Function at 0x4381a0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x44be2c]
mov dword [esp + 0x10], 0xcf79c92d
mov dword [esp + 0x14], 0xc355cd45
mov dword [esp + 0x18], 0xc763c154
mov dword [esp + 0x1c], 0xbb7ec559
mov dword [esp + 0x20], 0xbf27b92e
mov dword [esp + 0x24], 0xb317bd36
mov dword [esp + 0x28], 0xb7b6b155
mov byte [esp + 0x2c], 0
mov ecx, 0x33019432
mov edx, 0xccfe6bcd
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x33019422]
lea edi, [edx + 0x40000000]
and edi, 0x8126a5c
mov ebx, ecx
and ebx, 0x31019423
or ebx, edi
lea edi, [esi + esi]
not edi
add edi, esi
xor ebx, 0xf5ed95a3
not esi
and esi, ebx
or edi, edx
not edi
or edi, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
add bl, 6
mov byte [esp + ecx - 0x33019422], bl
inc ecx
dec edx
cmp ecx, 0x3301944f
jne 0x438200
mov esi, esp
lea ecx, [esp + 0x84]
lea edi, [esp + 0x10]
push esi
push 8
push ecx
push 0xd
push edi
push 0
call eax
test eax, eax
jns 0x438277
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0xc], 0x695d8aeb
mov dword [esp + 8], 0xe2590fb5
mov dword [esp + 4], 0x53700b61
mov dword [esp], 0x9e6bf33a
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x4c]
push eax
push 0x442668
push 1
push 0
push 0x442678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x4386f4
mov dword [esp + 0x10], 0x93c591c2
mov dword [esp + 0x14], 0xafc2adfb
mov dword [esp + 0x18], 0xabe9a9cc
mov dword [esp + 0x1c], 0xa7f3a5fd
mov dword [esp + 0x20], 0xa390a1ce
mov word [esp + 0x24], 0xbdbc
mov dword [esp + 0x26], 0
mov byte [esp + 0x2a], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x9c
xor cl, byte [esp + eax + 0x10]
add cl, 0xf4
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x1b
jne 0x438310
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], edi
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
lea edi, [esp + 0x10]
js 0x4386e0
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x64]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4386d6
mov dword [esp + 0x10], 0x39853b85
mov dword [esp + 0x14], 0x2526278c
mov word [esp + 0x18], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x10]
lea ecx, [eax - 0x4856d4f5]
xor ecx, edx
mov edx, ecx
not edx
and ecx, 0xc8
and edx, 0x37
sub ecx, edx
mov byte [esp + eax + 0x10], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xa
jb 0x4383a0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x50], eax
mov dword [esp + 0x10], 0x79317b01
mov dword [esp + 0x14], 0x652d670c
mov dword [esp + 0x18], 0x611e6329
mov dword [esp + 0x1c], 0x6d386f40
mov dword [esp + 0x20], 0x69206b4c
mov dword [esp + 0x24], 0x95e79716
mov dword [esp + 0x28], 0x91b293e7
mov dword [esp + 0x2c], 0x9d099fe9
mov dword [esp + 0x30], 0x99c79b0e
mov dword [esp + 0x34], 0x85e787c6
mov dword [esp + 0x38], 0x81f583ca
mov dword [esp + 0x3c], 0x8df38ff1
mov word [esp + 0x40], 0x8b8c
mov dword [esp + 0x42], 0
mov ecx, 0xf5ecac6a
mov eax, 0xa135394
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + 1]
mov esi, edx
or esi, 0x21273505
lea edi, [eax + esi]
add edi, 0xf5ecb001
mov ebx, ecx
sub ebx, esi
mov esi, eax
or esi, ebx
and ebx, 0x84583ad0
and edi, 0x52f
or edi, ebx
mov ebx, eax
or ebx, 0x33000
and ebx, 0xa1372fa
xor ebx, edi
not esi
xor ebx, 0x5a80c02a
and esi, 0xded8cafa
or esi, ebx
movzx edi, byte [esp + ecx + 0xa1353a6]
xor esi, edi
mov edi, esi
and edi, 0x68
xor esi, 0x134794ed
lea ebx, [esi + edi*2]
and esi, 1
or ebx, 1
add ebx, esi
mov byte [esp + ecx + 0xa1353a6], bl
dec eax
mov ecx, edx
cmp edx, 0xf5ecaca0
jne 0x438460
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x48]
mov ecx, dword [esi]
lea edx, [esp + 0x5c]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x60]
push esi
call dword [ecx + 0x50]
test eax, eax
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x10]
js 0x4386c2
mov dword [esp + 0x54], 0
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
lea esi, [esp + 0x58]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4386b8
cmp eax, 1
je 0x4386b8
cmp dword [esp + 0x54], 0
je 0x4386b8
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], 0x91399f29
mov dword [esp + 0x14], 0x95099302
mov dword [esp + 0x18], 0x890a9737
mov dword [esp + 0x1c], 0x8d1d8b36
mov dword [esp + 0x20], 0x812c8f13
mov dword [esp + 0x24], 0x85108327
mov dword [esp + 0x28], 0x8784
mov ecx, 0x428b0025
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x428b0015]
xor edx, ecx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0x46
mov byte [esp + ecx - 0x428b0015], dl
inc ecx
cmp ecx, 0x428b0041
jne 0x4385a0
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea edx, [esp + 0x20]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4386a7
cmp word [esp + 0x70], 8
jne 0x4386a7
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x64], eax
je 0x438645
add eax, 2
xor esi, esi
jmp 0x43861c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x438647
cmp cx, 0x7f
jbe 0x438610
movzx edx, cx
cmp edx, 0x7ff
ja 0x43863a
mov ecx, esi
xor ecx, 2
and esi, 2
lea esi, [ecx + esi*2]
jmp 0x438611
cmp cx, 0xffff
je 0x438611
add esi, 3
jmp 0x438611
xor esi, esi
lea eax, [esi + 1]
mov dword [esp + 0x60], eax
push eax
call fcn.004082d0
add esp, 4
mov edi, eax
push dword [esp + 0x64]
push dword [esp + 0x64]
push eax
call fcn.004278e0
add esp, 0xc
mov eax, dword [edi]
mov dword [esp], eax
and esi, 0xfffffffc
cmp esi, 4
je 0x438696
mov eax, dword [edi + 4]
mov dword [esp + 4], eax
cmp esi, 8
je 0x438696
mov eax, dword [edi + 8]
mov dword [esp + 8], eax
cmp esi, 0xc
je 0x438696
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], eax
push edi
call fcn.004082e0
add esp, 4
lea edi, [esp + 0x10]
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x50]
call esi
push dword [esp + 0x68]
call esi
mov esi, esp
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44be24]
call fcn.0043e580
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x438724
mov esi, edi
imul eax, dword [esi], 0x1a5845
add eax, 0xebde8a13
mov dword [esp], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.0041fb40
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438750
test esi, esi
je 0x43876e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408360
add esp, 0xc
lea eax, [ebx + 8]
xor ecx, ecx
cmp dword [esp + 4], 0
setne cl
imul ecx, dword [esp + ecx*4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 4], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041fb40
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4387a0
test esi, esi
je 0x4387be
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408360
add esp, 0xc
lea eax, [ebx + 0x10]
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
imul ecx, dword [esp + ecx*4 + 4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 8], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041fb40
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4387f0
test esi, esi
je 0x43880e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408360
add esp, 0xc
add ebx, 0x18
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
imul eax, dword [esp + eax*4 + 8], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.0041fb40
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438840
test esi, esi
je 0x43885e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408360
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret