Function at 0x4377a0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44cf8c]
mov dword [esp + 8], 0x23f121c5
mov dword [esp + 0xc], 0x279525ad
mov dword [esp + 0x10], 0x3b9f398c
mov dword [esp + 0x14], 0x3ffa3d81
mov dword [esp + 0x18], 0x338b3182
mov dword [esp + 0x1c], 0x37933582
mov dword [esp + 0x20], 0xb0a09ed
mov ecx, 0xcd899448
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x32766bc0]
xor edx, ecx
add edx, 0xfc501a97
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx + 0x32766bc0], dl
inc ecx
cmp ecx, 0xcd899464
jne 0x437800
lea ecx, [esp + 0x48]
lea esi, [esp + 0x84]
lea ebx, [esp + 8]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x437854
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
lea eax, [esp + 0x44]
push eax
push 0x444aa8
push 1
push 0
push 0x444ab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x437ea4
mov dword [esp + 8], 0x297b2b72
mov dword [esp + 0xc], 0x2d7a2f79
mov dword [esp + 0x10], 0x31773370
mov dword [esp + 0x14], 0x3565377f
mov dword [esp + 0x18], 0x394c3b6e
mov word [esp + 0x1c], 0x3f38
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 8]
lea edx, [ecx - 0x198e6f9]
mov edi, esi
and edx, 0xb406103f
mov ebx, edx
xor ebx, 0x4a6109bf
or esi, 0x4a610900
and esi, ebx
xor edi, 0xb406103f
or edx, 0x1100440
and edx, edi
or edx, esi
mov esi, edx
xor esi, 0x24
and edx, 0x5b
add edx, edx
sub edx, esi
inc dl
mov byte [esp + ecx + 8], dl
and eax, 1
not ecx
or ecx, 1
sub eax, ecx
mov ecx, eax
cmp eax, 0x1b
jb 0x4378f0
lea ebx, [esp + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x44]
mov ecx, dword [esi]
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
lea esi, [esp + 0x84]
js 0x437e90
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x5c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x437e86
mov dword [esp + 8], 0x29fd2bfd
mov dword [esp + 0xc], 0x2d2e2fe4
mov byte [esp + 0x10], 0
mov eax, 0x6210b447
movzx ecx, byte [esp + eax - 0x6210b43f]
mov edx, eax
and edx, ecx
mov edi, edx
or edi, 0xfffffffd
inc edi
mov esi, edx
and esi, 0x5d
imul esi, edi
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
add esi, ecx
sub esi, edx
add ecx, eax
add esi, eax
and ecx, 1
xor esi, 1
lea ecx, [esi + ecx*2]
add cl, 0x9c
mov byte [esp + eax - 0x6210b43f], cl
inc eax
cmp eax, 0x6210b450
jne 0x4379c0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 8], 0x135f1163
mov dword [esp + 0xc], 0x1f531d68
mov dword [esp + 0x10], 0x1b66195b
mov dword [esp + 0x14], 0x72c0524
mov dword [esp + 0x18], 0x34c0120
mov dword [esp + 0x1c], 0xf790d7e
mov dword [esp + 0x20], 0xb2a097d
mov dword [esp + 0x24], 0x375f354b
mov dword [esp + 0x28], 0x336131a6
mov dword [esp + 0x2c], 0x3f593d6e
mov dword [esp + 0x30], 0x3b73397a
mov dword [esp + 0x34], 0x27552553
mov dword [esp + 0x38], 0x2120
mov eax, 0x42909904
mov ecx, 0xbd6f66fb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], ecx
movzx edx, byte [esp + eax - 0x429098fc]
lea edi, [ecx + 0x42909980]
and edi, 0x6e
mov esi, eax
and esi, 0x11
or esi, edi
xor esi, ecx
xor esi, 0x6e
and esi, ecx
mov edi, eax
or edi, edx
not edx
or edx, esi
and edx, edi
add edx, 0xe624e4f6
mov esi, edx
and esi, 0x332d02eb
xor edx, 0xb32d02eb
lea ebx, [edx + esi*2]
mov esi, 0xe624e4f5
sub esi, ebx
or esi, 1
add esi, ebx
add esi, 0x19db1b0b
mov ecx, esi
and ecx, 2
mov edi, esi
or esi, 2
imul esi, ecx
xor ecx, 2
and edi, 0xfd
imul edi, ecx
mov ecx, 1
sub ecx, edx
and ecx, 1
and ebx, 0xfe
or ebx, ecx
mov ecx, dword [esp + 4]
add ebx, esi
add ebx, edi
add bl, 0xa
mov byte [esp + eax - 0x429098fc], bl
inc eax
dec ecx
cmp eax, 0x42909938
jne 0x437a90
lea ebx, [esp + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x40]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x68]
push esi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
js 0x437e6d
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437e63
cmp eax, 1
je 0x437e63
cmp dword [esp + 0x5c], 0
je 0x437e63
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [esp + 0x60]
mov dword [esp + 8], 0x8f2b89df
mov dword [esp + 0xc], 0x833b8d3a
mov dword [esp + 0x10], 0x873a8121
mov dword [esp + 0x14], 0x9b2f85d6
mov dword [esp + 0x18], 0x9f389925
mov dword [esp + 0x1c], 0x93249d39
mov dword [esp + 0x20], 0x9190
mov esi, 0xc7f959a2
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi + 0x3806a666]
mov eax, edx
xor eax, esi
lea ebx, [eax + eax]
not ebx
add ebx, eax
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0xd6
mov byte [esp + esi + 0x3806a666], al
inc esi
cmp esi, 0xc7f959be
jne 0x437bf0
mov eax, dword [edi]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea ebx, [esp + 0x18]
push ebx
push edi
call dword [eax + 0x10]
test eax, eax
js 0x437e4f
cmp word [esp + 0x70], 8
jne 0x437e4f
mov esi, dword [esp + 0x78]
movzx edi, word [esi]
test di, di
je 0x437cb1
lea eax, [esi + 2]
mov dword [esp], 0
mov ecx, edi
jmp 0x437c8e
inc dword [esp]
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x437cb8
cmp cx, 0x7f
jbe 0x437c80
movzx edx, cx
cmp edx, 0x7ff
ja 0x437ca5
add dword [esp], 2
jmp 0x437c83
cmp cx, 0xffff
je 0x437c83
add dword [esp], 3
jmp 0x437c83
mov dword [esp], 0
mov eax, dword [esp]
inc eax
push eax
call fcn.0040ced0
add esp, 4
mov dword [esp + 0x3c], eax
cmp dword [esp], 0
je 0x437e03
mov eax, dword [esp + 0x3c]
test di, di
je 0x437e03
mov ecx, dword [esp]
mov eax, dword [esp + 0x3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, di
lea edi, [esi + 2]
mov dword [esp + 4], edi
cmp dx, 0x7f
ja 0x437d10
lea edi, [eax + 1]
mov byte [eax], dl
jmp 0x437d37
cmp edx, 0x7ff
ja 0x437d56
cmp ecx, 2
jb 0x437d56
mov ebx, edx
shr ebx, 6
add bl, 0xc0
mov byte [eax], bl
lea ebx, [esp + 8]
and dl, 0x3f
or dl, 0x80
lea edi, [eax + 2]
mov byte [eax + 1], dl
mov esi, dword [esp + 4]
add ecx, eax
sub ecx, edi
mov eax, edi
movzx edi, word [esi]
test di, di
je 0x437e03
test ecx, ecx
jne 0x437cf0
jmp 0x437e03
mov edi, edx
and edi, 0xfc00
cmp edi, 0xd800
jne 0x437db6
cmp ecx, 4
jb 0x437db6
movzx edi, word [esi + 2]
add esi, 4
shl edx, 0xa
lea ebx, [edx + edi]
add ebx, 0xfca02400
mov edx, ebx
shr edx, 0x12
add dl, 0xf0
mov byte [eax], dl
mov edx, ebx
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 2], bl
lea ebx, [esp + 8]
mov edx, edi
and dl, 0x3f
or dl, 0x80
lea edi, [eax + 4]
mov byte [eax + 3], dl
jmp 0x437d3b
movzx esi, di
cmp esi, 0xdc00
jne 0x437dca
mov esi, dword [esp + 4]
jmp 0x437d41
cmp ecx, 3
jb 0x437dfc
mov ebx, edx
shr ebx, 0xc
or bl, 0xe0
mov byte [eax], bl
mov ebx, edx
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
lea ebx, [esp + 8]
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
lea edi, [eax + 3]
jmp 0x437d37
mov edi, eax
jmp 0x437d37
mov byte [eax], 0
mov eax, 3
sub eax, dword [esp]
cmp eax, 0xfffffffd
jae 0x437e18
mov eax, 0xfffffffc
add eax, dword [esp]
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x70]
jb 0x437e2c
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov edi, dword [esp + 0x40]
push edi
lea eax, [esp + 0x50]
push eax
call fcn.0040cf00
add esp, 0xc
push edi
call fcn.0040cee0
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 0x84]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 8], 0
push 0x72a7c387
push dword [0x44cf84]
call fcn.00440270
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x4380ae
mov eax, dword [esp + 8]
mov ecx, eax
or ecx, 0x1a5845
mov edx, eax
and edx, 0x1a5845
imul ecx, edx
and eax, 0xffe5a7ba
xor edx, 0x1a5845
imul edx, eax
lea eax, [ecx + edx]
add eax, 0xebde8a13
mov dword [esp + 0x48], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041dde0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x437f20
test esi, esi
je 0x437f3e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040cf50
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
mov ecx, dword [esp + ecx*4 + 0x48]
mov edx, ecx
or edx, 0x1a5845
mov esi, ecx
and esi, 0x1a5845
imul edx, esi
and ecx, 0xffe5a7ba
xor esi, 0x1a5845
imul esi, ecx
lea ecx, [edx + esi]
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041dde0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x437fa0
test esi, esi
je 0x437fbe
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040cf50
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x50], 0
setne cl
mov ecx, dword [esp + ecx*4 + 0x4c]
mov edx, ecx
or edx, 0x1a5845
mov esi, ecx
and esi, 0x1a5845
imul edx, esi
and ecx, 0xffe5a7ba
xor esi, 0x1a5845
imul esi, ecx
lea ecx, [edx + esi]
add ecx, 0xebde8a13
mov dword [esp + 0x50], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041dde0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438020
test esi, esi
je 0x43803e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040cf50
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x54], 0
setne al
mov eax, dword [esp + eax*4 + 0x50]
mov ecx, eax
or ecx, 0x1a5845
mov edx, eax
and edx, 0x1a5845
imul ecx, edx
and eax, 0xffe5a7ba
xor edx, 0x1a5845
imul edx, eax
lea eax, [ecx + edx]
add eax, 0xebde8a13
mov dword [esp + 0x54], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041dde0
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438090
test esi, esi
je 0x4380ae
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040cf50
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret