Function at 0x438a30
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44ce4c]
mov dword [esp + 0x10], 0x23512105
mov dword [esp + 0x14], 0x27b525ad
mov dword [esp + 0x18], 0x5b3f59cc
mov dword [esp + 0x1c], 0x5f1a5dc1
mov dword [esp + 0x20], 0x53cb51c2
mov dword [esp + 0x24], 0x573355c2
mov dword [esp + 0x28], 0x4b4a496d
mov dword [esp + 0x2c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x10]
mov ebx, ecx
and ebx, 8
xor ebx, 0xb2991348
mov esi, ecx
and esi, 0x17
sub esi, ebx
lea ebx, [esi + esi]
not ebx
add ebx, esi
xor ebx, esi
and ebx, edx
xor ebx, esi
add bl, 0x68
mov byte [esp + ecx + 0x10], bl
inc ecx
cmp ecx, 0x20
jne 0x438a90
lea ecx, [esp + 0x58]
lea ebx, [esp + 0x84]
lea esi, [esp + 0x10]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x438aea
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x64], 0x242507ad
mov dword [esp + 0x60], 0xd125373c
mov dword [esp + 0x5c], 0xebc258c4
mov dword [esp + 0x58], 0xe4d1aa88
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0x443668
push 1
push 0
push 0x443678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x438f0e
mov dword [esp + 0x10], 0x9fcd99ce
mov dword [esp + 0x14], 0xa3f69dcf
mov dword [esp + 0x18], 0xa7e1a1fc
mov dword [esp + 0x1c], 0xabe7a5ed
mov dword [esp + 0x20], 0xaf98a9f2
mov dword [esp + 0x24], 0xadac
xor eax, eax
mov ecx, eax
add cl, 0x1a
xor cl, byte [esp + eax + 0x10]
add cl, 0x7e
mov byte [esp + eax + 0x10], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x18
jb 0x438b70
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x438ef9
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x24]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x438eef
mov dword [esp + 0x10], 0x63336137
mov dword [esp + 0x14], 0x67666538
mov word [esp + 0x18], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x10]
mov edx, 0x97
sub edx, eax
lea ebx, [eax + 0x68]
or ebx, ecx
not ecx
or ecx, edx
and ecx, ebx
add cl, 0xf8
mov byte [esp + eax + 0x10], cl
mov ecx, eax
xor ecx, 0xd60a13ba
and eax, 5
add eax, eax
sub eax, ecx
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
add eax, 0xd60a13ba
cmp eax, 0xa
jb 0x438c00
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x48], eax
mov dword [esp + 0x10], 0x29612b51
mov dword [esp + 0x14], 0x2d652f64
mov dword [esp + 0x18], 0x51265369
mov dword [esp + 0x1c], 0x55785770
mov dword [esp + 0x20], 0x59105b74
mov dword [esp + 0x24], 0x5d2f5f2e
mov dword [esp + 0x28], 0x4162432f
mov dword [esp + 0x2c], 0x45294739
mov dword [esp + 0x30], 0x491f4bd6
mov dword [esp + 0x34], 0x4d2f4f1e
mov dword [esp + 0x38], 0x713d730a
mov dword [esp + 0x3c], 0x75037701
mov word [esp + 0x40], 0x7b74
mov dword [esp + 0x42], 0
mov eax, 0x1929cbb7
mov ecx, 0xcdac6948
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1929cba7]
mov ebx, ecx
xor ebx, eax
and ebx, edx
xor ebx, eax
mov edx, ebx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
add dl, 0x6c
mov byte [esp + eax - 0x1929cba7], dl
inc eax
dec ecx
cmp eax, 0x1929cbed
jne 0x438cd0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 8]
mov ecx, dword [ebx]
lea edx, [esp + 0x54]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
push dword [esp + 0x58]
push ebx
call dword [ecx + 0x50]
test eax, eax
js 0x438ed6
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
lea ebx, [esp + 0x50]
push edx
push ebx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x438ecc
cmp eax, 1
je 0x438ecc
cmp dword [esp + 0x4c], 0
je 0x438ecc
lea ebx, [esp + 0x70]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], 0xf35ff1a3
mov dword [esp + 0x14], 0xff57fd4e
mov dword [esp + 0x18], 0xfb4ef959
mov dword [esp + 0x1c], 0xc77bc592
mov dword [esp + 0x20], 0xc360c175
mov dword [esp + 0x24], 0xcf7ccd61
mov dword [esp + 0x28], 0xc9c8
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xd4
xor dl, byte [esp + ecx + 0x10]
add dl, 0xdc
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, 0x1c
jne 0x438dc0
mov ecx, dword [eax]
push 0
push 0
push ebx
push 0
lea edx, [esp + 0x20]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x438ebb
cmp word [esp + 0x70], 8
jne 0x438ebb
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 4], eax
je 0x438e4d
add eax, 2
xor ebx, ebx
jmp 0x438e2c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x438e4f
cmp cx, 0x7f
jbe 0x438e20
movzx edx, cx
cmp edx, 0x7ff
ja 0x438e42
add ebx, 2
jmp 0x438e21
cmp cx, 0xffff
je 0x438e21
add ebx, 3
jmp 0x438e21
xor ebx, ebx
lea eax, [ebx + 1]
mov dword [esp + 0x68], eax
push eax
call fcn.00408220
add esp, 4
push dword [esp + 4]
push dword [esp + 0x6c]
mov dword [esp + 0xc], eax
push eax
call fcn.0042ee70
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x438e85
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
jb 0x438e94
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 8]
push ebx
lea eax, [esp + 0x60]
push eax
call fcn.00408250
add esp, 0xc
push ebx
call fcn.00408230
add esp, 4
lea ebx, [esp + 0x70]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x48]
call ebx
push dword [esp + 0x6c]
call ebx
lea ebx, [esp + 0x84]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x10]
push 0xbeb8f1a1
push dword [0x44ce44]
call fcn.0043f1c0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x438f3d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x58], eax
xor esi, esi
jmp 0x438f67
add edi, 8
mov eax, esi
and eax, 1
xor esi, 1
lea esi, [esi + eax*2]
cmp esi, 4
jae 0x438ff3
mov eax, 0
test esi, esi
je 0x438f7a
cmp dword [esp + esi*4 + 0x58], 1
mov eax, esi
sbb eax, 0
mov eax, dword [esp + eax*4 + 0x58]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x58], eax
mov ebx, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.0041f880
add esp, 0x10
nop
nop
nop
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x438fc0
mov ecx, ebx
and ecx, 0xfffffff7
not ebx
and ebx, 8
mov edx, ebx
sub edx, ecx
je 0x438f50
sub ecx, ebx
add eax, ecx
push edx
push 0x30
push eax
call fcn.00408430
add esp, 0xc
jmp 0x438f50
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret