Function at 0x41c690
Capabilities:
Encode data using xor
Reference sql statements
Reference wmi statements

Disassembly:
push 0xffffffffffffffff
push 0x437f23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
call fcn.0040de30
lea ecx, [esp + 0x44]
mov dword [esp + 0xbc], 0
call fcn.00423fc0
xor eax, eax
xor ecx, ecx
mov dword [esp + 0xc], eax
mov byte [esp + 0xbc], 1
mov word [esp + 0x10], ax
mov eax, dword [esi]
and eax, 1
or eax, ecx
je 0x41c7ef
add esi, 8
push ecx
push str.SOFTWAREMicrosoftWindows_Genuine_Advantage
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00413a00
cmp eax, 1
mov edi, 6
jne 0x41c72c
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
push ecx
push 0x449094
mov ecx, esi
call fcn.00413a80
cmp eax, 1
je 0x41c84f
push 0
push str.SOFTWAREDescriptionMicrosoftRpcUuidTemporaryData
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00413a00
cmp eax, 1
jne 0x41c767
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push eax
push str.NetworkAddress
mov ecx, esi
mov dword [esp + 0x20], edi
call fcn.00413b60
cmp eax, 1
je 0x41c84f
push str.ROOTCIMV2
lea ecx, [esp + 0x48]
xor edi, edi
call fcn.004240a0
cmp eax, 1
jne 0x41c7c8
push str.SELECT__FROM_Win32_NetworkAdapterConfiguration_WHERE_IPEnabledtrue
lea ecx, [esp + 0x48]
call fcn.00424400
cmp eax, 1
jne 0x41c7b6
lea ecx, [esp + 0x44]
call fcn.00424640
test eax, eax
je 0x41c7b6
push edi
lea ecx, [esp + 0x1c]
push edi
push ecx
push str.MACAddress
mov ecx, eax
call fcn.00424820
cmp eax, 1
jne 0x41c7b6
mov edi, eax
lea ecx, [esp + 0x44]
call fcn.004243d0
cmp edi, 1
je 0x41c84f
push 0x100
lea edx, [esp + 0x1c]
push 0x44f7f8
push edx
push str.ProductId
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00413e00
jmp 0x41c84f
add esi, 8
push 0
push str.SystemCurrentControlSetServicesVxDDHCPDhcpInfo00
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00413a00
cmp eax, 1
jne 0x41c82d
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push str.HardwareAddress
mov ecx, esi
mov dword [esp + 0x20], 6
call fcn.00413b60
cmp eax, 1
je 0x41c84f
push 0
lea edx, [esp + 0x1c]
push 0x44f7f8
push edx
push str.ProductId
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00413e00
lea ecx, [esp + 0x18]
call fcn.0040ef30
test eax, eax
je 0x41c88f
lea ecx, [esp + 0x18]
xor edi, edi
call fcn.0040ef30
test eax, eax
jle 0x41c8b5
push edi
lea ecx, [esp + 0x1c]
call fcn.0040eec0
mov bl, byte [esp + 0xc]
lea ecx, [esp + 0x18]
xor bl, al
inc edi
mov byte [esp + 0xc], bl
call fcn.0040ef30
cmp edi, eax
jl 0x41c86b
jmp 0x41c8b5
mov al, byte [esp + 0xc]
mov dl, byte [esp + 0xd]
mov cl, byte [esp + 0xe]
mov bl, byte [esp + 0xf]
xor al, dl
mov dl, byte [esp + 0x10]
xor al, cl
mov cl, byte [esp + 0x11]
xor al, bl
xor al, dl
xor al, cl
mov byte [esp + 0xc], al
mov ecx, esi
call fcn.00413d00
mov bl, byte [esp + 0xc]
lea ecx, [esp + 0x44]
mov byte [esp + 0xbc], 0
call fcn.00424020
lea ecx, [esp + 0x18]
mov dword [esp + 0xbc], 0xffffffff
call fcn.0040ded0
mov ecx, dword [esp + 0xb4]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xb4
ret