Function at 0x439310
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x44cd18]
mov dword [esp + 0x10], 0x116b1f3b
mov dword [esp + 0x14], 0x1587139b
mov dword [esp + 0x18], 0x9711780
mov dword [esp + 0x1c], 0xd4e0b97
mov dword [esp + 0x20], 0x1950f9e
mov dword [esp + 0x24], 0x5650396
mov dword [esp + 0x28], 0x39060723
mov byte [esp + 0x2c], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x10]
mov edi, ecx
and edi, 0xa
mov ebx, edx
xor ebx, 0xfb82d605
add ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 1
or ebx, 1
add ebx, esi
add bl, 0xe6
mov byte [esp + edx + 0x10], bl
inc edx
add ecx, 2
cmp edx, 0x1d
jne 0x439370
mov ebx, esp
lea ecx, [esp + 0x84]
lea esi, [esp + 0x10]
push ebx
push 8
push ecx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x4393c7
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0xc], 0xa591cc61
mov dword [esp + 8], 0xc5c3b9ef
mov dword [esp + 4], 0xef78b2f0
mov dword [esp], 0x6f821586
mov dword [esp + 0x50], 0
lea eax, [esp + 0x50]
push eax
push 0x443668
push 1
push 0
push 0x443678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov edi, dword [ebp + 8]
js 0x439975
mov dword [esp + 0x10], 0x81578756
mov dword [esp + 0x14], 0x8d5e8351
mov dword [esp + 0x18], 0x89438f28
mov dword [esp + 0x1c], 0x955d8b43
mov dword [esp + 0x20], 0x9164974a
mov dword [esp + 0x24], 0x9390
mov byte [esp + 0x28], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x10]
lea edx, [eax - 0x73e1899f]
or edx, ecx
mov esi, 0x9e
sub esi, eax
not ecx
or ecx, esi
add ecx, edx
add ecx, 0x4367b01b
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x10], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x19
jb 0x439460
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], esi
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x43995d
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x439953
mov dword [esp + 0x10], 0x7f0f7903
mov dword [esp + 0x14], 0x63627d30
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x6a
xor dl, byte [esp + ecx + 0x10]
add dl, 0xee
mov byte [esp + ecx + 0x10], dl
and eax, 1
not ecx
or ecx, 1
sub eax, ecx
mov ecx, eax
cmp eax, 0xb
jb 0x439520
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x10], 0xf7abf957
mov dword [esp + 0x14], 0xf3aff5a0
mov dword [esp + 0x18], 0xcf62f1af
mov dword [esp + 0x1c], 0xcbbccdac
mov dword [esp + 0x20], 0xc79cc9a8
mov dword [esp + 0x24], 0xc391c56a
mov dword [esp + 0x28], 0xdfbec195
mov dword [esp + 0x2c], 0xdb63dd77
mov dword [esp + 0x30], 0xd799d96a
mov dword [esp + 0x34], 0xd371d59a
mov dword [esp + 0x38], 0x2f77d18e
mov dword [esp + 0x3c], 0x2b852d7f
mov dword [esp + 0x40], 0x2928
mov byte [esp + 0x44], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
or edx, 0x6452ec56
add edx, ecx
lea edx, [edx*2 + 2]
mov edi, ecx
xor edi, 0x6452ec56
mov ebx, edx
and ebx, edi
xor edi, edx
movzx edx, byte [esp + ecx + 0x10]
lea edi, [edi + ebx*2]
mov ebx, edi
and ebx, edx
or edi, edx
lea edx, [edi + edi]
not edx
add edx, edi
or edx, ebx
mov bl, 0x51
sub bl, dl
mov byte [esp + ecx + 0x10], bl
inc ecx
dec eax
cmp ecx, 0x35
jne 0x4395d0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
push edi
mov dword [esp + 0x78], esi
push esi
push eax
call dword [ecx + 0x50]
test eax, eax
mov ebx, esp
js 0x439941
mov dword [esp + 0x64], edi
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea edi, [esp + 0x5c]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x439933
cmp eax, 1
je 0x439933
cmp dword [esp + 0x58], 0
je 0x439933
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], 0x99f19bc1
mov dword [esp + 0x14], 0xa5d1a7e6
mov dword [esp + 0x18], 0xa1d6a3cb
mov dword [esp + 0x1c], 0xadd5aff2
mov dword [esp + 0x20], 0xa9c4abdf
mov dword [esp + 0x24], 0xb5c8b7c3
mov word [esp + 0x28], 0xb3b4
mov dword [esp + 0x2a], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 5
xor edi, 0x74e40ae5
mov edx, ecx
and edx, 0x1a
sub edx, edi
lea edi, [edx*2 + 1]
mov ebx, edx
sub ebx, edi
mov edi, edx
not edi
lea edi, [edi + edx*2]
inc edi
and ebx, 0x85
and edi, 0x7a
or edi, ebx
movzx ebx, byte [esp + ecx + 0x10]
xor edi, 0x85
and edi, ebx
or edx, ebx
xor edx, edi
add dl, 0x79
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, 0x1e
jne 0x4396e0
mov ecx, dword [eax]
push 0
push 0
push esi
push 0
lea edx, [esp + 0x20]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x439920
cmp word [esp + 0x70], 8
jne 0x439920
mov ebx, dword [esp + 0x78]
movzx ecx, word [ebx]
test cx, cx
je 0x43979d
lea eax, [ebx + 2]
xor esi, esi
jmp 0x43977c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43979f
cmp cx, 0x7f
jbe 0x439770
movzx edx, cx
cmp edx, 0x7ff
ja 0x439792
add esi, 2
jmp 0x439771
cmp cx, 0xffff
je 0x439771
add esi, 3
jmp 0x439771
xor esi, esi
lea eax, [esi + 1]
push eax
call fcn.004086e0
add esp, 4
mov edi, eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], esi
test esi, esi
je 0x4398d4
movzx eax, word [ebx]
mov edi, dword [esp + 0x48]
test ax, ax
je 0x4398d4
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, ax
lea esi, [ebx + 2]
cmp dx, 0x7f
ja 0x439800
lea eax, [edi + 1]
mov byte [edi], dl
jmp 0x439880
cmp edx, 0x7ff
ja 0x439824
cmp ecx, 2
jb 0x439824
mov eax, edx
shr eax, 6
add al, 0xc0
mov byte [edi], al
and dl, 0x3f
or dl, 0x80
mov byte [edi + 1], dl
lea eax, [edi + 2]
jmp 0x439880
mov eax, edx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x43989a
cmp ecx, 4
jb 0x43989a
movzx esi, word [ebx + 2]
shl edx, 0xa
lea eax, [edx + esi]
add eax, 0xfca02400
mov edx, eax
shr edx, 0x12
add dl, 0xf0
mov byte [edi], dl
mov edx, eax
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [edi + 1], dl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 2], al
mov al, 0x3f
mov edx, esi
sub al, dl
and al, 0x3f
xor al, 0xbf
mov byte [edi + 3], al
lea eax, [edi + 4]
add ebx, 4
mov esi, ebx
nop
nop
nop
add ecx, edi
sub ecx, eax
mov ebx, esi
mov edi, eax
movzx eax, word [ebx]
test ax, ax
je 0x4398d4
test ecx, ecx
jne 0x4397e0
jmp 0x4398d4
movzx eax, ax
cmp eax, 0xdc00
jne 0x4398a8
mov ebx, esi
jmp 0x439888
cmp ecx, 3
jb 0x4398d0
mov eax, edx
shr eax, 0xc
or al, 0xe0
mov byte [edi], al
mov eax, edx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 1], al
and dl, 0x3f
or dl, 0x80
lea eax, [edi + 3]
mov byte [edi + 2], dl
jmp 0x439880
mov eax, edi
jmp 0x439880
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x54]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x4398ec
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x70]
jb 0x4398ff
mov eax, 3
lea eax, [eax*4 + 4]
mov ecx, esp
push eax
mov edi, dword [esp + 0x4c]
push edi
push ecx
call fcn.00408710
add esp, 0xc
push edi
call fcn.004086f0
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, esp
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [esp + 0x64]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x68]
call esi
push edi
call esi
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x10]
push 0xbeb8f1a1
push dword [0x44cd10]
call fcn.004400a0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x4399a5
mov ebx, esi
imul eax, dword [ebx], 0x1a5845
add eax, 0xebde8a13
mov dword [esp], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041fa80
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4399d0
test esi, esi
je 0x4399ee
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408870
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 4], 0
setne cl
imul ecx, dword [esp + ecx*4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 4], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041fa80
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439a20
test esi, esi
je 0x439a3e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408870
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
imul ecx, dword [esp + ecx*4 + 4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 8], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041fa80
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439a70
test esi, esi
je 0x439a8e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408870
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
imul eax, dword [esp + eax*4 + 8], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041fa80
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439ac0
test esi, esi
je 0x439ade
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408870
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret