Function at 0x43aea0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44f2b0]
mov dword [esp + 0x3c], eax
mov dword [esp + 4], 0xf59092d
mov dword [esp + 8], 0x3750d85
mov dword [esp + 0xc], 0x7630174
mov dword [esp + 0x10], 0x1b5e0579
mov dword [esp + 0x14], 0x1f67196e
mov dword [esp + 0x18], 0x13771d96
mov dword [esp + 0x1c], 0x17161135
mov byte [esp + 0x20], 0
mov ecx, 2
mov edx, 0xfd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 2]
mov eax, edx
and eax, esi
lea ebx, [esi + esi]
not ebx
add ebx, esi
and ebx, ecx
or ebx, eax
add bl, 0xf6
mov byte [esp + ecx + 2], bl
inc ecx
dec edx
cmp ecx, 0x1f
jne 0x43af10
lea ecx, [esp + 0x54]
lea ebx, [esp + 0x84]
lea eax, [esp + 4]
push ecx
push 8
push ebx
push 0xd
push eax
push 0
call dword [esp + 0x54]
test eax, eax
jns 0x43af5d
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x60], 0x7b521b20
mov dword [esp + 0x5c], 0xb19e345d
mov dword [esp + 0x58], 0xf98fa0ac
mov dword [esp + 0x54], 0x2e31b909
mov dword [esp + 0x44], 0
lea eax, [esp + 0x44]
push eax
push 0x445668
push 1
push 0
push 0x445678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43b3c9
mov dword [esp + 4], 0x37653956
mov dword [esp + 8], 0x335e3567
mov dword [esp + 0xc], 0x4f113154
mov dword [esp + 0x10], 0x4b1f4d15
mov dword [esp + 0x14], 0x47084922
mov word [esp + 0x18], 0x4544
mov dword [esp + 0x1a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
lea ecx, [eax + 0x3e]
mov edx, 1
sub edx, eax
and edx, 8
and ecx, 0x77
sub ecx, edx
xor cl, byte [esp + eax + 4]
add cl, 0xf2
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
mov edx, eax
and edx, 0x1e
mov esi, eax
xor esi, 1
add esi, eax
mov eax, esi
sub eax, edx
and esi, ecx
or eax, ecx
add eax, esi
cmp eax, 0x1a
jb 0x43aff0
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x43b3b8
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x5c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43b3ae
mov dword [esp + 0x68], esi
mov dword [esp + 4], 0xd90ddb6d
mov dword [esp + 8], 0xdddedf04
mov dword [esp + 0xc], 0
mov edx, 0x2f
nop
movzx esi, byte [esp + edx - 0x2b]
mov ebx, esi
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x3d
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x15
mov byte [esp + edx - 0x2b], al
inc edx
cmp edx, 0x3b
jne 0x43b0a0
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov dword [esp + 4], 0x438741b3
mov dword [esp + 8], 0x47834588
mov dword [esp + 0xc], 0x4bbe498b
mov dword [esp + 0x10], 0x4f644d6c
mov dword [esp + 0x14], 0x73b47150
mov dword [esp + 0x18], 0x77b97586
mov dword [esp + 0x1c], 0x7b5a79b5
mov dword [esp + 0x20], 0x7f977d8b
mov dword [esp + 0x24], 0x63b1618e
mov dword [esp + 0x28], 0x679965b6
mov dword [esp + 0x2c], 0x6ba369aa
mov dword [esp + 0x30], 0x6f9d6da3
mov word [esp + 0x34], 0x1110
mov dword [esp + 0x36], 0
mov byte [esp + 0x3a], 0
xor eax, eax
mov cl, 0xef
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 4]
xor dl, cl
mov ch, 0xaf
sub ch, dl
mov byte [esp + eax + 4], ch
inc eax
dec cl
cmp eax, 0x37
jne 0x43b170
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x40]
mov ecx, dword [esi]
lea edx, [esp + 0x50]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
mov dword [esp + 0x4c], ebx
push ebx
push esi
call dword [ecx + 0x50]
test eax, eax
mov esi, dword [esp + 0x68]
js 0x43b395
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
lea edx, [esp + 0x48]
lea ebx, [esp + 0x4c]
push edx
push ebx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43b38b
cmp eax, 1
je 0x43b38b
cmp dword [esp + 0x48], 0
je 0x43b38b
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
mov dword [esp + 4], 0x83278153
mov dword [esp + 8], 0x872f8536
mov dword [esp + 0xc], 0x8b268929
mov dword [esp + 0x10], 0x8f3b8d42
mov dword [esp + 0x14], 0x9330913d
mov dword [esp + 0x18], 0x97249531
mov word [esp + 0x1c], 0x9998
mov dword [esp + 0x1e], 0
mov ecx, 0x538b4760
mov eax, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x538b475c]
mov edx, eax
xor edx, ecx
and edx, ebx
xor edx, ecx
add edx, 0x5e479b1f
mov ebx, edx
and ebx, 1
xor edx, 1
lea edx, [edx + ebx*2]
mov byte [esp + ecx - 0x538b475c], dl
inc ecx
dec eax
cmp ecx, 0x538b477e
jne 0x43b260
mov edx, dword [esp]
mov eax, dword [edx]
push 0
push 0
lea ebx, [esp + 0x78]
push ebx
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [eax + 0x10]
test eax, eax
js 0x43b37a
cmp word [esp + 0x70], 8
jne 0x43b37a
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp], eax
je 0x43b30d
add eax, 2
xor ebx, ebx
jmp 0x43b2ec
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43b30f
cmp cx, 0x7f
jbe 0x43b2e0
movzx edx, cx
cmp edx, 0x7ff
ja 0x43b302
add ebx, 2
jmp 0x43b2e1
cmp cx, 0xffff
je 0x43b2e1
add ebx, 3
jmp 0x43b2e1
xor ebx, ebx
lea eax, [ebx + 1]
mov dword [esp + 0x64], eax
push eax
call fcn.00408640
add esp, 4
push dword [esp]
push dword [esp + 0x68]
mov dword [esp + 8], eax
push eax
call fcn.00430800
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x43b344
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
jb 0x43b353
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 4]
push ebx
lea eax, [esp + 0x5c]
push eax
call fcn.00408670
add esp, 0xc
push ebx
call fcn.00408650
add esp, 4
lea ebx, [esp + 0x70]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x6c]
call ebx
lea ebx, [esp + 0x84]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44f2a8]
call fcn.00442040
add esp, 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push ebx
call eax
test eax, eax
je 0x43b3fc
mov eax, dword [esp + 4]
mov dword [esp + 0x54], eax
xor esi, esi
jmp 0x43b40d
add edi, 8
inc esi
cmp esi, 4
je 0x43b4a3
mov eax, 0
test esi, esi
je 0x43b420
cmp dword [esp + esi*4 + 0x54], 1
mov eax, esi
sbb eax, 0
mov eax, dword [esp + eax*4 + 0x54]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
mov ecx, eax
and ecx, 0xebde8a13
xor eax, 0xebde8a13
lea eax, [eax + ecx*2]
mov dword [esp + esi*4 + 0x54], eax
mov ebx, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.00420cd0
add esp, 0x10
nop
nop
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x43b470
mov ecx, ebx
and ecx, 0xfffffff7
not ebx
and ebx, 8
mov edx, ebx
sub edx, ecx
je 0x43b400
sub ecx, ebx
add eax, ecx
push edx
push 0x30
push eax
call fcn.004086c0
add esp, 0xc
jmp 0x43b400
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret