Function at 0x40b0fb
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
xor ebx, ebx
push esi
push ebx
push ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x40b12d
xor eax, eax
jmp 0x40b369
push ebx
push ebx
push ebx
push 3
pop eax
push eax
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x40b317
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 0x24]
push eax
push 0x401050
push 1
push ebx
push 0x401120
call esi
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0xbc], 9
jne 0x40b218
lea eax, [ebp - 0x20]
push eax
push 0x401090
push 1
push ebx
push 0x401130
call esi
test eax, eax
js 0x40b317
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [ebp - 0x20]
movaps xmm0, xmmword [0x401dd0]
push 3
pop eax
mov word [ebp - 0x18], ax
mov dword [ebp - 0x10], 0x40
mov eax, dword [ecx]
movups xmmword [ebp - 0x56], xmm0
mov dword [ebp - 0x36], 0x55365530
movaps xmm0, xmmword [0x401ba0]
mov edx, dword [eax + 0x20]
mov eax, ebx
movups xmmword [ebp - 0x46], xmm0
mov dword [ebp - 0x32], 0x55205521
mov dword [ebp - 0x2e], 0x55305527
mov word [ebp - 0x2a], 0x55
xor byte [ebp + eax - 0x56], 0x55
inc eax
cmp eax, 0x2d
jb 0x40b1ea
lea eax, [ebp - 0x18]
mov byte [ebp - 0x29], bl
push eax
push ebx
lea eax, [ebp - 0x56]
push eax
push ecx
call edx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
js 0x40b317
mov ecx, dword [ebp - 0x24]
movaps xmm0, xmmword [0x401b10]
push 3
mov eax, dword [ecx]
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x77], 0x55556755
mov byte [ebp - 0x73], bl
mov edx, dword [eax + 0xc]
pop eax
mov byte [ebp - 0x78], al
mov eax, ebx
xor byte [ebp + eax - 0x88], 0x55
inc eax
cmp eax, 0x15
jb 0x40b240
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x73], bl
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x88]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ecx
call edx
test eax, eax
js 0x40b317
push ebx
push ebx
push 3
pop eax
push eax
push eax
push ebx
push ebx
push 0xa
push dword [ebp - 0x1c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x40b317
mov ecx, dword [ebp - 0x1c]
movaps xmm0, xmmword [0x4020a0]
mov eax, dword [ecx]
movups xmmword [ebp - 0x66], xmm0
mov dword [ebp - 0x36], 0x5522553a
movaps xmm0, xmmword [0x401ed0]
mov edx, dword [eax + 0x50]
mov eax, ebx
movups xmmword [ebp - 0x56], xmm0
mov dword [ebp - 0x32], 0x553a5516
movaps xmm0, xmmword [0x401db0]
movups xmmword [ebp - 0x46], xmm0
mov dword [ebp - 0x2e], 0x552c5525
mov word [ebp - 0x2a], 0x55
xor byte [ebp + eax - 0x66], 0x55
inc eax
cmp eax, 0x3d
jb 0x40b2d1
mov byte [ebp - 0x29], bl
mov eax, ebx
mov dword [ebp - 0x10], 0x55045502
mov dword [ebp - 0xc], 0x555519
xor byte [ebp + eax - 0x10], 0x55
inc eax
cmp eax, 7
jb 0x40b2ef
lea eax, [ebp - 4]
mov byte [ebp - 9], bl
push eax
push ebx
push 0x30
lea eax, [ebp - 0x66]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
call edx
test eax, eax
jns 0x40b465
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x40b32a
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x40b33a
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x40b34a
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40b354
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40b361
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
pop esi
pop ebx
leave
ret
mov eax, dword [ecx]
lea edx, [ebp - 0x6c]
push edx
lea edx, [ebp - 0x28]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
test eax, eax
js 0x40b472
cmp dword [ebp - 0x6c], ebx
je 0x40b472
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
mov dword [ebp - 0x16], 0x550a550a
mov dword [ebp - 0x12], 0x55145505
mov dword [ebp - 0xe], 0x551d5501
mov edx, dword [eax + 0x10]
mov eax, ebx
mov word [ebp - 0xa], 0x55
xor byte [ebp + eax - 0x16], 0x55
inc eax
cmp eax, 0xd
jb 0x40b3c2
push ebx
push ebx
lea eax, [ebp - 0x88]
mov byte [ebp - 9], bl
push eax
push ebx
lea eax, [ebp - 0x16]
push eax
push ecx
call edx
test eax, eax
js 0x40b458
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
push ebx
push dword [ebp - 0x80]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x40]
test eax, eax
js 0x40b458
movaps xmm0, xmmword [0x401e60]
mov eax, ebx
movups xmmword [ebp - 0x48], xmm0
movaps xmm0, xmmword [0x401960]
movups xmmword [ebp - 0x38], xmm0
xor byte [ebp + eax - 0x48], 0x55
inc eax
cmp eax, 0x1f
jb 0x40b410
movaps xmm0, xmmword [0x4019a0]
mov eax, ebx
mov byte [ebp - 0x29], bl
movups xmmword [ebp - 0x98], xmm0
xor byte [ebp + eax - 0x98], 0x55
inc eax
cmp eax, 0xf
jb 0x40b42e
push dword [ebp - 0x80]
lea eax, [ebp - 0x48]
mov byte [ebp - 0x89], bl
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0040d976
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x40b36d
jmp 0x40b475
mov ecx, dword [ebp - 4]
xor ebx, ebx
inc ebx
jmp 0x40b31a