Function at 0x436a40
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x449dc4]
mov dword [esp + 0x6c], eax
mov dword [esp + 0xc], 0xdff0b2f
mov dword [esp + 0x10], 0x31a30f97
mov dword [esp + 0x14], 0x35d133a6
mov dword [esp + 0x18], 0x39fc37db
mov dword [esp + 0x1c], 0x3dd53ba8
mov dword [esp + 0x20], 0x21c53fa8
mov dword [esp + 0x24], 0x25242307
mov word [esp + 0x28], 0
xor esi, esi
mov dword [esp + 0x44], 0x9f7f33f6
mov dword [esp + 0x40], 0x7b801df6
xor ebx, ebx
nop
nop
nop
nop
nop
mov dword [esp + 4], esi
movzx eax, byte [esp + ebx + 0xc]
mov ecx, ebx
xor ecx, 0x7b801d25
mov edx, ebx
or edx, 0x1a
and edx, ecx
lea edi, [edx + edx]
mov ecx, esi
and ecx, 0x34
mov esi, edi
sub esi, ecx
add esi, ebx
add esi, 0x847fe2da
and esi, eax
lea edx, [eax + edx*2]
mov dword [esp + 0x74], edx
lea edx, [ecx + esi*2]
mov dword [esp + 0x70], ecx
sub edx, eax
lea eax, [esi + esi]
mov dword [esp + 8], eax
sub edx, edi
mov eax, dword [esp + 0x40]
add eax, edx
or eax, 1
mov esi, dword [esp + 0x74]
add eax, esi
sub esi, ecx
sub esi, dword [esp + 8]
add esi, ebx
add esi, 0x847fe309
mov ecx, dword [esp + 0x44]
add edx, ecx
mov edi, edx
and edx, 0xbc
and esi, 0x43
or esi, edx
not edi
xor esi, 0xbd
and edi, 1
or edi, esi
mov esi, dword [esp + 4]
add eax, edi
sub eax, dword [esp + 0x70]
sub eax, dword [esp + 8]
add eax, ebx
add al, 0xa
mov byte [esp + ebx + 0xc], al
inc ebx
add esi, 2
dec ecx
mov dword [esp + 0x44], ecx
dec dword [esp + 0x40]
cmp ebx, 0x1e
jne 0x436ab0
lea ecx, [esp + 0x48]
lea ebx, [esp + 0x78]
lea eax, [esp + 0xc]
push ecx
push 8
push ebx
push 0xd
push eax
push 0
call dword [esp + 0x84]
test eax, eax
jns 0x436bf4
mov dword [esp + 0xc], 0x8440
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x5b
xor cl, byte [esp + eax + 0xc]
add cl, 0x28
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 4
jne 0x436b90
movzx eax, word [esp + 0xc]
mov word [esp + 0x78], ax
mov dword [esp + 0xc], 0x615a
mov eax, 0x60
mov ecx, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x54]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
not dl
mov byte [esp + eax - 0x54], dl
inc eax
dec ecx
cmp eax, 0x64
jne 0x436bd0
movzx eax, word [esp + 0xc]
mov word [esp + 0x7a], ax
mov dword [esp + 0xc], 0x1c77
mov eax, 3
mov ecx, 0xfc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xb3
mov edx, eax
and edx, 4
or edx, esi
xor dl, byte [esp + eax + 9]
xor dl, 0xb3
add dl, 0xe8
mov byte [esp + eax + 9], dl
inc eax
dec ecx
cmp eax, 7
jne 0x436c10
movzx eax, word [esp + 0xc]
mov word [esp + 0x7c], ax
mov word [esp + 0x7e], 0
mov dword [esp + 0x54], 0x2c08189e
mov dword [esp + 0x50], 0x4ea4964d
mov dword [esp + 0x4c], 0x3d1cb029
mov dword [esp + 0x48], 0x1529c7a
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x5c]
push eax
push 0x440678
push 1
push 0
push 0x440688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov edi, dword [ebp + 8]
js 0x4370cf
mov dword [esp + 0xc], 0x551b5320
mov dword [esp + 0x10], 0x592c5719
mov dword [esp + 0x14], 0x5d1f5b26
mov dword [esp + 0x18], 0x410d5f17
mov dword [esp + 0x1c], 0x45164334
mov dword [esp + 0x20], 0x4746
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0xc]
lea ecx, [eax + 0x78bd9642]
xor ecx, edx
mov edx, ecx
