Function at 0x43c110
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x4510e0]
mov dword [esp + 0x10], 0xe10be7db
mov dword [esp + 0x14], 0xfd6fe36b
mov dword [esp + 0x18], 0xf901ff70
mov dword [esp + 0x1c], 0xf526fb0f
mov dword [esp + 0x20], 0xf10df706
mov dword [esp + 0x24], 0x8d0df37e
mov dword [esp + 0x28], 0x898e8fb3
mov word [esp + 0x2c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
xor esi, 0x9e7769d6
mov edx, ecx
or edx, 9
and edx, esi
mov esi, edx
and esi, 0x1d
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
xor ebx, 2
imul ebx, esi
mov esi, ecx
xor esi, 0x61889629
add esi, edx
movzx edi, byte [esp + ecx + 0x10]
add esi, ebx
lea edx, [esi + esi]
not edx
add edx, esi
or edx, edi
not esi
and esi, edi
not edx
add edx, esi
add dl, 0x33
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, 0x1e
jne 0x43c170
mov esi, esp
lea ecx, [esp + 0x84]
lea edi, [esp + 0x10]
push esi
push 8
push ecx
push 0xd
push edi
push 0
call eax
test eax, eax
jns 0x43c1eb
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0xc], 0x5517b271
mov dword [esp + 8], 0xb6e50048
mov dword [esp + 4], 0xc9c3f5e3
mov dword [esp], 0x83a4fb44
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x4c]
push eax
push 0x447668
push 1
push 0
push 0x447678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x43c69d
mov dword [esp + 0x10], 0xf305f102
mov dword [esp + 0x14], 0xef02ed1b
mov dword [esp + 0x18], 0xeb29e90c
mov dword [esp + 0x1c], 0xe713e51d
mov dword [esp + 0x20], 0xe330e10e
mov dword [esp + 0x24], 0x9d9c
mov byte [esp + 0x28], 0
mov eax, 0x3ce921ad
mov ecx, 0x316de53
movzx edx, byte [esp + eax - 0x3ce9219d]
lea esi, [eax - 1]
mov edi, ecx
and edi, 0x124008
and esi, 0x2161
or esi, edi
xor esi, 0x1042161
mov ebx, ecx
or ebx, 0xfa299e16
add ebx, eax
or ebx, esi
mov esi, edx
and esi, 0xffffffe9
or esi, 0x1a098404
and edx, 0x16
xor edx, ebx
xor edx, esi
xor edx, 0x1fdfe5ed
mov esi, 0x75
sub esi, edx
add edx, 0xa
and esi, 0x66
and edx, 0x99
sub edx, esi
mov byte [esp + eax - 0x3ce9219d], dl
inc eax
dec ecx
cmp eax, 0x3ce921c6
jne 0x43c280
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
mov ebx, dword [ebp + 8]
mov esi, esp
lea edi, [esp + 0x10]
js 0x43c689
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x64]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43c67f
mov dword [esp + 0x10], 0x39853b85
mov dword [esp + 0x14], 0x2526278c
mov byte [esp + 0x18], 0
mov eax, 0xadf5e68b
mov ecx, 0x520a1974
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x520a1985]
lea edx, [ecx - 0x520a1900]
mov edi, esi
not edi
or edi, edx
mov edx, eax
or edx, esi
and edx, edi
not edx
and edx, eax
mov ebx, edx
and ebx, 0xadf5e69d
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, ebx
add edx, edi
mov edi, edx
xor edi, eax
and edx, ecx
add edx, edx
sub edx, edi
mov edi, edx
xor edi, esi
not edx
and edx, esi
add edx, edx
sub edx, edi
add dl, 0x49
mov byte [esp + eax + 0x520a1985], dl
inc eax
dec ecx
cmp eax, 0xadf5e694
jne 0x43c370
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x10], 0x19d11bc1
mov dword [esp + 0x14], 0xe52de7cc
mov dword [esp + 0x18], 0xe13ee329
mov dword [esp + 0x1c], 0xed18ef00
mov dword [esp + 0x20], 0xe920eb0c
mov dword [esp + 0x24], 0xf527f736
mov dword [esp + 0x28], 0xf112f327
mov dword [esp + 0x2c], 0xfd49ff29
mov dword [esp + 0x30], 0xf907fb4e
mov dword [esp + 0x34], 0xc567c706
mov dword [esp + 0x38], 0xc115c30a
mov dword [esp + 0x3c], 0xcd13cf11
mov word [esp + 0x40], 0xcbcc
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x7b
xor cl, byte [esp + eax + 0x10]
add cl, 0x99
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x37
jne 0x43c460
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x48]
mov ecx, dword [edi]
lea edx, [esp + 0x58]
push edx
push 0
push 0x30
mov dword [esp + 0x70], eax
push eax
mov dword [esp + 0x78], esi
push esi
push edi
call dword [ecx + 0x50]
test eax, eax
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x10]
js 0x43c66b
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
lea esi, [esp + 0x54]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43c661
cmp eax, 1
je 0x43c661
cmp dword [esp + 0x50], 0
je 0x43c661
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x10], 0x29412b51
mov dword [esp + 0x14], 0x2d412fbe
mov dword [esp + 0x18], 0x513e534b
mov dword [esp + 0x1c], 0x55cd5722
mov dword [esp + 0x20], 0x593c5bc7
mov dword [esp + 0x24], 0x5dc85f33
mov dword [esp + 0x28], 0x435c
mov byte [esp + 0x2c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x37
xor dl, byte [esp + ecx + 0x10]
add dl, 0xed
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, 0x1d
jne 0x43c540
mov ecx, dword [eax]
push 0
push 0
push esi
push 0
lea edx, [esp + 0x20]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43c650
cmp word [esp + 0x70], 8
jne 0x43c650
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x60], eax
je 0x43c5cd
add eax, 2
xor esi, esi
jmp 0x43c5ac
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43c5cf
cmp cx, 0x7f
jbe 0x43c5a0
movzx edx, cx
cmp edx, 0x7ff
ja 0x43c5c2
add esi, 2
jmp 0x43c5a1
cmp cx, 0xffff
je 0x43c5a1
add esi, 3
jmp 0x43c5a1
xor esi, esi
lea eax, [esi + 1]
mov dword [esp + 0x5c], eax
push eax
call fcn.004088e0
add esp, 4
mov edi, eax
push dword [esp + 0x60]
push dword [esp + 0x60]
push eax
call fcn.0042a8e0
add esp, 0xc
mov eax, dword [edi]
mov dword [esp], eax
mov eax, esi
xor eax, 4
and esi, 0xfffffffb
add esi, esi
sub esi, eax
cmp esi, 4
jb 0x43c63f
mov eax, dword [edi + 4]
mov dword [esp + 4], eax
mov eax, esi
xor eax, 4
and esi, 0xfffffffb
add esi, esi
sub esi, eax
cmp esi, 4
jb 0x43c63f
mov eax, dword [edi + 8]
mov dword [esp + 8], eax
mov eax, esi
xor eax, 4
and esi, 0xfffffffb
add esi, esi
sub esi, eax
cmp esi, 4
jb 0x43c63f
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], eax
push edi
call fcn.004088f0
add esp, 4
lea edi, [esp + 0x10]
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x68]
call esi
push dword [esp + 0x64]
call esi
mov esi, esp
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x4510d8]
call fcn.004431d0
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x43c6cd
mov esi, edi
imul eax, dword [esi], 0x1a5845
add eax, 0xebde8a13
mov dword [esp], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.00421a10
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x43c6f0
test esi, esi
je 0x43c70e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408960
add esp, 0xc
lea eax, [ebx + 8]
xor ecx, ecx
cmp dword [esp + 4], 0
setne cl
imul ecx, dword [esp + ecx*4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 4], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.00421a10
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x43c740
test esi, esi
je 0x43c75e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408960
add esp, 0xc
lea eax, [ebx + 0x10]
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
imul ecx, dword [esp + ecx*4 + 4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 8], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.00421a10
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x43c790
test esi, esi
je 0x43c7ae
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408960
add esp, 0xc
add ebx, 0x18
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
imul eax, dword [esp + eax*4 + 8], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.00421a10
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x43c7e0
test esi, esi
je 0x43c7fe
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408960
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret