Function at 0x439000
Capabilities:
Authenticate hmac
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov ebx, dword [ebp + 8]
mov eax, dword [0x44cd1c]
mov dword [esp + 0x10], 0x43b14165
mov dword [esp + 0x14], 0x47d545dd
mov dword [esp + 0x18], 0x4baf49dc
mov dword [esp + 0x1c], 0x4f8a4da1
mov dword [esp + 0x20], 0x739b71e2
mov dword [esp + 0x24], 0x779375e2
mov dword [esp + 0x28], 0x7b7a795d
mov byte [esp + 0x2c], 0
mov ecx, 0x371dc290
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x371dc280]
xor esi, ecx
mov edx, esi
xor edx, 0xd0
or esi, 0x2f
and edx, esi
add edx, esi
inc dl
mov byte [esp + ecx - 0x371dc280], dl
inc ecx
cmp ecx, 0x371dc2ad
jne 0x439060
lea ecx, [esp + 0x4c]
lea esi, [esp + 0x84]
lea edi, [esp + 0x10]
push ecx
push 8
push esi
push 0xd
push edi
push 0
call eax
test eax, eax
jns 0x4390b4
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x58], 0x47acd4b7
mov dword [esp + 0x54], 0xf5cc498a
mov dword [esp + 0x50], 0xc038ba09
mov dword [esp + 0x4c], 0xa324c977
mov dword [esp + 0x48], 0
lea eax, [esp + 0x48]
push eax
push 0x443668
push 1
push 0
push 0x443678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x439660
mov dword [esp + 0x10], 0x1f4d194e
mov dword [esp + 0x14], 0x63361d4f
mov dword [esp + 0x18], 0x6721613c
mov dword [esp + 0x1c], 0x6b27652d
mov dword [esp + 0x20], 0x6f186932
mov word [esp + 0x24], 0x6d6c
mov dword [esp + 0x26], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3a
xor cl, byte [esp + eax + 0x10]
add cl, 0xde
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x1a
jne 0x439150
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], edi
push edi
lea edi, [esp + 0x30]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x43964c
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x439642
mov dword [esp + 0x10], 0x3383319f
mov dword [esp + 0x14], 0x2f2e2d98
mov eax, 0x4c
mov ecx, 0xb3
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3c]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
add dl, 0x84
mov byte [esp + eax - 0x3c], dl
inc eax
dec ecx
cmp eax, 0x54
jne 0x4391e0
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x10], 0x972b9937
mov dword [esp + 0x14], 0x932f9520
mov dword [esp + 0x18], 0x8f22912f
mov dword [esp + 0x1c], 0x8bdc8dec
mov dword [esp + 0x20], 0x873c89e8
mov dword [esp + 0x24], 0x8331852a
mov dword [esp + 0x28], 0xff9e8135
mov dword [esp + 0x2c], 0xfb63fd57
mov dword [esp + 0x30], 0xf7b9f96a
mov dword [esp + 0x34], 0xf351f5ba
mov dword [esp + 0x38], 0xef57f14e
mov dword [esp + 0x3c], 0xeb45ed5f
mov dword [esp + 0x40], 0xe9e8
xor ebx, ebx
mov eax, 0xffffffff
mov dword [esp + 0xc], 0xfffffffe
nop
mov dword [esp], eax
movzx ecx, byte [esp + ebx + 0x10]
mov eax, dword [esp]
or eax, 0x98b1c8a6
mov edx, ebx
or edx, 0x98b1c8a6
lea esi, [edx + eax]
add esi, ebx
inc esi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
and esi, ecx
add esi, esi
sub esi, edx
mov edx, ebx
and edx, 0x19
xor edx, 0x59
sub esi, eax
sub edx, eax
sub esi, ecx
mov edi, dword [esp + 0xc]
add esi, edi
mov ecx, dword [esp + 4]
and esi, ecx
add esi, esi
add edx, dword [esp]
and edx, esi
mov eax, esi
not eax
and eax, ecx
sub eax, edx
add al, byte [esp + 8]
add al, 0xc2
mov byte [esp + ebx + 0x10], al
mov eax, dword [esp]
inc ebx
dec eax
dec edi
mov dword [esp + 0xc], edi
cmp ebx, 0x34
jne 0x439280
lea edi, [esp + 0x10]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x44]
mov ecx, dword [esi]
lea edx, [esp + 0x68]
push edx
push 0
push 0x30
mov dword [esp + 0x18], eax
push eax
push dword [esp + 0x6c]
push esi
call dword [ecx + 0x50]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x439629
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
lea esi, [esp + 0x64]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43961f
cmp eax, 1
je 0x43961f
cmp dword [esp + 0x60], 0
je 0x43961f
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], 0x31d93fe9
mov dword [esp + 0x14], 0x35c933c2
mov dword [esp + 0x18], 0xc9ca37d7
mov dword [esp + 0x1c], 0xcd3dcb16
mov dword [esp + 0x20], 0xc12ccf33
mov dword [esp + 0x24], 0xc530c327
mov dword [esp + 0x28], 0xc7c4
mov ecx, 0x923accf5
mov edx, 0xa
nop
nop
nop
movzx esi, byte [esp + ecx + 0x6dc5331b]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
add bl, 0x36
mov byte [esp + ecx + 0x6dc5331b], bl
inc ecx
dec edx
cmp ecx, 0x923acd11
jne 0x4393b0
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea edi, [esp + 0x20]
push edi
push eax
call dword [ecx + 0x10]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x43960e
cmp word [esp + 0x70], 8
jne 0x43960e
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp], eax
je 0x43945d
add eax, 2
xor esi, esi
jmp 0x43943c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43945f
cmp cx, 0x7f
jbe 0x439430
movzx edx, cx
cmp edx, 0x7ff
ja 0x439452
add esi, 2
jmp 0x439431
cmp cx, 0xffff
je 0x439431
add esi, 3
jmp 0x439431
xor esi, esi
lea eax, [esi + 1]
push eax
call fcn.00408300
add esp, 4
mov dword [esp + 4], eax
mov ecx, eax
mov dword [esp + 8], esi
test esi, esi
mov esi, dword [esp]
je 0x4395a8
movzx eax, word [esi]
mov ecx, dword [esp + 4]
test ax, ax
je 0x4395a8
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, ax
lea edi, [esi + 2]
mov dword [esp], edi
cmp ax, 0x7f
ja 0x4394c0
mov byte [ecx], al
lea edi, [ecx + 1]
jmp 0x4394e3
cmp eax, 0x7ff
ja 0x439505
cmp edx, 2
jb 0x439505
mov ebx, eax
shr ebx, 6
add bl, 0xc0
mov byte [ecx], bl
mov ebx, dword [ebp + 8]
and al, 0x3f
or al, 0x80
lea edi, [ecx + 2]
mov byte [ecx + 1], al
mov esi, dword [esp]
add edx, ecx
sub edx, edi
mov ecx, edi
lea edi, [esp + 0x10]
movzx eax, word [esi]
test ax, ax
je 0x4395a8
test edx, edx
jne 0x4394a0
jmp 0x4395a8
mov edi, eax
and edi, 0xfc00
cmp edi, 0xd800
jne 0x43955f
cmp edx, 4
jb 0x43955f
movzx edi, word [esi + 2]
add esi, 4
shl eax, 0xa
lea ebx, [eax + edi]
add ebx, 0xfca02400
mov eax, ebx
shr eax, 0x12
add al, 0xf0
mov byte [ecx], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ecx + 1], al
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ecx + 2], bl
mov ebx, dword [ebp + 8]
mov eax, edi
and al, 0x3f
or al, 0x80
lea edi, [ecx + 4]
mov byte [ecx + 3], al
jmp 0x4394e6
movzx esi, di
cmp esi, 0xdc00
jne 0x439572
mov esi, dword [esp]
jmp 0x4394ec
cmp edx, 3
jb 0x4395a1
mov ebx, eax
shr ebx, 0xc
or bl, 0xe0
mov byte [ecx], bl
mov ebx, eax
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ecx + 1], bl
mov ebx, dword [ebp + 8]
and al, 0x3f
or al, 0x80
lea edi, [ecx + 3]
mov byte [ecx + 2], al
jmp 0x4394e3
mov edi, ecx
jmp 0x4394e3
mov byte [ecx], 0
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 8]
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x439601
mov eax, dword [edx + 4]
mov dword [esp + 0x50], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x439601
mov eax, dword [edx + 8]
mov dword [esp + 0x54], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x439601
mov eax, dword [edx + 0xc]
mov dword [esp + 0x58], eax
push edx
call fcn.00408310
add esp, 4
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x5c]
call esi
push dword [esp + 0xc]
call esi
lea esi, [esp + 0x84]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44cd14]
call fcn.0043fb70
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push esi
call eax
test eax, eax
je 0x43968f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
xor esi, esi
jmp 0x4396ad
add ebx, 8
inc esi
cmp esi, 4
je 0x439733
mov eax, 0
test esi, esi
je 0x4396cd
cmp dword [esp + esi*4 + 0x4c], 0
mov eax, esi
jne 0x4396cd
mov ecx, esi
xor ecx, 1
mov eax, esi
and eax, 2
add eax, eax
sub eax, ecx
mov eax, dword [esp + eax*4 + 0x4c]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x4c], eax
mov edi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.00420b60
add esp, 0x10
cmp byte [eax + edi + 9], 0
lea edi, [edi + 1]
jne 0x439710
test edi, edi
je 0x4396a0
add eax, edi
neg edi
push edi
push 0x30
push eax
call fcn.00408490
add esp, 0xc
jmp 0x4396a0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret