Function at 0x43a140
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44e0bc]
mov dword [esp + 0x18], 0x912b9f7b
mov dword [esp + 0x1c], 0x9507931b
mov dword [esp + 0x20], 0x89319700
mov dword [esp + 0x24], 0x8d4e8b17
mov dword [esp + 0x28], 0x81158f1e
mov dword [esp + 0x2c], 0x85258316
mov dword [esp + 0x30], 0x79868763
mov dword [esp + 0x34], 0
mov ecx, 0x83506565
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x7caf9ab3]
xor edx, ecx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 6
mov byte [esp + ecx + 0x7caf9ab3], dl
inc ecx
cmp ecx, 0x83506585
jne 0x43a1a0
lea ebx, [esp + 8]
lea ecx, [esp + 0x84]
lea esi, [esp + 0x18]
push ebx
push 8
push ecx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x43a1f0
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x14], 0xc65bfc44
mov dword [esp + 0x10], 0x31df0c74
mov dword [esp + 0xc], 0xe52fee50
mov dword [esp + 8], 0xa516cb61
mov dword [esp + 0x54], 0
lea eax, [esp + 0x54]
push eax
push 0x444668
push 1
push 0
push 0x444678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43a657
mov dword [esp + 0x18], 0xb9cbbbf2
mov dword [esp + 0x1c], 0xbdcabfc9
mov dword [esp + 0x20], 0xb1f7b3d0
mov dword [esp + 0x24], 0xb5c5b7cf
mov dword [esp + 0x28], 0xa9fcabde
mov dword [esp + 0x2c], 0xafa8
mov byte [esp + 0x30], 0
lea eax, [esp + 0x18]
mov ecx, 0xe0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x3dabb100]
or esi, edx
not esi
and edx, ecx
or edx, esi
mov ebx, 1
sub ebx, edx
mov esi, 0x345a709b
sub esi, edx
add edx, edx
and edx, 2
and ebx, 1
and esi, 0xfffffffe
or esi, ebx
xor esi, 0xfffffffe
mov ebx, esi
and ebx, edx
xor esi, edx
lea edx, [esi + ebx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xc7
jne 0x43a290
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x54]
mov ecx, dword [esi]
lea edx, [esp + 0x50]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
lea ebx, [esp + 8]
lea esi, [esp + 0x18]
js 0x43a643
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x6c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43a639
mov dword [esp + 0x18], 0xf1bd0fb5
mov dword [esp + 0x1c], 0xf5f2f33c
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x7d
xor cl, byte [esp + eax + 0x18]
add cl, 0x8f
mov byte [esp + eax + 0x18], cl
mov ecx, eax
xor ecx, 0xff8a0c8b
and eax, 3
lea eax, [ecx + eax*2]
add eax, 0x75f376
cmp eax, 8
jb 0x43a350
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 0x18], 0xe159e749
mov dword [esp + 0x1c], 0xdd5de354
mov dword [esp + 0x20], 0xd972df61
mov dword [esp + 0x24], 0xd580dbb8
mov dword [esp + 0x28], 0xd168d7b4
mov dword [esp + 0x2c], 0xcd63d362
mov dword [esp + 0x30], 0xc9aecf7b
mov dword [esp + 0x34], 0xc551cb61
mov dword [esp + 0x38], 0xc18bc752
mov dword [esp + 0x3c], 0x3d63c392
mov dword [esp + 0x40], 0x39853f7e
mov dword [esp + 0x44], 0x35973b89
mov word [esp + 0x48], 0x3734
mov dword [esp + 0x4a], 0
mov byte [esp + 0x4e], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x59
xor cl, byte [esp + eax + 0x18]
add cl, 0x43
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x37
jne 0x43a400
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x50]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x68]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x43a623
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43a619
cmp eax, 1
je 0x43a619
cmp dword [esp + 0x5c], 0
je 0x43a619
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 0x18], 0xb7db89f7
mov dword [esp + 0x1c], 0xb3dbb52a
mov dword [esp + 0x20], 0xbf2ab1d1
mov dword [esp + 0x24], 0xbb27bdce
mov dword [esp + 0x28], 0xa7c8b92d
mov dword [esp + 0x2c], 0xa33ca5c9
mov dword [esp + 0x30], 0xa1a0
mov byte [esp + 0x34], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x18]
lea esi, [ecx - 0x3602e462]
mov ebx, esi
and ebx, edx
lea eax, [ecx + edx]
add eax, 0xc9fd1b9e
not eax
lea eax, [eax + ebx*2]
and eax, esi
add eax, eax
neg eax
add eax, ecx
add eax, 0xc9fd1b9e
add al, dl
add al, 0xea
mov byte [esp + ecx + 0x18], al
mov eax, ecx
and eax, 1
xor ecx, 1
lea ecx, [ecx + eax*2]
cmp ecx, 0x1d
jb 0x43a4e0
mov edx, dword [esp + 4]
mov eax, dword [edx]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [eax + 0x10]
test eax, eax
lea ebx, [esp + 8]
js 0x43a608
cmp word [esp + 0x70], 8
jne 0x43a608
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 4], eax
je 0x43a59d
add eax, 2
xor esi, esi
jmp 0x43a57c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43a59f
cmp cx, 0x7f
jbe 0x43a570
movzx edx, cx
cmp edx, 0x7ff
ja 0x43a592
add esi, 2
jmp 0x43a571
cmp cx, 0xffff
je 0x43a571
add esi, 3
jmp 0x43a571
xor esi, esi
lea ebx, [esi + 1]
push ebx
call fcn.004083f0
add esp, 4
push dword [esp + 4]
push ebx
mov dword [esp + 0xc], eax
push eax
call fcn.0042f580
add esp, 0xc
mov eax, 3
sub eax, esi
cmp eax, 0xfffffffd
jae 0x43a5ce
mov eax, 0xfffffffc
add eax, esi
shr eax, 2
cmp eax, 3
lea ebx, [esp + 8]
jb 0x43a5e1
mov eax, 3
lea eax, [eax*4 + 4]
lea ecx, [esp + 8]
push eax
mov esi, dword [esp + 8]
push esi
push ecx
call fcn.00408420
add esp, 0xc
push esi
call fcn.00408400
add esp, 4
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 0x18]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44e0b4]
call fcn.00440990
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x43a687
mov ebx, esi
imul eax, dword [ebx], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 8], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.004205a0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x43a6b0
test esi, esi
je 0x43a6ce
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408470
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0xc], 0
setne cl
imul ecx, dword [esp + ecx*4 + 8], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0xc], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.004205a0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x43a700
test esi, esi
je 0x43a71e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408470
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x10], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0xc], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x10], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.004205a0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x43a750
test esi, esi
je 0x43a76e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408470
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x14], 0
setne al
imul eax, dword [esp + eax*4 + 0x10], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.004205a0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x43a7a0
test esi, esi
je 0x43a7be
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408470
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret