Function at 0x433030
Capabilities:
Authenticate hmac
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x4497f4]
mov dword [esp + 8], 0x37593905
mov dword [esp + 0xc], 0x33bd35bd
mov dword [esp + 0x10], 0x4f3331bc
mov dword [esp + 0x14], 0x4b164d39
mov dword [esp + 0x18], 0x473f49c6
mov dword [esp + 0x1c], 0x433f45ce
mov dword [esp + 0x20], 0x5f5e417d
mov ecx, 0xcafe7236
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x35018dd2]
xor edx, ecx
add edx, 0x907c4f1
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx + 0x35018dd2], dl
inc ecx
cmp ecx, 0xcafe7252
jne 0x433090
lea ecx, [esp + 0x48]
lea esi, [esp + 0x84]
lea ebx, [esp + 8]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x4330e4
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
lea eax, [esp + 0x44]
push eax
push 0x43f670
push 1
push 0
push 0x43f680
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43351e
mov dword [esp + 8], 0x37653956
mov dword [esp + 0xc], 0x335e3567
mov dword [esp + 0x10], 0x4f113154
mov dword [esp + 0x14], 0x4b1f4d15
mov dword [esp + 0x18], 0x47084922
mov dword [esp + 0x1c], 0x4544
mov byte [esp + 0x20], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
mov ebx, eax
and ebx, 0x2c
mov esi, ecx
xor esi, 0x6a779c36
add esi, ebx
mov ebx, edx
not ebx
and ebx, 0x29
xor edx, 0x258d3229
or edx, ebx
xor edx, esi
mov esi, edx
and esi, 0x71
add esi, esi
xor esi, 0x42
xor edx, 0xd8
add edx, esi
inc dl
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 0x19
jne 0x433180
lea ebx, [esp + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x433506
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x5c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4334fc
mov dword [esp + 8], 0xc3b3c1b7
mov dword [esp + 0xc], 0xc7c6c588
mov word [esp + 0x10], 0
xor eax, eax
mov ecx, eax
add cl, 0x50
xor cl, byte [esp + eax + 8]
add cl, 0x70
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0xa
jne 0x433230
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 8], 0x11d91fe9
mov dword [esp + 0xc], 0x15d513ec
mov dword [esp + 0x10], 0x9e217d1
mov dword [esp + 0x14], 0xdd00b28
mov dword [esp + 0x18], 0x1c80f2c
mov dword [esp + 0x1c], 0x5f303f2
mov dword [esp + 0x20], 0x392607fb
mov dword [esp + 0x24], 0x3da13bd1
mov dword [esp + 0x28], 0x31eb3fa2
mov dword [esp + 0x2c], 0x35d333e2
mov dword [esp + 0x30], 0x29cd37f6
mov dword [esp + 0x34], 0x2ddf2bd9
mov word [esp + 0x38], 0x2f2c
mov dword [esp + 0x3a], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
not dl
and dl, 0x3a
mov dh, al
or dh, 0xc5
sub dl, dh
movzx edx, dl
add edx, eax
xor dl, byte [esp + ecx + 8]
mov bl, 0x26
sub bl, dl
mov byte [esp + ecx + 8], bl
lea edx, [ecx + 1]
dec eax
mov ecx, edx
cmp edx, 0x36
jne 0x4332d0
lea eax, [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x40]
mov ecx, dword [ebx]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
push dword [esp + 0x68]
push ebx
call dword [ecx + 0x50]
test eax, eax
js 0x4334e6
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea ebx, [esp + 0x60]
push edx
push ebx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4334dc
cmp eax, 1
je 0x4334dc
cmp dword [esp + 0x5c], 0
je 0x4334dc
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 0x933f9123
mov dword [esp + 0xc], 0x9f379d0e
mov dword [esp + 0x10], 0x9b0e9939
mov dword [esp + 0x14], 0x871b8532
mov dword [esp + 0x18], 0x83208115
mov dword [esp + 0x1c], 0x8f1c8d21
mov dword [esp + 0x20], 0x8988
mov byte [esp + 0x24], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
lea ebx, [ecx + 0x64]
or ebx, edx
add edx, ecx
neg edx
add edx, ebx
add edx, 0x9b
and edx, ebx
add dl, 0xc
mov byte [esp + ecx + 8], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x1d
jb 0x4333c0
mov ecx, dword [eax]
push 0
push 0
lea ebx, [esp + 0x78]
push ebx
push 0
lea edx, [esp + 0x18]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4334cb
cmp word [esp + 0x70], 8
jne 0x4334cb
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 4], eax
je 0x43345d
add eax, 2
xor ebx, ebx
jmp 0x43343c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43345f
cmp cx, 0x7f
jbe 0x433430
movzx edx, cx
cmp edx, 0x7ff
ja 0x433452
add ebx, 2
jmp 0x433431
cmp cx, 0xffff
je 0x433431
add ebx, 3
jmp 0x433431
xor ebx, ebx
lea eax, [ebx + 1]
mov dword [esp + 0x68], eax
push eax
call fcn.00408630
add esp, 4
push dword [esp + 4]
push dword [esp + 0x6c]
mov dword [esp + 0xc], eax
push eax
call fcn.00428f30
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x433495
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
jb 0x4334a4
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 8]
push ebx
lea eax, [esp + 0x50]
push eax
call fcn.00408660
add esp, 0xc
push ebx
call fcn.00408640
add esp, 4
lea ebx, [esp + 0x70]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call ebx
push dword [esp + 0x6c]
call ebx
lea ebx, [esp + 8]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x84]
mov dword [esp + 8], 0
push 0x72a7c387
push dword [0x4497ec]
call fcn.0043b560
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x4336eb
imul eax, dword [esp + 8], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x48], eax
mov ebx, 0xffffffff
mov esi, 0xfffffffe
push 0x10
push 9
push edi
push eax
call fcn.0041aa00
add esp, 0x10
nop
nop
nop
nop
nop
nop
add esi, 2
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x433580
xor ebx, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, ebx
je 0x4335ab
sub ebx, esi
add eax, ebx
push ecx
push 0x30
push eax
call fcn.004086c0
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x48], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
mov esi, 0xfffffffe
mov ebx, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041aa00
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, 2
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x4335f0
xor ebx, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, ebx
je 0x43361b
sub ebx, esi
add eax, ebx
push ecx
push 0x30
push eax
call fcn.004086c0
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x50], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x4c], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x50], ecx
mov esi, 0xfffffffe
mov ebx, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041aa00
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, 2
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x433660
xor ebx, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, ebx
je 0x43368b
sub ebx, esi
add eax, ebx
push ecx
push 0x30
push eax
call fcn.004086c0
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x54], 0
setne al
imul eax, dword [esp + eax*4 + 0x50], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffffe
mov ebx, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.0041aa00
add esp, 0x10
nop
nop
nop
add esi, 2
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x4336c0
xor ebx, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, ebx
je 0x4336eb
sub ebx, esi
add eax, ebx
push ecx
push 0x30
push eax
call fcn.004086c0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret