Function at 0x438040
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using base64
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44d394]
mov dword [esp + 0x20], 0x519b4f6b
mov dword [esp + 0x24], 0x55a753ab
mov dword [esp + 0x28], 0x59b157a0
mov dword [esp + 0x2c], 0x5d9e5bb7
mov dword [esp + 0x30], 0x61b55fae
mov dword [esp + 0x34], 0x65856396
mov dword [esp + 0x38], 0x69666743
mov ecx, 0xd
mov edx, 0xf2
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x13]
lea esi, [ebx + ebx]
not esi
add esi, ebx
and esi, ecx
and ebx, edx
or ebx, esi
add bl, 0xbf
mov byte [esp + ecx + 0x13], bl
inc ecx
dec edx
cmp ecx, 0x29
jne 0x4380a0
lea ecx, [esp + 4]
lea ebx, [esp + 0x84]
lea esi, [esp + 0x20]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x4380e9
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x10], 0x10f8d45
mov dword [esp + 0xc], 0x8e6253c5
mov dword [esp + 8], 0xe09077ae
mov dword [esp + 4], 0xc3e0674f
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
push 0x443678
push 1
push 0
push 0x443688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43864b
mov dword [esp + 0x20], 0x13451142
mov dword [esp + 0x24], 0x6fc26d3b
mov dword [esp + 0x28], 0x6b2969cc
mov dword [esp + 0x2c], 0x6733653d
mov dword [esp + 0x30], 0x631061ce
mov dword [esp + 0x34], 0x7d7c
mov byte [esp + 0x38], 0
mov eax, 0x43
mov ecx, esi
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
mov edx, eax
or edx, esi
mov edi, esi
not edi
or edi, eax
add esi, edi
inc esi
not edx
or edx, esi
add dl, 0x54
mov byte [ecx], dl
inc ecx
dec eax
cmp eax, 0x2a
jne 0x438180
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi]
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], eax
push eax
push edi
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
js 0x438633
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x34]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x438629
mov dword [esp + 0x20], 0xe155e74d
mov dword [esp + 0x24], 0xdde2e354
mov word [esp + 0x28], 0
mov byte [esp + 0x2a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x20]
mov edi, eax
and edi, 7
xor edi, 0xb1b3a327
mov ecx, eax
and ecx, 8
sub ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0x42
add edx, edx
xor ecx, 0x3d
sub edx, ecx
mov byte [esp + eax + 0x20], dl
inc eax
cmp eax, 0xb
jne 0x438220
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 0x20], 0xf931fb01
mov dword [esp + 0x24], 0xe52de70c
mov dword [esp + 0x28], 0xe11ee329
mov dword [esp + 0x2c], 0xed38efc0
mov dword [esp + 0x30], 0xe920ebcc
mov dword [esp + 0x34], 0x95679716
mov dword [esp + 0x38], 0x91b29367
mov dword [esp + 0x3c], 0x9d099f69
mov dword [esp + 0x40], 0x99479b0e
mov dword [esp + 0x44], 0x85678746
mov dword [esp + 0x48], 0x8175834a
mov dword [esp + 0x4c], 0x8d738f71
mov dword [esp + 0x50], 0x8b8c
mov eax, 0x7bb79d4
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi]
mov ecx, eax
or ecx, edx
lea edi, [eax - 0x7bb7900]
and edi, edx
not ecx
or ecx, edi
add ecx, 0x19905618
mov edx, ecx
and edx, 0x28
xor ecx, 0x28
lea ecx, [ecx + edx*2]
add cl, 0xe9
mov byte [esi], cl
inc esi
dec eax
cmp eax, 0x7bb79a0
jne 0x4382d0
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x18]
mov ecx, dword [edi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x68]
push edi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
js 0x438617
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea edi, [esp + 0x60]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43860a
cmp eax, 1
je 0x43860a
cmp dword [esp + 0x5c], 0
je 0x43860a
lea edi, [esp + 0x70]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], 0x83278153
mov dword [esp + 0x24], 0x872f8536
mov dword [esp + 0x28], 0x8b268929
mov dword [esp + 0x2c], 0x8f3b8d42
mov dword [esp + 0x30], 0x9330913d
mov dword [esp + 0x34], 0x97249531
mov word [esp + 0x38], 0x9998
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
or dl, 0xe0
xor dl, byte [esp + ecx + 0x20]
add dl, 0xa0
mov byte [esp + ecx + 0x20], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x20
jb 0x4383d0
mov ecx, dword [eax]
push 0
push 0
push edi
push 0
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4385f9
cmp word [esp + 0x70], 8
jne 0x4385f9
mov esi, dword [esp + 0x78]
movzx ebx, word [esi]
test bx, bx
je 0x438465
lea eax, [esi + 2]
xor edi, edi
mov ecx, ebx
jmp 0x43843c
inc edi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x438467
cmp cx, 0x7f
jbe 0x438430
movzx edx, cx
cmp edx, 0x7ff
ja 0x438452
add edi, 2
jmp 0x438431
cmp cx, 0xffff
je 0x438431
mov ecx, edi
and ecx, 3
xor edi, 3
lea edi, [edi + ecx*2]
jmp 0x438431
xor edi, edi
lea eax, [edi + 1]
push eax
call fcn.004095a0
add esp, 4
mov ecx, edi
mov dword [esp + 0x14], eax
mov edi, eax
mov dword [esp + 0x54], ecx
test ecx, ecx
je 0x4385a4
mov edi, dword [esp + 0x14]
test bx, bx
je 0x4385a4
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x14]
nop
nop
nop
nop
movzx ebx, bx
lea edx, [esi + 2]
cmp bx, 0x7f
ja 0x4384c0
mov byte [edi], bl
lea eax, [edi + 1]
jmp 0x438550
cmp ebx, 0x7ff
ja 0x4384e4
cmp ecx, 2
jb 0x4384e4
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [edi], al
and bl, 0x3f
or bl, 0x80
lea eax, [edi + 2]
mov byte [edi + 1], bl
jmp 0x438550
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x43856a
cmp ecx, 4
jb 0x43856a
movzx edx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + edx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [edi], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [edi + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 2], al
mov ebx, 0xff
sub ebx, edx
or ebx, 0x3f
add ebx, edx
add bl, 0x81
lea eax, [edi + 4]
mov byte [edi + 3], bl
mov edx, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add ecx, edi
sub ecx, eax
mov esi, edx
mov edi, eax
movzx ebx, word [esi]
test bx, bx
je 0x4385a4
test ecx, ecx
jne 0x4384a0
jmp 0x4385a4
movzx eax, ax
cmp eax, 0xdc00
jne 0x438578
mov esi, edx
jmp 0x438558
cmp ecx, 3
jb 0x4385a0
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [edi], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 1], al
and bl, 0x3f
or bl, 0x80
mov byte [edi + 2], bl
lea eax, [edi + 3]
jmp 0x438550
mov eax, edi
jmp 0x438550
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x54]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x4385bc
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
lea ebx, [esp + 0x84]
lea edi, [esp + 0x70]
jb 0x4385d6
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov esi, dword [esp + 0x18]
push esi
lea eax, [esp + 0xc]
push eax
call fcn.004095d0
add esp, 0xc
push esi
call fcn.004095b0
add esp, 4
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push dword [esp + 0x68]
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x20]
push 0xbeb8f1a1
push dword [0x44c38c]
call fcn.0043f980
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x43867a
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 4], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041ecc0
add esp, 0x10
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4386c0
test esi, esi
je 0x4386de
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00409730
add esp, 0xc
xor eax, eax
cmp dword [esp + 8], 0
setne al
mov eax, dword [esp + eax*4 + 4]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 8]
mov dword [esp + 8], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041ecc0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438730
test esi, esi
je 0x43874e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00409730
add esp, 0xc
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
mov eax, dword [esp + eax*4 + 8]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 0x10]
mov dword [esp + 0xc], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041ecc0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4387a0
test esi, esi
je 0x4387be
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00409730
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x10], 0
setne al
mov eax, dword [esp + eax*4 + 0xc]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 0x10], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041ecc0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438810
test esi, esi
je 0x43882e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00409730
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret