Function at 0x437250
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44bccc]
mov dword [esp + 0x14], 0x15b072b
mov dword [esp + 0x18], 0xd7f037b
mov dword [esp + 0x1c], 0x9610f70
mov dword [esp + 0x20], 0x15460b7f
mov dword [esp + 0x24], 0x117d1766
mov dword [esp + 0x28], 0x1d7d136e
mov dword [esp + 0x2c], 0x191e1f33
mov word [esp + 0x30], 0
mov ecx, 1
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x13]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xfb
mov byte [esp + ecx + 0x13], dl
inc ecx
cmp ecx, 0x1f
jne 0x4372b0
mov ebx, esp
lea ecx, [esp + 0x84]
lea esi, [esp + 0x14]
push ebx
push 8
push ecx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x4372f6
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0xc], 0x18256285
mov dword [esp + 8], 0x9ebb5b1a
mov dword [esp + 4], 0xcf240b93
mov dword [esp], 0xf7fb5e23
mov dword [esp + 0x50], 0
lea eax, [esp + 0x50]
push eax
push 0x442678
push 1
push 0
push 0x442688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x437878
mov dword [esp + 0x14], 0x21772776
mov dword [esp + 0x18], 0x3d8e2371
mov dword [esp + 0x1c], 0x39633f98
mov dword [esp + 0x20], 0x356d3b63
mov dword [esp + 0x24], 0x3144379a
mov dword [esp + 0x28], 0x3330
xor eax, eax
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x14]
lea edx, [eax + 0x5fe97889]
and edx, ecx
add edx, edx
neg edx
add edx, eax
add edx, 0x5fe97889
add dl, cl
add dl, 0x53
mov byte [esp + eax + 0x14], dl
add eax, 0x81d955ea
mov ecx, eax
xor ecx, 0x81d955e9
and eax, 0x216
add eax, eax
sub eax, ecx
cmp eax, 0x18
jb 0x437380
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], esi
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x437860
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x437856
mov dword [esp + 0x14], 0xd98ddbad
mov dword [esp + 0x18], 0xdddedf84
mov byte [esp + 0x1c], 0
xor eax, eax
xor ecx, ecx
nop
nop
movzx edx, byte [esp + ecx + 0x14]
mov edi, ecx
xor edi, 0xf999b5cf
add edi, eax
xor edi, edx
mov edx, edi
and edx, 0x74
xor edi, 0xf4
lea edx, [edi + edx*2]
inc dl
mov byte [esp + ecx + 0x14], dl
inc ecx
add eax, 2
cmp ecx, 9
jne 0x437430
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x14], 0xff3bf90f
mov dword [esp + 0x18], 0xe327fd30
mov dword [esp + 0x1c], 0xe712e127
mov dword [esp + 0x20], 0xebc4e5c4
mov dword [esp + 0x24], 0xef24e9c8
mov dword [esp + 0x28], 0x9361ed1a
mov dword [esp + 0x2c], 0x97b6915d
mov dword [esp + 0x30], 0x9b73956f
mov dword [esp + 0x34], 0x9f49990a
mov dword [esp + 0x38], 0x83619d4a
mov dword [esp + 0x3c], 0x874f8146
mov dword [esp + 0x40], 0x8b7d8577
mov word [esp + 0x44], 0x8988
mov dword [esp + 0x46], 0
mov eax, 0x39d2c82a
mov ecx, 0xd5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x39d2c816]
lea ebx, [ecx - 0xd0]
and ebx, 5
mov edi, eax
and edi, 0x7a
or edi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
xor edi, 0x7a
or edi, ecx
and edi, edx
not edx
and edx, eax
and edx, ebx
add edi, edx
mov edx, edi
and edx, 0x2d
xor edi, 0x2d
lea edx, [edi + edx*2]
inc dl
mov byte [esp + eax - 0x39d2c816], dl
inc eax
dec ecx
cmp eax, 0x39d2c860
jne 0x4374f0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x4c]
mov ecx, dword [edi]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
mov dword [esp + 0x70], eax
push eax
mov dword [esp + 0x78], esi
push esi
push edi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
mov ebx, esp
js 0x437844
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea edi, [esp + 0x5c]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437837
cmp eax, 1
je 0x437837
cmp dword [esp + 0x58], 0
je 0x437837
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], 0x89318b21
mov dword [esp + 0x18], 0x85318706
mov dword [esp + 0x1c], 0x8136833b
mov dword [esp + 0x20], 0x9d159f52
mov dword [esp + 0x24], 0x99249b2f
mov dword [esp + 0x28], 0x95189723
mov word [esp + 0x2c], 0x9394
mov dword [esp + 0x2e], 0
mov byte [esp + 0x32], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x63
xor dl, byte [esp + ecx + 0x14]
add dl, 0x11
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 0x1f
jne 0x437610
mov ecx, dword [eax]
push 0
push 0
push esi
push 0
lea edx, [esp + 0x24]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437826
cmp word [esp + 0x70], 8
jne 0x437826
mov ebx, dword [esp + 0x78]
movzx ecx, word [ebx]
test cx, cx
je 0x43768d
lea eax, [ebx + 2]
xor esi, esi
jmp 0x43766c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43768f
cmp cx, 0x7f
jbe 0x437660
movzx edx, cx
cmp edx, 0x7ff
ja 0x437682
add esi, 2
jmp 0x437661
cmp cx, 0xffff
je 0x437661
add esi, 3
jmp 0x437661
xor esi, esi
mov dword [esp + 0x54], esi
lea eax, [esi + 1]
push eax
call fcn.00409550
add esp, 4
mov edi, eax
movzx edx, word [ebx]
mov dword [esp + 0x10], eax
test dx, dx
je 0x4377d8
mov ecx, dword [esp + 0x54]
lea eax, [ecx*2 + 2]
sub eax, ecx
mov edi, dword [esp + 0x10]
add eax, 0xfffffffe
je 0x4377d8
mov edi, dword [esp + 0x10]
nop
movzx edx, dx
lea esi, [ebx + 2]
cmp dx, 0x7f
ja 0x4376f0
mov byte [edi], dl
lea ecx, [edi + 1]
jmp 0x437780
cmp edx, 0x7ff
ja 0x437715
cmp eax, 2
jb 0x437715
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [edi], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [edi + 2]
mov byte [edi + 1], dl
jmp 0x437780
mov ecx, edx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x43779a
cmp eax, 4
jb 0x43779a
movzx esi, word [ebx + 2]
add ebx, 4
shl edx, 0xa
lea ecx, [edx + esi]
add ecx, 0xfca02400
mov edx, ecx
shr edx, 0x12
add dl, 0xf0
mov byte [edi], dl
mov edx, ecx
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [edi + 1], dl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 2], cl
mov ecx, esi
and cl, 0x3f
or cl, 0x80
mov edx, ecx
lea ecx, [edi + 4]
mov byte [edi + 3], dl
mov esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
sub eax, ecx
mov ebx, esi
mov edi, ecx
movzx edx, word [ebx]
test dx, dx
je 0x4377d8
test eax, eax
jne 0x4376d0
jmp 0x4377d8
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x4377a9
mov ebx, esi
jmp 0x437788
cmp eax, 3
jb 0x4377d4
mov ecx, edx
shr ecx, 0xc
or cl, 0xe0
mov byte [edi], cl
mov ecx, edx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [edi + 3]
mov byte [edi + 2], dl
jmp 0x437780
mov ecx, edi
jmp 0x437780
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x54]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x4377f0
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
mov ebx, esp
lea esi, [esp + 0x70]
jb 0x437805
mov eax, 3
lea eax, [eax*4 + 4]
mov ecx, esp
push eax
mov edi, dword [esp + 0x14]
push edi
push ecx
call fcn.00409580
add esp, 0xc
push edi
call fcn.00409560
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x68]
call esi
push dword [esp + 0x64]
call esi
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x14]
push 0xbeb8f1a1
push dword [0x44acc4]
call fcn.0043e290
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x4378a8
mov ebx, esi
imul eax, dword [ebx], 0x1a5845
add eax, 0xebde8a13
mov dword [esp], eax
mov esi, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.0041e430
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x4378d0
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x4378fa
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.004096e0
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 4], 0
setne cl
imul ecx, dword [esp + ecx*4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 4], ecx
mov esi, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041e430
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x437930
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x43795a
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.004096e0
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
imul ecx, dword [esp + ecx*4 + 4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 8], ecx
mov esi, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041e430
add esp, 0x10
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x437990
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x4379ba
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.004096e0
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
imul eax, dword [esp + eax*4 + 8], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.0041e430
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x4379f0
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x437a1a
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.004096e0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret