Function at 0x41e4c0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a0a15
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4da22c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov edi, dword [esi + 8]
push str.DDR3
lea eax, [esi + 0x18]
push 0x20
push eax
call fcn.00488d0e
fld dword [0x4b2f14]
fstp dword [esi + 0x200]
mov dword [esi + 0x14], 9
movzx eax, byte [edi + 3]
and eax, 0xf
add eax, 0xffffffff
add esp, 0xc
cmp eax, 5
ja case.default.0x41e525
jmp dword [eax*4 + 0x41eefc]
push 0x4b2f7c
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.00434330
fld dword [0x4b2f78]
mov dword [esi + 0x1a8], 0x20001
jmp 0x41e608
push str.UDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.00434330
fld dword [0x4b2f78]
mov dword [esi + 0x1a8], 0x20002
jmp 0x41e608
push 0x4b2f68
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.00434330
fld dword [0x4b2f64]
mov dword [esi + 0x1a8], 0x20003
jmp 0x41e608
push 0x4b2f58
lea ecx, [esi + 0x188]
push 0x20
push ecx
call fcn.00434330
fld dword [0x4b2f54]
mov dword [esi + 0x1a8], 0x20004
jmp 0x41e608
push str.Mini_RDIMM
lea edx, [esi + 0x188]
push 0x20
push edx
call fcn.00434330
mov dword [esi + 0x1a8], 0x20005
jmp 0x41e602
push 0x4b2f3c
lea eax, [esi + 0x188]
push 0x20
push eax
call fcn.00434330
mov dword [esi + 0x1a8], 0x20006
fld dword [0x4b2f38]
fstp dword [esi + 0x1ac]
add esp, 0xc
movzx eax, byte [edi + 4]
shr eax, 4
and eax, 7
cmp eax, 3
ja case.default.0x41e620
jmp dword [eax*4 + 0x41ef14]
mov dword [esi + 0x1c0], 8
jmp case.default.0x41e620
mov dword [esi + 0x1c0], 0x10
jmp case.default.0x41e620
mov dword [esi + 0x1c0], 0x20
jmp case.default.0x41e620
mov dword [esi + 0x1c0], 0x40
movzx eax, byte [edi + 4]
or ebx, 0xffffffff
and eax, 0xf
cmp eax, 9
mov ebp, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
ja case.default.0x41e66e
jmp dword [eax*4 + 0x41ef24]
mov ebp, 0x100
jmp case.default.0x41e66e
mov ebp, 0x200
jmp case.default.0x41e66e
mov ebp, 0x400
jmp case.default.0x41e66e
mov ebp, 0x800
jmp case.default.0x41e66e
mov ebp, 0x1000
jmp case.default.0x41e66e
mov ebp, 0x2000
jmp case.default.0x41e66e
mov ebp, 0x4000
jmp case.default.0x41e66e
mov ebp, 0x8000
jmp case.default.0x41e66e
mov ebp, 0x10000
jmp case.default.0x41e66e
mov ebp, 0x20000
movzx eax, byte [edi + 7]
mov ecx, eax
and ecx, 7
cmp ecx, 3
mov edx, 4
ja case.default.0x41e6cc
jmp dword [ecx*4 + 0x41ef4c]
mov dword [esp + 0x28], edx
jmp case.default.0x41e6cc
mov dword [esp + 0x28], 8
jmp case.default.0x41e6cc
mov dword [esp + 0x28], 0x10
jmp case.default.0x41e6cc
mov dword [esp + 0x28], 0x20
shr eax, 3
and eax, 7
cmp eax, 3
ja case.default.0x41e700
jmp dword [eax*4 + 0x41ef5c]
mov dword [esp + 0x14], 1
jmp case.default.0x41e700
mov dword [esp + 0x14], 2
jmp case.default.0x41e700
mov dword [esp + 0x14], 3
jmp case.default.0x41e700
mov dword [esp + 0x14], edx
movzx eax, byte [edi + 8]
and eax, 7
cmp eax, 3
ja case.default.0x41e735
jmp dword [eax*4 + 0x41ef6c]
mov ebx, 8
jmp case.default.0x41e735
mov ebx, 0x10
jmp case.default.0x41e735
mov ebx, 0x20
jmp case.default.0x41e735
mov ebx, 0x40
push ebp
call fcn.00407d40
add esp, 4
test eax, eax
je 0x41e7b4
push ebx
call fcn.00407d40
add esp, 4
test eax, eax
je 0x41e7b4
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00407d40
add esp, 4
test eax, eax
je 0x41e7b4
mov edx, dword [esp + 0x14]
push edx
call fcn.00407d40
add esp, 4
test eax, eax
je 0x41e7b4
mov eax, ebx
cdq
idiv dword [esp + 0x28]
mov ecx, eax
mov eax, ebp
cdq
and edx, 7
add eax, edx
sar eax, 3
imul ecx, eax
imul ecx, dword [esp + 0x14]
mov dword [esi + 0x180], ecx
movzx edx, byte [edi + 0xa]
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x28], edx
movzx ecx, byte [edi + 0xc]
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x28]
fdivp st(1)
fstp dword [esp + 0x28]
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fst dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr qword [0x4a7288]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fld st(0)
fld qword [0x4b2ed0]
fadd st(1), st(0)
fxch st(1)
call fcn.00488e00
fxch st(1)
fadd st(0), st(0)
mov dword [esi + 0x1cc], eax
fmul qword [0x4b2e98]
fdiv qword [0x4a7248]
fadd st(1)
call fcn.00488e00
fld qword [0x4b2f30]
fdivrp st(2)
mov ebp, eax
imul ebp, ebp, 0x64
faddp st(1)
mov dword [esi + 0x1c8], ebp
call fcn.00488e00
push ebp
push 0x4b2e90
lea ebx, [esi + 0x38]
push 0x20
push ebx
mov dword [esi + 0x1d0], eax
call fcn.00434330
add esp, 0x10
test byte [edi + 0xe], 1
je 0x41e8a3
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0
je 0x41e883
mov ecx, eax
call fcn.00418570
jmp 0x41e885
xor eax, eax
fld dword [0x4b2e70]
or ebp, 0xffffffff
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
push eax
mov dword [esp + 0x24], ebp
call fcn.0041cf80
jmp 0x41e8a6
or ebp, 0xffffffff
test byte [edi + 0xe], 2
je 0x41e8ea
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 1
je 0x41e8cf
mov ecx, eax
call fcn.00418570
jmp 0x41e8d1
xor eax, eax
fld dword [0x4b2e6c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xe], 4
je 0x41e92e
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 2
je 0x41e913
mov ecx, eax
call fcn.00418570
jmp 0x41e915
xor eax, eax
fld dword [0x4b2e68]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xe], 8
je 0x41e972
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 3
je 0x41e957
mov ecx, eax
call fcn.00418570
jmp 0x41e959
xor eax, eax
fld dword [0x4b2e64]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xe], 0x10
je 0x41e9b6
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 4
je 0x41e99b
mov ecx, eax
call fcn.00418570
jmp 0x41e99d
xor eax, eax
fld dword [0x4b2e60]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xe], 0x20
je 0x41e9fa
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 5
je 0x41e9df
mov ecx, eax
call fcn.00418570
jmp 0x41e9e1
xor eax, eax
fld dword [0x4b2e5c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xe], 0x40
je 0x41ea3e
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 6
je 0x41ea23
mov ecx, eax
call fcn.00418570
jmp 0x41ea25
xor eax, eax
fld dword [0x4b2e58]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xe], 0x80
je 0x41ea82
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 7
je 0x41ea67
mov ecx, eax
call fcn.00418570
jmp 0x41ea69
xor eax, eax
fld dword [0x4b2e54]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xf], 1
je 0x41eac6
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 8
je 0x41eaab
mov ecx, eax
call fcn.00418570
jmp 0x41eaad
xor eax, eax
fld dword [0x4b2e50]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xf], 2
je 0x41eb0a
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 9
je 0x41eaef
mov ecx, eax
call fcn.00418570
jmp 0x41eaf1
xor eax, eax
fld dword [0x4b2e4c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xf], 4
je 0x41eb4e
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xa
je 0x41eb33
mov ecx, eax
call fcn.00418570
jmp 0x41eb35
xor eax, eax
fld dword [0x4b2e48]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xf], 8
je 0x41eb92
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xb
je 0x41eb77
mov ecx, eax
call fcn.00418570
jmp 0x41eb79
xor eax, eax
fld dword [0x4b2e44]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xf], 0x10
je 0x41ebd6
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xc
je 0x41ebbb
mov ecx, eax
call fcn.00418570
jmp 0x41ebbd
xor eax, eax
fld dword [0x4b2e40]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xf], 0x20
je 0x41ec1a
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xd
je 0x41ebff
mov ecx, eax
call fcn.00418570
jmp 0x41ec01
xor eax, eax
fld dword [0x4b2e3c]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
test byte [edi + 0xf], 0x40
je 0x41ec5e
push 0xc
call fcn.00479967
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0xe
je 0x41ec43
mov ecx, eax
call fcn.00418570
jmp 0x41ec45
xor eax, eax
fld dword [0x4b2e38]
push eax
fstp dword [eax + 4]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x24], ebp
call fcn.0041cf80
movzx ecx, byte [edi + 0x10]
mov eax, dword [esi + 0x1cc]
cmp eax, 0x29b
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul dword [esp + 0x28]
fstp dword [esp + 0x14]
jg 0x41ece5
je 0x41ecc1
cmp eax, 0x190
je 0x41eca9
cmp eax, 0x215
jne case.0x41ecfb.81
cmp ecx, 0x5a
je 0x41ecb3
cmp ecx, 0x69
je case.0x41ecd0.84
cmp ecx, 0x78
jne case.0x41ecfb.81
push 0x4b2e8c
jmp 0x41ed0e
cmp ecx, 0x64
je 0x41ecba
cmp ecx, 0x78
jne case.0x41ecfb.81
push 0x4b2e84
jmp 0x41ed0e
push 0x4b2e80
jmp 0x41ed0e
lea eax, [ecx - 0x54]
cmp eax, 0x24
ja case.0x41ecfb.81
movzx edx, byte [eax + 0x41ef90]
jmp dword [edx*4 + 0x41ef7c]
push 0x4b2e88
jmp 0x41ed0e
push 0x4b2e78
jmp 0x41ed0e
cmp eax, 0x320
jne case.0x41ecfb.81
lea eax, [ecx - 0x50]
cmp eax, 0x1e
ja case.0x41ecfb.81
movzx eax, byte [eax + 0x41efcc]
jmp dword [eax*4 + 0x41efb8]
push 0x4b2e7c
jmp 0x41ed0e
push str.KJHDEFG
push 0x20
push ebx
call fcn.00434130
add esp, 0xc
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x41ed90
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x41ed90
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x41ed90
fld dword [esp + 0x14]
fldz
fld qword [0x4a7288]
fld qword [0x4b2ed0]
jmp 0x41ed47
fxch st(2)
fxch st(2)
fcom dword [ebp + 4]
fnstsw ax
test ah, 5
jp 0x41ed74
fld st(3)
fdiv dword [ebp + 4]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fdivr st(2)
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fadd st(3)
call fcn.00488e00
mov dword [ebp + 8], eax
test ebx, ebx
je 0x41ed88
mov eax, dword [ebx + 8]
test eax, eax
je 0x41ed88
mov ebp, dword [eax + 4]
test ebp, ebp
mov ebx, eax
jne 0x41ed45
fstp st(3)
fstp st(0)
fstp st(0)
fstp st(0)
movzx ecx, byte [edi + 0x12]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fld dword [esp + 0x28]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esi + 0x1d8]
movzx edx, byte [edi + 0x13]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1dc]
movzx eax, byte [edi + 0x14]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e0]
movzx ecx, byte [edi + 0x15]
movzx edx, byte [edi + 0x16]
and ecx, 0xf
shl ecx, 8
add ecx, edx
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
fmul st(1)
fstp dword [esi + 0x1e4]
movzx eax, byte [edi + 0x15]
movzx ecx, byte [edi + 0x17]
shr eax, 4
shl eax, 8
add eax, ecx
mov dword [esp + 0x28], eax
fimul dword [esp + 0x28]
fstp dword [esi + 0x1e8]
movzx edx, byte [edi + 0x3c]
and edx, 0x1f
mov dword [esi + 0x1b0], edx
movzx eax, byte [edi + 0x75]
and eax, 0x7f
mov ebp, eax
cmp ebp, 7
jle 0x41ee32
mov ebp, 7
xor eax, eax
test ebp, ebp
jle 0x41ee49
push ebp
lea eax, [esi + 0x58]
push 0x7f
push eax
call fcn.004890c0
add esp, 0xc
mov eax, ebp
movzx ecx, byte [edi + 0x76]
lea edx, [esi + 0x60]
mov byte [eax + esi + 0x58], cl
push edx
lea eax, [esi + 0x58]
push eax
call fcn.0041aad0
mov cl, byte [edi + 0x78]
mov al, cl
shr al, 4
mov dl, 0xa
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fc], al
mov cl, byte [edi + 0x79]
mov al, cl
shr al, 4
imul dl
and cl, 0xf
add al, cl
mov byte [esi + 0x1fd], al
movzx eax, byte [edi + 0x7d]
movzx ecx, byte [edi + 0x7c]
movzx edx, byte [edi + 0x7b]
shl eax, 8
add eax, ecx
movzx ecx, byte [edi + 0x7a]
shl eax, 8
add eax, edx
shl eax, 8
add esp, 8
add eax, ecx
lea ecx, [edi + 0x80]
mov dword [esi + 0x184], eax
lea ebp, [esi + 0x160]
mov edi, 0x12
movzx eax, byte [ecx]
cmp al, 0xff
sete dl
sub dl, 1
add ecx, 1
add ebp, 1
and edx, eax
sub edi, 1
mov byte [ebp - 1], dl
jne 0x41eec3
mov byte [esi + 0x172], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4