, byte [edi + 0x76]
lea edx, [esi + 0x60]
mov byte [eax + esi + 0x58], cl
push edx
lea eax, [esi + 0x58]
push eax
call fcn.00417b60
mov cl, byte [edi + 0x78]
mov al, cl
shr al, 4
mov dl, 0xa
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fc], al
mov cl, byte [edi + 0x79]
mov al, cl
shr al, 4
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fd], al
movzx eax, byte [edi + 0x7d]
movzx ecx, byte [edi + 0x7c]
movzx edx, byte [edi + 0x7b]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7a]
shl eax, 8
add eax, edx
shl eax, 8
add esp, 8
add eax, ecx
lea ecx, [edi + 0x80]
mov dword [esi + 0x184], eax
lea ebp, [esi + 0x160]
mov edi, 0x12
movzx eax, byte [ecx]
cmp al, 0xff
sete dl
sub dl, 1
add ecx, 1
add ebp, 1
and edx, eax
sub edi, 1
mov byte [ebp - 1], dl
jne 0x41bee3
mov byte [esi + 0x172], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4