xor edx, 0x45ecb210
mov esi, ecx
or esi, 0x381104ef
and esi, edx
xor ecx, 0x3a134def
lea edx, [ecx + esi*2]
and ecx, 1
or edx, 1
add edx, ecx
mov byte [esp + eax + 0xc], dl
lea ecx, [eax + eax]
and ecx, 2
sub eax, ecx
inc eax
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [eax + edx*2]
cmp eax, 0x18
jb 0x436cd0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4370be
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x74]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4370b4
mov dword [esp + 0x44], esi
mov dword [esp + 0xc], 0xe432e236
mov dword [esp + 0x10], 0xf8e7e639
mov word [esp + 0x14], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
mov esi, ecx
xor esi, 0x57
mov edx, eax
and edx, 0x10
sub edx, esi
xor dl, byte [esp + ecx + 0xc]
add dl, 0xb8
mov byte [esp + ecx + 0xc], dl
inc ecx
add eax, 2
cmp ecx, 0xa
jne 0x436d90
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xd397d183
mov dword [esp + 0x10], 0xd793d598
mov dword [esp + 0x14], 0xdb8ed99b
mov dword [esp + 0x18], 0xdff4ddfc
mov dword [esp + 0x1c], 0xe3a4e1c0
mov dword [esp + 0x20], 0xe7a9e5b6
mov dword [esp + 0x24], 0xebcae9a5
mov dword [esp + 0x28], 0xef87edbb
mov dword [esp + 0x2c], 0xf3c1f19e
mov dword [esp + 0x30], 0xf7a9f5c6
mov dword [esp + 0x34], 0xfbb3f9ba
mov dword [esp + 0x38], 0xffadfdb3
mov word [esp + 0x3c], 0x100
mov eax, 0x50
mov ecx, 0xc56ccaf
movzx edi, byte [esp + eax - 0x44]
mov esi, ecx
and esi, 0x82
mov edx, eax
and edx, 0x7d
or edx, esi
xor edx, 0x7d
or edx, eax
not edx
add edx, eax
xor edx, ecx
and edx, edi
xor edx, ecx
mov esi, edx
not esi
mov edi, esi
and edi, 0x7d
mov ebx, edx
and ebx, 2
imul ebx, edi
and esi, 2
or edi, 2
imul edi, esi
xor edx, 0x80
add edx, ebx
add edx, edi
inc dl
mov byte [esp + eax - 0x44], dl
inc eax
dec ecx
cmp eax, 0x82
jne 0x436e30
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x58]
mov ecx, dword [esi]
lea edx, [esp + 0x68]
push edx
push 0
push 0x30
mov dword [esp + 0x4c], eax
push eax
push dword [esp + 0x18]
push esi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
lea ebx, [esp + 0x78]
js 0x43709e
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
lea esi, [esp + 0x64]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437094
cmp eax, 1
je 0x437094
cmp dword [esp + 0x60], 0
je 0x437094
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x79dd77c5
mov dword [esp + 0x10], 0x7dd57be8
mov dword [esp + 0x14], 0x61cc7fdf
mov dword [esp + 0x18], 0x65f1632c
mov dword [esp + 0x1c], 0x69ca67cb
mov dword [esp + 0x20], 0x6dfe6bcf
mov word [esp + 0x24], 0x6f6e
mov byte [esp + 0x26], 0
mov ecx, 0x3a79ccb9
lea edx, [esp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
mov edi, ecx
or edi, esi
lea eax, [ecx - 0x3a79cc00]
and eax, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
or ebx, eax
add bl, 0xd0
mov byte [edx], bl
inc edx
dec ecx
cmp ecx, 0x3a79cc9e
jne 0x436f60
mov edx, dword [esp + 4]
mov eax, dword [edx]
lea ecx, [esp + 0xc]
push 0
push 0
lea esi, [esp + 0x90]
push esi
push 0
push ecx
push edx
call dword [eax + 0x10]
test eax, eax
mov edi, dword [ebp + 8]
js 0x43707f
cmp word [esp + 0x88], 8
jne 0x43707f
mov eax, dword [esp + 0x90]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 4], eax
je 0x437015
add eax, 2
xor ebx, ebx
jmp 0x436fec
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x437017
cmp cx, 0x7f
jbe 0x436fe0
movzx edx, cx
cmp edx, 0x7ff
ja 0x43700a
mov ecx, ebx
xor ecx, 2
and ebx, 2
lea ebx, [ecx + ebx*2]
jmp 0x436fe1
cmp cx, 0xffff
je 0x436fe1
add ebx, 3
jmp 0x436fe1
xor ebx, ebx
lea esi, [ebx + 1]
push esi
call fcn.004084d0
add esp, 4
push dword [esp + 4]
push esi
mov dword [esp + 0xc], eax
push eax
call fcn.00409370
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x437046
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x88]
jb 0x43705c
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 8]
push ebx
lea eax, [esp + 0x50]
push eax
call fcn.00408500
add esp, 0xc
push ebx
call fcn.004084e0
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ebx, [esp + 0x78]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 8]
call esi
push dword [esp + 0x40]
call esi
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x448dbc]
call fcn.0043c800
add esp, 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push ebx
call eax
test eax, eax
je 0x437102
mov eax, dword [esp + 0xc]
mov dword [esp + 0x48], eax
imul eax, dword [esp + 0x48], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x48], eax
push 0x10
push 9
push edi
push eax
call fcn.0041d5e0
add esp, 0x10
lea ecx, [eax - 1]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x437130
mov edx, ecx
xor edx, eax
mov esi, eax
not esi
and esi, ecx
lea ecx, [edx + 8]
add esi, esi
sub ecx, esi
je 0x43715f
sub esi, edx
add eax, esi
add eax, 0xfffffff8
push ecx
push 0x30
push eax
call fcn.00408680
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x48], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
push 0x10
push 9
push eax
push ecx
call fcn.0041d5e0
add esp, 0x10
lea ecx, [eax - 1]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x4371a0
mov edx, ecx
xor edx, eax
mov esi, eax
not esi
and esi, ecx
lea ecx, [edx + 8]
add esi, esi
sub ecx, esi
je 0x4371cf
sub esi, edx
add eax, esi
add eax, 0xfffffff8
push ecx
push 0x30
push eax
call fcn.00408680
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x50], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x4c], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x50], ecx
push 0x10
push 9
push eax
push ecx
call fcn.0041d5e0
add esp, 0x10
lea ecx, [eax - 1]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x437210
mov edx, ecx
xor edx, eax
mov esi, eax
not esi
and esi, ecx
lea ecx, [edx + 8]
add esi, esi
sub ecx, esi
je 0x43723f
sub esi, edx
add eax, esi
add eax, 0xfffffff8
push ecx
push 0x30
push eax
call fcn.00408680
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x54], 0
setne al
imul eax, dword [esp + eax*4 + 0x50], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x54], eax
push 0x10
push 9
push edi
push eax
call fcn.0041d5e0
add esp, 0x10
lea ecx, [eax - 1]
mov edx, eax
inc ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x437270
mov edx, ecx
xor edx, eax
mov esi, eax
not esi
and esi, ecx
lea ecx, [edx + 8]
add esi, esi
sub ecx, esi
je 0x43729f
sub esi, edx
add eax, esi
add eax, 0xfffffff8
push ecx
push 0x30
push eax
call fcn.00408680
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret