Function at 0x433ba0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44985c]
mov dword [esp + 0x10], 0x23712145
mov dword [esp + 0x14], 0x279525ad
mov dword [esp + 0x18], 0x3b9f398c
mov dword [esp + 0x1c], 0x3f7a3d81
mov dword [esp + 0x20], 0x338b3182
mov dword [esp + 0x24], 0x37933582
mov dword [esp + 0x28], 0xb0a096d
mov ecx, 0x5af59888
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x5af59878]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
lea esi, [ecx + edx]
not esi
add edx, ecx
add edx, 0x57
and esi, 1
or edx, 1
xor edx, esi
lea edx, [edx + esi*2]
mov byte [esp + ecx - 0x5af59878], dl
inc ecx
cmp ecx, 0x5af598a4
jne 0x433c00
mov ecx, esp
lea esi, [esp + 0x84]
lea ebx, [esp + 0x10]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x433c5c
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x50], 0
lea eax, [esp + 0x50]
push eax
push 0x43f670
push 1
push 0
push 0x43f680
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4341b5
mov dword [esp + 0x10], 0x398b3b82
mov dword [esp + 0x14], 0x259a2789
mov dword [esp + 0x18], 0x216f2380
mov dword [esp + 0x1c], 0x2d9d2f97
mov dword [esp + 0x20], 0x29742b96
mov dword [esp + 0x24], 0x1728
mov eax, 0xb
mov ecx, 0xf4
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 5]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
mov bl, 0xc8
sub bl, dl
mov byte [esp + eax + 5], bl
inc eax
dec ecx
cmp eax, 0x23
jne 0x433cf0
lea ebx, [esp + 0x10]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x50]
mov ecx, dword [esi]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
lea esi, [esp + 0x84]
js 0x4341a1
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x434197
mov dword [esp + 0x10], 0xc373c177
mov dword [esp + 0x14], 0xc7c6c508
mov byte [esp + 0x18], 0
mov eax, 0xef8773b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x10788c60]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x90
mov byte [esp + eax + 0x10788c60], cl
inc eax
cmp eax, 0xef8773b9
jne 0x433d90
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 0x10], 0x49f14be1
mov dword [esp + 0x14], 0x45fd47fc
mov dword [esp + 0x18], 0x41ee43f9
mov dword [esp + 0x1c], 0xbde8bf20
mov dword [esp + 0x20], 0xb900bbdc
mov dword [esp + 0x24], 0xb507b716
mov dword [esp + 0x28], 0xb1d2b307
mov dword [esp + 0x2c], 0xad39af19
mov dword [esp + 0x30], 0xa9e7ab3e
mov dword [esp + 0x34], 0xa507a7e6
mov dword [esp + 0x38], 0xa115a31a
mov dword [esp + 0x3c], 0x9d339f11
mov word [esp + 0x40], 0x9b9c
mov dword [esp + 0x42], 0
mov eax, 0xf3
mov ecx, 0xede3220c
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xe3]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
mov ebx, 0x3f
sub ebx, edx
not edx
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + eax - 0xe3], bl
inc eax
dec ecx
cmp eax, 0x129
jne 0x433e40
lea ebx, [esp + 0x10]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x68]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x43417e
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x434174
cmp eax, 1
je 0x434174
cmp dword [esp + 0x5c], 0
je 0x434174
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], 0x29812bf1
mov dword [esp + 0x14], 0x2d812f9e
mov dword [esp + 0x18], 0x319e338b
mov dword [esp + 0x1c], 0x358d37e2
mov dword [esp + 0x20], 0x399c3b87
mov dword [esp + 0x24], 0x3d883f93
mov word [esp + 0x28], 0x33c
mov dword [esp + 0x2a], 0
mov word [esp + 0x2e], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x10]
mov ebx, ecx
and ebx, 0xe
mov esi, edx
xor esi, 0xe5f3f747
add esi, ebx
xor esi, edi
mov ebx, esi
and ebx, 0x1c
add ebx, ebx
xor esi, 0x63
sub ebx, esi
mov byte [esp + edx + 0x10], bl
inc edx
add ecx, 2
cmp edx, 0x20
jne 0x433f40
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea ebx, [esp + 0x20]
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
mov edi, dword [ebp + 8]
js 0x434163
cmp word [esp + 0x70], 8
jne 0x434163
mov esi, dword [esp + 0x78]
movzx ecx, word [esi]
test cx, cx
je 0x433fdd
lea eax, [esi + 2]
xor edi, edi
jmp 0x433fbc
inc edi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x433fdf
cmp cx, 0x7f
jbe 0x433fb0
movzx edx, cx
cmp edx, 0x7ff
ja 0x433fd2
add edi, 2
jmp 0x433fb1
cmp cx, 0xffff
je 0x433fb1
add edi, 3
jmp 0x433fb1
xor edi, edi
lea eax, [edi + 1]
push eax
call fcn.004084c0
add esp, 4
mov dword [esp + 0x48], eax
mov ecx, eax
mov dword [esp + 0x54], edi
test edi, edi
mov edi, dword [ebp + 8]
je 0x43411f
movzx eax, word [esi]
mov ecx, dword [esp + 0x48]
test ax, ax
je 0x43411f
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x434040
lea eax, [ecx + 1]
mov byte [ecx], bl
jmp 0x4340c0
cmp ebx, 0x7ff
ja 0x434064
cmp edx, 2
jb 0x434064
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ecx], al
and bl, 0x3f
or bl, 0x80
lea eax, [ecx + 2]
mov byte [ecx + 1], bl
jmp 0x4340c0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x4340e1
cmp edx, 4
jb 0x4340e1
movzx edi, word [esi + 2]
shl ebx, 0xa
lea eax, [ebx + edi]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ecx + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ecx + 2], al
mov eax, edi
and al, 0x3f
or al, 0x80
mov byte [ecx + 3], al
lea eax, [ecx + 4]
add esi, 4
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
lea ebx, [esp + 0x10]
add edx, ecx
sub edx, eax
mov esi, edi
mov ecx, eax
movzx eax, word [esi]
test ax, ax
mov edi, dword [ebp + 8]
je 0x43411f
test edx, edx
jne 0x434020
jmp 0x43411f
movzx eax, ax
cmp eax, 0xdc00
jne 0x4340f3
mov esi, edi
lea ebx, [esp + 0x10]
jmp 0x4340cc
cmp edx, 3
jb 0x43411b
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ecx], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ecx + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ecx + 3]
mov byte [ecx + 2], bl
jmp 0x4340c0
mov eax, ecx
jmp 0x4340c0
mov byte [ecx], 0
mov edx, dword [esp + 0x48]
mov eax, dword [edx]
mov dword [esp], eax
mov ecx, dword [esp + 0x54]
and ecx, 0xfffffffc
cmp ecx, 4
je 0x434156
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
cmp ecx, 8
je 0x434156
mov eax, dword [edx + 8]
mov dword [esp + 8], eax
cmp ecx, 0xc
je 0x434156
mov eax, dword [edx + 0xc]
mov dword [esp + 0xc], eax
push edx
call fcn.004084d0
add esp, 4
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 0x84]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x10], 0
push 0x72a7c387
push dword [0x449854]
call fcn.0043c130
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x43439e
mov eax, dword [esp + 0x10]
mov ecx, eax
or ecx, 0x1a5845
mov edx, eax
and edx, 0x1a5845
imul ecx, edx
xor edx, 0x1a5845
and eax, 0xffe5a7ba
imul eax, edx
add eax, ecx
add eax, 0xebde8a13
mov dword [esp], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041a140
add esp, 0x10
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x434230
test esi, esi
je 0x43424e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408540
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 4], 0
setne cl
mov ecx, dword [esp + ecx*4]
mov edx, ecx
or edx, 0x1a5845
mov esi, ecx
and esi, 0x1a5845
imul edx, esi
xor esi, 0x1a5845
and ecx, 0xffe5a7ba
imul ecx, esi
add ecx, edx
add ecx, 0xebde8a13
mov dword [esp + 4], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041a140
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4342a0
test esi, esi
je 0x4342be
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408540
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
mov ecx, dword [esp + ecx*4 + 4]
mov edx, ecx
or edx, 0x1a5845
mov esi, ecx
and esi, 0x1a5845
imul edx, esi
xor esi, 0x1a5845
and ecx, 0xffe5a7ba
imul ecx, esi
add ecx, edx
add ecx, 0xebde8a13
mov dword [esp + 8], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041a140
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x434310
test esi, esi
je 0x43432e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408540
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
mov eax, dword [esp + eax*4 + 8]
mov ecx, eax
or ecx, 0x1a5845
mov edx, eax
and edx, 0x1a5845
imul ecx, edx
xor edx, 0x1a5845
and eax, 0xffe5a7ba
imul eax, edx
add eax, ecx
add eax, 0xebde8a13
mov dword [esp + 0xc], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041a140
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x434380
test esi, esi
je 0x43439e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408540
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret