Function at 0x4336c0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x4452a8]
mov dword [esp + 8], 0x56ba564d
mov dword [esp + 0xc], 0x56985693
mov dword [esp + 0x10], 0x56885698
mov dword [esp + 0x14], 0x56ab5683
mov dword [esp + 0x18], 0x56985682
mov dword [esp + 0x1c], 0x56965684
mov dword [esp + 0x20], 0x56755651
mov ecx, 0xb74c84
mov edx, 0x5548b37b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [esp + ecx*2 - 0x16e9900]
mov ebx, edx
and ebx, 0x5108115c
mov esi, ecx
and esi, 0xa04083
sub esi, ebx
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
add esi, 0xffff86c0
mov word [esp + ecx*2 - 0x16e9900], si
inc ecx
dec edx
cmp ecx, 0xb74c92
jne 0x433720
lea ecx, [esp + 0x4c]
lea esi, [esp + 0x84]
lea edi, [esp + 8]
push ecx
push 8
push esi
push 0xd
push edi
push 0
call eax
test eax, eax
jns 0x433785
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x58], 0x918ef99f
mov dword [esp + 0x54], 0xa2f6ccf8
mov dword [esp + 0x50], 0xb681a42c
mov dword [esp + 0x4c], 0x9fb139ae
mov dword [esp + 0x48], 0
lea eax, [esp + 0x48]
push eax
push 0x43c678
push 1
push 0
push 0x43c688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x433bd1
mov dword [esp + 8], 0x54e754d5
mov dword [esp + 0xc], 0x54ee54e6
mov dword [esp + 0x10], 0x549f54f7
mov dword [esp + 0x14], 0x54e354e4
mov dword [esp + 0x18], 0x548254e9
mov word [esp + 0x1c], 0x5551
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, 0x6660
sub ecx, eax
xor cx, word [esp + eax*2 + 8]
mov edx, 0x3307
sub edx, ecx
mov word [esp + eax*2 + 8], dx
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xb
jb 0x433810
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x433bc0
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x433bb6
mov dword [esp + 8], 0xeaeceaeb
mov dword [esp + 0xc], 0xeb3feaf2
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
or ecx, 0xc5dc
xor cx, word [esp + eax*2 + 8]
add ecx, 0xffffd120
mov word [esp + eax*2 + 8], cx
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x4338a0
mov dword [esp + 0x40], ebx
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x7c477c52
mov dword [esp + 0xc], 0x7c417c5f
mov dword [esp + 0x10], 0x7c527c46
mov dword [esp + 0x14], 0x7ca27ca7
mov dword [esp + 0x18], 0x7c5c7cb9
mov dword [esp + 0x1c], 0x7c437c49
mov dword [esp + 0x20], 0x7cbe7c40
mov dword [esp + 0x24], 0x7c697c48
mov dword [esp + 0x28], 0x7ca17c6f
mov dword [esp + 0x2c], 0x7c7b7ca1
mov dword [esp + 0x30], 0x7c4f7c57
mov dword [esp + 0x34], 0x7c7b7c48
mov word [esp + 0x38], 0x7ca9
mov eax, 0xbe642ac9
mov ecx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx]
mov edi, eax
and edi, edx
add edi, edi
sub edx, edi
add edx, eax
mov ebx, edx
and ebx, 0xa9b5
mov esi, edx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, ebx
or ebx, 2
imul ebx, esi
xor edx, 0xa9b7
add edx, edi
add edx, ebx
inc edx
mov word [ecx], dx
add ecx, 2
inc eax
cmp eax, 0xbe642ae2
jne 0x433950
lea ebx, [esp + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x44]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x48], eax
push eax
mov edi, dword [esp + 0x14]
push edi
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x433b98
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x433b8e
cmp eax, 1
je 0x433b8e
cmp dword [esp + 0x5c], 0
je 0x433b8e
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 0x7955794c
mov dword [esp + 0xc], 0x796b7963
mov dword [esp + 0x10], 0x79687952
mov dword [esp + 0x14], 0x7963794b
mov dword [esp + 0x18], 0x794a796a
mov dword [esp + 0x1c], 0x7978794c
mov word [esp + 0x20], 0x79eb
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + ecx*2 + 8]
lea esi, [ecx + 0x5ca347c7]
xor esi, edx
lea edx, [esi*2 + 0x35cb838e]
add esi, 0x1ae5c1c7
and edx, 2
mov edi, edx
and edi, esi
xor edx, esi
xor edx, 1
lea edx, [edx + edi*2]
mov word [esp + ecx*2 + 8], dx
lea edx, [ecx + ecx]
and edx, 2
xor ecx, 1
add ecx, edx
cmp ecx, 0xd
jb 0x433a50
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
mov edi, dword [esp + 4]
js 0x433b7d
cmp word [esp + 0x70], 8
jne 0x433b7d
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x6c], eax
je 0x433afd
add eax, 2
xor ebx, ebx
jmp 0x433adc
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x433aff
cmp cx, 0x7f
jbe 0x433ad0
movzx edx, cx
cmp edx, 0x7ff
ja 0x433af2
add ebx, 2
jmp 0x433ad1
cmp cx, 0xffff
je 0x433ad1
add ebx, 3
jmp 0x433ad1
xor ebx, ebx
lea eax, [ebx + 1]
mov dword [esp + 0x68], eax
push eax
call fcn.00407fa0
add esp, 4
mov esi, eax
push dword [esp + 0x6c]
push dword [esp + 0x6c]
push eax
call fcn.00408e40
add esp, 0xc
mov eax, dword [esi]
mov dword [esp + 0x4c], eax
mov eax, ebx
xor eax, 4
and ebx, 0xfffffffb
add ebx, ebx
sub ebx, eax
cmp ebx, 4
jb 0x433b70
mov eax, dword [esi + 4]
mov dword [esp + 0x50], eax
mov eax, ebx
xor eax, 4
and ebx, 0xfffffffb
add ebx, ebx
sub ebx, eax
cmp ebx, 4
jb 0x433b70
mov eax, dword [esi + 8]
mov dword [esp + 0x54], eax
mov eax, ebx
xor eax, 4
and ebx, 0xfffffffb
add ebx, ebx
sub ebx, eax
cmp ebx, 4
jb 0x433b70
mov eax, dword [esi + 0xc]
mov dword [esp + 0x58], eax
push esi
call fcn.00407fb0
add esp, 4
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call esi
push dword [esp + 0x3c]
call esi
lea esi, [esp + 0x84]
lea edi, [esp + 8]
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x4442a0]
call fcn.00439000
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push esi
call eax
test eax, eax
mov esi, dword [ebp + 8]
je 0x433c03
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
xor edi, edi
jmp 0x433c1d
add esi, 8
inc edi
cmp edi, 4
je 0x433d07
mov dword [esp + 4], esi
mov eax, 0
test edi, edi
je 0x433c34
cmp dword [esp + edi*4 + 0x4c], 1
mov eax, edi
sbb eax, 0
mov dword [esp + 0x40], edi
mov edx, dword [esp + eax*4 + 0x4c]
mov eax, edx
and eax, 0xffe5a7ba
mov dword [esp + 0x3c], eax
mov esi, edx
and esi, 0x1a5845
mov eax, edx
or eax, 0x1a5845
imul eax, esi
mov dword [esp + 8], 0xd4c66a04
mov dword [esp + 0xc], 0xe0eae0e9
xor edi, edi
nop
nop
nop
nop
nop
mov esi, edi
and esi, 2
mov ecx, edi
or ecx, 2
imul ecx, esi
xor esi, 2
mov ebx, edi
and ebx, 1
neg ebx
and ebx, esi
mov esi, edi
xor esi, 0xc48f
add esi, ebx
add esi, ecx
xor si, word [esp + edi*2 + 8]
add esi, 0xffffdb88
mov word [esp + edi*2 + 8], si
inc edi
cmp edi, 4
jne 0x433c70
not edx
and edx, 0x1a5845
mov ecx, dword [esp + 0x3c]
imul ecx, edx
add eax, ecx
add eax, dword [esp + 8]
mov edi, dword [esp + 0x40]
mov dword [esp + edi*4 + 0x4c], eax
mov ebx, 0xfffffff7
push 0x10
push 9
mov esi, dword [esp + 0xc]
push esi
push eax
call fcn.0041c0c0
add esp, 0x10
nop
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne 0x433ce0
test ebx, ebx
je 0x433c10
add eax, ebx
neg ebx
push ebx
push 0x30
push eax
call fcn.00408140
add esp, 0xc
jmp 0x433c10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret