Function at 0x432630
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44354c]
mov dword [esp + 0x18], 0x2c782a0c
mov dword [esp + 0x1c], 0x205c2ea4
mov dword [esp + 0x20], 0x24462255
mov dword [esp + 0x24], 0x38632658
mov dword [esp + 0x28], 0x3c423a4b
mov dword [esp + 0x2c], 0x305a3e4b
mov dword [esp + 0x30], 0x34333214
mov ecx, 0x21
mov edx, 0xde
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 9]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0xf8
mov byte [esp + ecx - 9], bl
inc ecx
dec edx
cmp ecx, 0x3d
jne 0x432690
mov ecx, esp
lea ebx, [esp + 0x84]
lea esi, [esp + 0x18]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x4326d2
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0xc], 0x927dad14
mov dword [esp + 8], 0x97263f24
mov dword [esp + 4], 0xe225ad7d
mov dword [esp], 0xdf39de7b
mov dword [esp + 0x50], 0
lea eax, [esp + 0x50]
push eax
push 0x43a678
push 1
push 0
push 0x43a688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x432c2c
mov dword [esp + 0x18], 0x823e803d
mov dword [esp + 0x1c], 0x8631843c
mov dword [esp + 0x20], 0xfabaf82b
mov dword [esp + 0x24], 0xfe40fc42
mov dword [esp + 0x28], 0xf2a3f049
mov word [esp + 0x2c], 0xf4f3
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
and ecx, 0x15
mov edx, eax
and edx, 2
mov esi, edx
xor esi, 2
imul esi, ecx
or ecx, 2
imul ecx, edx
mov edx, eax
xor edx, 0x37
add edx, esi
add edx, ecx
xor dl, byte [esp + eax + 0x18]
add dl, 0x48
mov byte [esp + eax + 0x18], dl
inc eax
cmp eax, 0x16
jne 0x432760
lea esi, [esp + 0x18]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], ebx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
lea ebx, [esp + 0x84]
js 0x432c18
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x432c0e
mov dword [esp + 0x18], 0xcc9aca9e
mov dword [esp + 0x1c], 0xc0cfce91
mov eax, 0xe9ac99c1
mov ecx, 0x1653663e
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x16536657]
mov edi, ecx
and edi, 0x16110005
mov edx, eax
and edx, 0xc08c094a
or edx, edi
xor edx, esi
mov esi, edx
xor esi, 0x73
and edx, 0x76
add edx, edx
xor edx, 9
add edx, esi
inc dl
mov byte [esp + eax + 0x16536657], dl
inc eax
dec ecx
cmp eax, 0xe9ac99c9
jne 0x432810
lea esi, [esp + 0x18]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov dword [esp + 0x18], 0xca0cc864
mov dword [esp + 0x1c], 0xce08cc77
mov dword [esp + 0x20], 0xc275c00c
mov dword [esp + 0x24], 0xc61fc423
mov dword [esp + 0x28], 0xba7fb827
mov dword [esp + 0x2c], 0xbe02bc09
mov dword [esp + 0x30], 0xb251b002
mov dword [esp + 0x34], 0xb62cb404
mov dword [esp + 0x38], 0xaa7aa829
mov dword [esp + 0x3c], 0xae02ac79
mov dword [esp + 0x40], 0xa218a06d
mov dword [esp + 0x44], 0xa616a41c
mov word [esp + 0x48], 0x98a7
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xaf
xor cl, byte [esp + eax + 0x18]
add cl, 0x88
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x32
jne 0x4328d0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push ebx
push esi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
js 0x432bf4
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea esi, [esp + 0x5c]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x432bea
cmp eax, 1
je 0x432bea
cmp dword [esp + 0x58], 0
je 0x432bea
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x18], 0xa3c7a1f3
mov dword [esp + 0x1c], 0xa7cfa5d6
mov dword [esp + 0x20], 0xabc6a9c9
mov dword [esp + 0x24], 0xafdbade2
mov dword [esp + 0x28], 0xb3d0b1dd
mov dword [esp + 0x2c], 0xb7c4b5d1
mov word [esp + 0x30], 0xb9b8
xor ecx, ecx
lea esi, [esp + 0x18]
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
or dl, 0xa0
xor byte [esp + ecx + 0x18], dl
mov edx, ecx
or edx, 1
add edx, ecx
not ecx
or ecx, 1
add ecx, edx
inc ecx
cmp ecx, 0x1a
jb 0x4329a0
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0x78]
push edx
push 0
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x432bd5
cmp word [esp + 0x70], 8
jne 0x432bd5
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x78]
movzx ebx, word [eax]
test bx, bx
mov dword [esp + 0x14], eax
je 0x432a2d
add eax, 2
xor esi, esi
mov ecx, ebx
jmp 0x432a0c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x432a2f
cmp cx, 0x7f
jbe 0x432a00
movzx edx, cx
cmp edx, 0x7ff
ja 0x432a22
add esi, 2
jmp 0x432a01
cmp cx, 0xffff
je 0x432a01
add esi, 3
jmp 0x432a01
xor esi, esi
lea eax, [esi + 1]
push eax
call fcn.00408300
add esp, 4
mov edi, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x54], esi
test esi, esi
mov ecx, dword [esp + 0x14]
je 0x432b84
mov edi, dword [esp + 0x10]
test bx, bx
je 0x432b84
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, bx
lea ebx, [ecx + 2]
cmp dx, 0x7f
ja 0x432a90
lea eax, [edi + 1]
mov byte [edi], dl
jmp 0x432b30
cmp edx, 0x7ff
ja 0x432ab4
cmp esi, 2
jb 0x432ab4
mov eax, edx
shr eax, 6
add al, 0xc0
mov byte [edi], al
and dl, 0x3f
or dl, 0x80
lea eax, [edi + 2]
mov byte [edi + 1], dl
jmp 0x432b30
mov eax, edx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x432b4a
cmp esi, 4
jb 0x432b4a
movzx ebx, word [ecx + 2]
shl edx, 0xa
mov eax, ebx
xor eax, 0xdc00
and ebx, 0x23ff
add ebx, ebx
sub ebx, eax
mov dword [esp + 0x14], ecx
lea ecx, [edx + ebx]
add ecx, 0xfca10000
mov eax, ecx
shr eax, 0x12
add al, 0xf0
mov byte [edi], al
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
lea eax, [edx + ebx]
add eax, 0xfca00000
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 2], al
mov ecx, dword [esp + 0x14]
add ecx, 4
and bl, 0x3f
or bl, 0x80
mov byte [edi + 3], bl
lea eax, [edi + 4]
mov ebx, ecx
nop
nop
nop
nop
add esi, edi
sub esi, eax
mov ecx, ebx
mov edi, eax
movzx ebx, word [ecx]
test bx, bx
je 0x432b84
test esi, esi
jne 0x432a70
jmp 0x432b84
movzx eax, ax
cmp eax, 0xdc00
jne 0x432b58
mov ecx, ebx
jmp 0x432b38
cmp esi, 3
jb 0x432b80
mov eax, edx
shr eax, 0xc
or al, 0xe0
mov byte [edi], al
mov eax, edx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 1], al
and dl, 0x3f
or dl, 0x80
lea eax, [edi + 3]
mov byte [edi + 2], dl
jmp 0x432b30
mov eax, edi
jmp 0x432b30
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x54]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x432b9c
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
mov edi, dword [ebp + 8]
jb 0x432bae
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov esi, dword [esp + 0x14]
push esi
lea eax, [esp + 8]
push eax
call fcn.00408330
add esp, 0xc
push esi
call fcn.00408310
add esp, 4
mov ebx, dword [esp + 0x64]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 0x18]
lea ebx, [esp + 0x84]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x442544]
call fcn.00437540
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x432c5a
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041b9a0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x432ca0
test esi, esi
je 0x432cbe
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408380
add esp, 0xc
xor eax, eax
cmp dword [esp + 4], 0
setne al
mov eax, dword [esp + eax*4]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 8]
mov dword [esp + 4], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041b9a0
add esp, 0x10
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x432d10
test esi, esi
je 0x432d2e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408380
add esp, 0xc
xor eax, eax
cmp dword [esp + 8], 0
setne al
mov eax, dword [esp + eax*4 + 4]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 0x10]
mov dword [esp + 8], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041b9a0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x432d80
test esi, esi
je 0x432d9e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408380
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
mov eax, dword [esp + eax*4 + 8]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 0xc], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041b9a0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x432df0
test esi, esi
je 0x432e0e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408380
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret