Function at 0x433110
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov ebx, dword [ebp + 8]
mov eax, dword [0x44961c]
mov dword [esp + 8], 0x4fb9496d
mov dword [esp + 0xc], 0x43d54dc5
mov dword [esp + 0x10], 0x47a341d4
mov dword [esp + 0x14], 0x7bbe45d9
mov dword [esp + 0x18], 0x7fe779ee
mov dword [esp + 0x1c], 0x73977df6
mov dword [esp + 0x20], 0x77767155
mov byte [esp + 0x24], 0
mov ecx, 0xd
mov esi, 0x12
nop
nop
mov edi, ecx
and edi, 0xe
mov edx, esi
and edx, 0x31
or edx, edi
xor dl, byte [esp + esi - 0xa]
xor dl, 0xe
add dl, 0xa6
mov byte [esp + esi - 0xa], dl
dec ecx
inc esi
cmp esi, 0x2f
jne 0x433170
lea ecx, [esp + 0x48]
lea esi, [esp + 0x84]
lea edi, [esp + 8]
push ecx
push 8
push esi
push 0xd
push edi
push 0
call eax
test eax, eax
jns 0x4331ba
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
lea eax, [esp + 0x44]
push eax
push 0x43f670
push 1
push 0
push 0x43f680
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43368a
mov dword [esp + 8], 0x33853182
mov dword [esp + 0xc], 0x2f822d9b
mov dword [esp + 0x10], 0x2b69298c
mov dword [esp + 0x14], 0x2793259d
mov dword [esp + 0x18], 0x2370218e
mov word [esp + 0x1c], 0x1d1c
mov dword [esp + 0x1e], 0
mov eax, 0xd7db7f8c
mov ecx, 0x28248073
nop
movzx edx, byte [esp + eax + 0x2824807c]
mov esi, eax
and esi, edx
add esi, esi
sub esi, edx
add esi, ecx
and esi, eax
mov edi, esi
and edi, 0xd7db7fbd
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
xor ebx, 2
imul ebx, edi
add esi, ebx
mov edi, esi
not edi
and edi, eax
and esi, ecx
sub edi, esi
add edi, edx
mov edx, edi
and edx, 0x43
xor edi, 0x43
lea edx, [edi + edx*2]
inc dl
mov byte [esp + eax + 0x2824807c], dl
inc eax
dec ecx
cmp eax, 0xd7db7fa6
jne 0x433250
lea edi, [esp + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x44]
mov ecx, dword [esi]
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
mov ebx, dword [ebp + 8]
lea esi, [esp + 0x84]
js 0x433676
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x5c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43366c
mov dword [esp + 8], 0xe93deb3d
mov dword [esp + 0xc], 0xedeeef24
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov edx, eax
and edx, 9
xor edx, 0xe5fca259
mov esi, eax
and esi, 6
sub esi, edx
xor esi, ecx
mov ecx, esi
and ecx, 1
xor esi, 1
lea ecx, [esi + ecx*2]
add cl, 0xbc
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0xb
jne 0x433330
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 8], 0x9510b61
mov dword [esp + 0xc], 0x55d075c
mov dword [esp + 0x10], 0x16e0359
mov dword [esp + 0x14], 0x1d281f20
mov dword [esp + 0x18], 0x19401b3c
mov dword [esp + 0x1c], 0x15471776
mov dword [esp + 0x20], 0x11321347
mov dword [esp + 0x24], 0x2d592f79
mov dword [esp + 0x28], 0x29672b5e
mov dword [esp + 0x2c], 0x25472766
mov dword [esp + 0x30], 0x2175237a
mov dword [esp + 0x34], 0x3d533f71
mov word [esp + 0x38], 0x3b3c
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
mov eax, 0x77aef83
mov ecx, 0x3885107c
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x77aef7b]
mov esi, ecx
and esi, 0x3884005e
mov edi, eax
and edi, 0x5100fa1
or edi, esi
xor edi, edx
mov edx, edi
and edx, 1
xor edi, 0x5f
lea edx, [edi + edx*2]
add dl, 0x70
mov byte [esp + eax - 0x77aef7b], dl
inc eax
dec ecx
cmp eax, 0x77aefbb
jne 0x4333f0
lea edi, [esp + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x40]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x68]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x433653
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x433649
cmp eax, 1
je 0x433649
cmp dword [esp + 0x5c], 0
je 0x433649
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x37cb39d7
mov dword [esp + 0xc], 0x33cb35ba
mov dword [esp + 0x10], 0xcf3a31d1
mov dword [esp + 0x14], 0xcb47cd1e
mov dword [esp + 0x18], 0xc738c93d
mov dword [esp + 0x1c], 0xc34cc539
mov dword [esp + 0x20], 0xc1c0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
mov eax, ecx
and eax, 0x14
mov esi, ecx
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, eax
or eax, 2
imul eax, esi
mov edi, ecx
xor edi, 0x74f0c776
add edi, ebx
add edi, eax
mov eax, edi
and eax, edx
mov ebx, eax
or ebx, 0xfffffffd
inc ebx
mov esi, eax
and esi, 0xfffffffd
imul esi, ebx
mov ebx, eax
and ebx, 2
or eax, 2
imul eax, ebx
sub esi, eax
add edi, edx
add edi, esi
mov eax, edi
and eax, 0x31
add eax, eax
xor edi, 0x4e
sub eax, edi
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x1c
jne 0x4334f0
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea edi, [esp + 0x18]
push edi
push ecx
call dword [eax + 0x10]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x433638
cmp word [esp + 0x70], 8
jne 0x433638
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 4], eax
je 0x4335cd
add eax, 2
xor edi, edi
jmp 0x4335ac
inc edi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4335cf
cmp cx, 0x7f
jbe 0x4335a0
movzx edx, cx
cmp edx, 0x7ff
ja 0x4335c2
add edi, 2
jmp 0x4335a1
cmp cx, 0xffff
je 0x4335a1
add edi, 3
jmp 0x4335a1
xor edi, edi
lea esi, [edi + 1]
push esi
call fcn.00408a60
add esp, 4
push dword [esp + 4]
push esi
mov dword [esp + 0xc], eax
push eax
call fcn.00420a10
add esp, 0xc
mov eax, 3
sub eax, edi
cmp eax, 0xfffffffd
jae 0x4335fe
mov eax, 0xfffffffc
add eax, edi
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x70]
jb 0x433611
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov edi, dword [esp + 8]
push edi
lea eax, [esp + 0x50]
push eax
call fcn.00408a90
add esp, 0xc
push edi
call fcn.00408a70
add esp, 4
lea edi, [esp + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 0x84]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 8], 0
push 0x72a7c387
push dword [0x449614]
call fcn.0043bcb0
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push esi
call eax
test eax, eax
je 0x4337fe
imul eax, dword [esp + 8], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x48], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.00419fd0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4336f0
test esi, esi
je 0x43370e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408ae0
add esp, 0xc
lea eax, [ebx + 8]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x48], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.00419fd0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433740
test esi, esi
je 0x43375e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408ae0
add esp, 0xc
lea eax, [ebx + 0x10]
xor ecx, ecx
cmp dword [esp + 0x50], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x4c], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x50], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.00419fd0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433790
test esi, esi
je 0x4337ae
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408ae0
add esp, 0xc
add ebx, 0x18
xor eax, eax
cmp dword [esp + 0x54], 0
setne al
imul eax, dword [esp + eax*4 + 0x50], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.00419fd0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4337e0
test esi, esi
je 0x4337fe
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408ae0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret