Function at 0x402650
Capabilities:
Encode data using xor
Get cpu information
Get mac address on windows
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x572e60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x1a8], eax
xor eax, eax
push 0x103
push eax
lea ecx, [ebp - 0x117]
push ecx
mov byte [ebp - 0xc], 0
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov byte [ebp - 0x118], al
call fcn.00503a30
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
add esp, 0xc
lea edx, [ebp - 0x1b4]
push edx
push 0
mov dword [ebp - 0x1b4], 0
call esi
cmp eax, 0x6f
jne 0x402814
mov eax, dword [ebp - 0x1b4]
push eax
call fcn.00402b08
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402814
lea ecx, [ebp - 0x1b4]
push ecx
push ebx
call esi
test eax, eax
jne 0x40280b
push 0x104
push eax
lea edx, [ebp - 0x118]
push edx
call fcn.00503a30
mov ecx, dword [ebx + 0x198]
mov eax, dword [ebx + 0x194]
mov dword [ebp - 8], ecx
add esp, 0xc
lea esi, [ebx + 8]
mov ecx, 0x40
lea edi, [ebp - 0x118]
mov dword [ebp - 0xc], eax
rep movsd dword es:[edi], dword [esi]
cmp al, 0x61
jb 0x40272d
cmp al, 0x7a
ja 0x40272d
add al, 0xe0
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
cmp al, 0x61
jb 0x40273d
cmp al, 0x7a
ja 0x40273d
add al, 0xe0
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xa]
cmp al, 0x61
jb 0x40274d
cmp al, 0x7a
ja 0x40274d
add al, 0xe0
mov byte [ebp - 0xa], al
mov al, byte [ebp - 9]
cmp al, 0x61
jb 0x40275d
cmp al, 0x7a
ja 0x40275d
add al, 0xe0
mov byte [ebp - 9], al
mov al, byte [ebp - 8]
cmp al, 0x61
jb 0x40276d
cmp al, 0x7a
ja 0x40276d
add al, 0xe0
mov byte [ebp - 8], al
mov al, byte [ebp - 7]
cmp al, 0x61
jb 0x40277d
cmp al, 0x7a
ja 0x40277d
add al, 0xe0
mov byte [ebp - 7], al
mov al, byte [ebp - 6]
cmp al, 0x61
jb 0x40278d
cmp al, 0x7a
ja 0x40278d
add al, 0xe0
mov byte [ebp - 6], al
mov al, byte [ebp - 5]
cmp al, 0x61
jb 0x40279d
cmp al, 0x7a
ja 0x40279d
add al, 0xe0
mov byte [ebp - 5], al
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0x118]
cmp al, 0x61
jb 0x4027b8
cmp al, 0x7a
ja 0x4027b8
sub al, 0x20
mov byte [ebp + ecx - 0x118], al
mov al, byte [ebp + ecx - 0x117]
cmp al, 0x61
jb 0x4027d0
cmp al, 0x7a
ja 0x4027d0
sub al, 0x20
mov byte [ebp + ecx - 0x117], al
mov al, byte [ebp + ecx - 0x116]
cmp al, 0x61
jb 0x4027e8
cmp al, 0x7a
ja 0x4027e8
sub al, 0x20
mov byte [ebp + ecx - 0x116], al
mov al, byte [ebp + ecx - 0x115]
cmp al, 0x61
jb 0x402800
cmp al, 0x7a
ja 0x402800
sub al, 0x20
mov byte [ebp + ecx - 0x115], al
add ecx, 4
cmp ecx, 0x100
jl 0x4027a0
push ebx
call fcn.00402b13
add esp, 4
push 0x7f
xor edi, edi
lea edx, [ebp - 0x197]
push edi
push edx
mov byte [ebp - 0x198], 0
call fcn.00503a30
add esp, 0xc
lea eax, [ebp - 0x1b0]
push eax
push 0x20019
push edi
push str.HardwareDescriptionSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1b0], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402a82
mov eax, dword [ebp - 0x1b0]
lea ecx, [ebp - 0x1ac]
push ecx
lea edx, [ebp - 0x198]
push edx
push edi
push edi
push str.ProcessorNameString
push eax
mov dword [ebp - 0x1ac], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x1b0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x19e], 1
call fcn.00502825
cdq
mov ecx, 0x12ffffff
idiv ecx
add edx, 3
mov dword [ebp - 0x1ac], edx
push edx
mov edx, dword [ebp - 0x1a8]
mov eax, dword [edx]
call fcn.00402050
mov eax, dword [ebp - 0x1ac]
push 0x188
mov dword [ebp - 0x19c], eax
call fcn.00402b08
lea ecx, [ebp - 0x118]
add esp, 4
mov dword [ebp - 0x1a4], eax
sub eax, ecx
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1b8], 0x100
jmp 0x402900
movzx edx, byte [ebp + edi - 0x118]
mov eax, dword [ebp - 0x1a8]
mov esi, dword [eax]
add dword [ebp - 0x19c], edx
lea ebx, [ebp + edi - 0x118]
call fcn.00401f00
xor edx, edx
mov ecx, 0xff
div ecx
mov eax, dword [ebp - 0x1bc]
inc edi
add dl, 0x17
xor dl, byte [ebx]
mov byte [ebx + eax], dl
cmp edi, 0x100
jl 0x402900
xor edi, edi
mov bl, byte [ebp + edi - 0xc]
mov edx, dword [ebp - 0x1a8]
mov esi, dword [edx]
movzx ecx, bl
add dword [ebp - 0x19c], ecx
call fcn.00401f00
xor edx, edx
mov ecx, 0xff
div ecx
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x1a4]
inc eax
inc edi
mov dword [ebp - 0x1b8], eax
add dl, 0x17
xor dl, bl
mov byte [eax + ecx - 1], dl
cmp edi, 8
jl 0x402944
mov ebx, eax
xor edi, edi
add ebx, ecx
nop
movzx ecx, byte [ebp + edi - 0x198]
mov edx, dword [ebp - 0x1a8]
mov esi, dword [edx]
add dword [ebp - 0x19c], ecx
call fcn.00401f00
xor edx, edx
mov ecx, 0xff
div ecx
inc edi
inc ebx
add dl, 0x17
xor dl, byte [ebp + edi - 0x199]
mov byte [ebx - 1], dl
cmp edi, 0x80
jl 0x402990
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
push 0x55310c
add eax, dword [ebp + 0x14]
push str.Lock.Key
add dword [ebp - 0x19c], eax
call fcn.00502904
mov esi, eax
add esp, 8
test esi, esi
je 0x402a97
push esi
push 1
lea ecx, [ebp - 0x1ac]
push 4
push ecx
call fcn.00502a72
mov edx, dword [ebp - 0x1a4]
push esi
push 1
push 0x188
push edx
call fcn.00502a72
push esi
push 1
lea eax, [ebp + 0xc]
push 4
push eax
call fcn.00502a72
push esi
push 1
lea ecx, [ebp + 0x10]
push 4
push ecx
call fcn.00502a72
add esp, 0x40
push esi
push 1
lea edx, [ebp + 0x14]
push 4
push edx
call fcn.00502a72
push esi
push 1
lea eax, [ebp - 0x19c]
push 4
push eax
call fcn.00502a72
push esi
push 1
lea ecx, [ebp - 0x19d]
push 1
push ecx
mov byte [ebp - 0x19d], 0xfe
call fcn.00502a72
push esi
call fcn.00502b59
mov bl, byte [ebp - 0x19e]
add esp, 0x34
jmp 0x402a99
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005021f9
mov esp, ebp
pop ebp
ret 0x10
xor bl, bl
mov edx, dword [ebp - 0x1a4]
push edx
call fcn.00402b13
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.005021f9
mov esp, ebp
pop ebp
ret 0x10