Function at 0x43cf02
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov ebx, dword [ebp + 8]
mov eax, dword [0x452b70]
mov dword [esp + 8], 0x29df2b0f
mov dword [esp + 0xc], 0x2dbb2fb7
mov dword [esp + 0x10], 0xd139d3b8
mov dword [esp + 0x14], 0xd512d743
mov dword [esp + 0x18], 0xd935db42
mov dword [esp + 0x1c], 0xdd35df42
mov dword [esp + 0x20], 0xc1c2c3f7
mov dword [esp + 0x24], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xf7
xor dl, byte [esp + ecx + 8]
add dl, 0x2d
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 0x20
jne case.default.0x43ced3
lea ecx, [esp + 0x58]
lea edi, [esp + 0x84]
lea esi, [esp + 8]
push ecx
push 8
push edi
push 0xd
push esi
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x45039c]
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov eax, dword [case.0x43ced3.3]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x48], 0
lea eax, [esp + 0x48]
push eax
push 0x449a98
push 1
push 0
push 0x449aa8
call dword [sym.imp.ole32.dll_CoCreateInstance]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4503b4]
mov dword [esp + 8], 0
jmp dword [0x45045c]
mov dword [esp + 8], 0x21772776
mov dword [esp + 0xc], 0x3d8e2371
mov dword [esp + 0x10], 0x39633f98
mov dword [esp + 0x14], 0x356d3b63
mov dword [esp + 0x18], 0x3144379a
mov dword [esp + 0x1c], 0x3330
mov eax, 9
mov ecx, 0x36
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x20
mov edx, eax
and edx, 0x1f
or edx, esi
xor dl, byte [esp + eax - 1]
xor dl, 0xa0
add dl, 0x53
mov byte [esp + eax - 1], dl
inc eax
dec ecx
cmp eax, 0x21
jne case.default.0x43cffd
lea esi, [esp + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, eax
mov eax, dword [esp + 0x48]
mov edx, dword [eax]
mov dword [esp], edx
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], ecx
push ecx
push eax
mov eax, dword [esp + 0x24]
call dword [eax + 0xc]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4503bc]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4503c4]
mov dword [esp + 8], 0x519d4f95
mov dword [esp + 0xc], 0x5552539c
mov dword [esp + 0x10], 0
mov edi, 0x806cdf2
mov dword [esp], 0xf7f9320e
mov edx, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx - 4]
mov dword [esp + 4], ecx
mov eax, edi
or eax, ecx
lea ecx, [edx + eax]
add ecx, 0xf7f93202
mov ebx, ecx
not ebx
mov esi, ecx
and esi, 0xfffffffd
and ebx, 2
imul ebx, esi
or ecx, 2
add eax, dword [esp]
shr eax, 1
and eax, 1
imul eax, ecx
lea ecx, [ebx + eax*2]
mov eax, edx
sub eax, ecx
add ecx, edi
add ecx, 0xf7f93301
mov esi, dword [esp + 4]
and eax, esi
not esi
and esi, ecx
sub eax, esi
add al, 0xbf
mov byte [esp + edx - 4], al
dec edi
inc dword [esp]
inc edx
cmp edx, 0x18
jne 0x43d060
lea eax, [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x77ab79d7
mov dword [esp + 0xc], 0x73af75a0
mov dword [esp + 0x10], 0x4fe271af
mov dword [esp + 0x14], 0x4bbc4dac
mov dword [esp + 0x18], 0x479c49a8
mov dword [esp + 0x1c], 0x439145ea
mov dword [esp + 0x20], 0x5fbe4195
mov dword [esp + 0x24], 0x5be35df7
mov dword [esp + 0x28], 0x579959ea
mov dword [esp + 0x2c], 0x53f1559a
mov dword [esp + 0x30], 0x2ff7518e
mov dword [esp + 0x34], 0x2b852dff
mov word [esp + 0x38], 0x2928
mov dword [esp + 0x3a], 0
mov eax, 0xdf98a0a
mov ecx, 0x1bf31414
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xdf98a02]
mov edi, ecx
and edi, 0x9c2002c
mov esi, eax
xor esi, 0x2918aa69
sub esi, edi
mov ebx, edx
not ebx
lea edi, [ebx + ebx]
mov dword [esp], edi
mov edi, ebx
shl edi, 8
sub edi, dword [esp]
sub edi, edx
add edi, 0xfe
add esi, 0xa
or edi, esi
or esi, ebx
add esi, edx
mov edx, 0xfe
sub edx, esi
and edx, edi
mov bl, 0x11
sub bl, dl
mov byte [esp + eax - 0xdf98a02], bl
inc eax
add ecx, 2
cmp eax, 0xdf98a40
jne 0x43d150
lea eax, [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x44]
mov ecx, dword [esi]
lea edx, [esp + 0x54]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x14]
push esi
call dword [ecx + 0x50]
not eax
shr eax, 0x1f
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x84]
jmp dword [eax*4 + 0x4503cc]
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
lea esi, [esp + 0x50]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
setns cl
cmp eax, 1
setne al
cmp dword [esp + 0x4c], 0
setne dl
and dl, al
and dl, cl
movzx eax, dl
jmp dword [eax*4 + 0x4503d4]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 8], 0xf74bf957
mov dword [esp + 0xc], 0xf34bf57a
mov dword [esp + 0x10], 0xcf7af151
mov dword [esp + 0x14], 0xcb47cd9e
mov dword [esp + 0x18], 0xc778c97d
mov dword [esp + 0x1c], 0xc34cc579
mov word [esp + 0x20], 0xc1c0
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
mov eax, 0x5635b756
mov ecx, 0x29ca48a9
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x5635b74e]
mov edi, ecx
and edi, 0x20c20020
mov edx, eax
and edx, 0x4230051f
or edx, edi
xor edx, esi
lea esi, [edx + edx]
and esi, 0x81e402a2
mov edi, edx
xor edi, 0x31
and edi, esi
xor esi, edx
xor esi, 0xb1
lea edx, [esi + edi*2]
inc dl
mov byte [esp + eax - 0x5635b74e], dl
inc eax
dec ecx
cmp eax, 0x5635b775
jne 0x43d290
mov ecx, dword [esp]
mov eax, dword [ecx]
mov esi, dword [eax + 0x10]
lea edi, [esp + 0x70]
jmp dword [0x4503dc]
push 0
push 0
push edi
push 0
lea eax, [esp + 0x18]
push eax
push ecx
call esi
mov ecx, dword [esp]
nop
nop
nop
push 0
push 0
push edi
push 0
lea eax, [esp + 0x18]
push eax
push ecx
call esi
mov ecx, dword [esp]
jmp dword [0x4503e4]
test eax, eax
setns cl
cmp word [esp + 0x70], 8
sete al
and al, cl
mov ecx, dword [case.0x43cffd.17]
lea edi, [esp + 0x84]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
movzx eax, al
lea esi, [esp + 0x70]
jmp dword [eax*4 + 0x45040c]
mov eax, dword [esp + 0x78]
mov dword [esp], eax
movzx ecx, word [eax]
mov esi, 0
test cx, cx
je 0x43d39b
mov eax, dword [esp]
add eax, 2
xor esi, esi
jmp 0x43d37a
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43d39b
cmp cx, 0x7f
jbe 0x43d36e
movzx edx, cx
cmp edx, 0x7ff
ja 0x43d390
add esi, 2
jmp 0x43d36f
cmp cx, 0xffff
je 0x43d36f
add esi, 3
jmp 0x43d36f
lea eax, [esi + 1]
mov dword [esp + 0x40], eax
push eax
call fcn.0040c820
add esp, 4
push dword [esp]
push dword [esp + 0x44]
mov dword [esp + 8], eax
push eax
call fcn.00428f10
add esp, 0xc
add esi, 0xfffffffc
mov dword [esp + 0x40], esi
xor eax, eax
xor esi, esi
cmp esi, 4
setb al
jmp dword [eax*4 + 0x450414]
mov eax, esi
and eax, 4
mov ecx, esi
or ecx, 4
imul ecx, eax
xor eax, 4
mov edx, esi
and edx, 0xfffffffb
imul edx, eax
add ecx, dword [esp]
mov eax, dword [edx + ecx]
mov dword [esp + esi*4 + 0x58], eax
xor eax, eax
sub dword [esp + 0x40], 4
setb al
jmp dword [eax*4 + 0x45041c]
inc esi
xor eax, eax
cmp esi, 4
setb al
jmp dword [eax*4 + 0x450414]
lea esi, [esp + 0x70]
jmp dword [0x450424]
push dword [esp]
call fcn.0040c830
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [case.0x43cffd.3]
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 4]
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 8]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
mov edx, dword [0x450458]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 8], 0
jmp dword [0x45045c]
into
inc ebx
add dl, bl
into
inc ebx
add byte [eax], al
iretd
aam 0x43
add byte [eax + edx*8], al
inc ebx
add byte [eax - 0x2c], bh
inc ebx
add byte [eax], ch
rol byte [ebx], 1
invalid