Function at 0x4330e0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x44531c]
mov dword [esp + 0xc], 0xc181c074
mov dword [esp + 0x10], 0xc1a7c1da
mov dword [esp + 0x14], 0xc1b3c1a1
mov dword [esp + 0x18], 0xc1acc1aa
mov dword [esp + 0x1c], 0xc193c19b
mov dword [esp + 0x20], 0xc189c19d
mov dword [esp + 0x24], 0xc06ec048
mov ecx, 0xe49a
mov edx, 0x1b66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + ecx*2 - 0x1c928]
mov edi, esi
not edi
or edi, edx
add esi, edi
inc esi
add edi, ecx
or edi, esi
add edi, 0xffffdb38
mov word [esp + ecx*2 - 0x1c928], di
inc ecx
dec edx
cmp ecx, 0xe4a8
jne 0x433140
lea ecx, [esp + 0x5c]
lea ebx, [esp + 0x84]
lea esi, [esp + 0xc]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x433196
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x68], 0xa3094d62
mov dword [esp + 0x64], 0x4f278a86
mov dword [esp + 0x60], 0xd3bc040b
mov dword [esp + 0x5c], 0x5388eeab
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x4c]
push eax
push 0x43c678
push 1
push 0
push 0x43c688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4336e3
mov dword [esp + 0xc], 0xfdd8fd24
mov dword [esp + 0x10], 0xfd2dfdd7
mov dword [esp + 0x14], 0xfdd8fd26
mov dword [esp + 0x18], 0xfdd0fdd5
mov dword [esp + 0x1c], 0xfdcdfd28
mov word [esp + 0x20], 0xfd80
mov eax, 0x1ef738a6
nop
nop
movzx ecx, word [esp + eax*2 - 0x3dee7140]
lea edx, [eax - 0x1ef70000]
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, ecx
and edx, 0x3acf
xor ecx, 0x3acf
lea ecx, [ecx + edx*2]
inc ecx
mov word [esp + eax*2 - 0x3dee7140], cx
inc eax
cmp eax, 0x1ef738b1
jne 0x433220
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4336d2
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x64]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4336c8
mov dword [esp + 4], edi
mov dword [esp + 0xc], 0x4faa4fad
mov dword [esp + 0x10], 0x4f5d4f90
mov eax, 0x683b08f5
mov ecx, esi
nop
nop
movzx esi, word [ecx]
mov edx, eax
or edx, esi
lea edi, [eax - 0x683b0000]
and edi, esi
lea esi, [edi + edi]
not esi
add esi, edi
mov edi, edx
not edi
or edi, esi
add edi, edx
mov edx, 0x47ae
sub edx, edi
mov word [ecx], dx
add ecx, 2
dec eax
cmp eax, 0x683b08f1
jne 0x4332c0
lea esi, [esp + 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc0a0c7d
mov dword [esp + 0x10], 0xc740c7c
mov dword [esp + 0x14], 0xc070c71
mov dword [esp + 0x18], 0xc5f0c54
mov dword [esp + 0x1c], 0xc710c56
mov dword [esp + 0x20], 0xc760c0a
mov dword [esp + 0x24], 0xc5b0c77
mov dword [esp + 0x28], 0xc140c0b
mov dword [esp + 0x2c], 0xc6c0c10
mov dword [esp + 0x30], 0xc1e0c72
mov dword [esp + 0x34], 0xc6a0c60
mov dword [esp + 0x38], 0xc160c6b
mov word [esp + 0x3c], 0xfa6
mov eax, 0xfe3e
nop
nop
movzx ecx, word [esp + eax*2 - 0x1fc70]
mov edx, eax
and edx, ecx
lea edi, [eax - 0x173e0000]
or edi, ecx
lea ecx, [edx + edx]
not ecx
add ecx, edx
and ecx, edi
mov edx, ecx
and edx, 0xe0f
xor ecx, 0xe0f
lea ecx, [ecx + edx*2]
inc ecx
mov word [esp + eax*2 - 0x1fc70], cx
inc eax
cmp eax, 0xfe57
jne 0x433370
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x48]
mov ecx, dword [edi]
lea edx, [esp + 0x58]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
push dword [esp + 0x18]
push edi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [esp + 4]
js 0x4336b2
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
lea edi, [esp + 0x54]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4336a4
cmp eax, 1
je 0x4336a4
cmp dword [esp + 0x50], 0
je 0x4336a4
lea edi, [esp + 0x70]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], 0x3d593d48
mov dword [esp + 0x10], 0x3da73daf
mov dword [esp + 0x14], 0x3dac3d5e
mov dword [esp + 0x18], 0x3da73d4f
mov dword [esp + 0x1c], 0x3d563dae
mov dword [esp + 0x20], 0x3da43d50
mov word [esp + 0x24], 0x3d37
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx - 0x23dd]
xor dx, word [esp + ecx*2 + 0xc]
add edx, 0x1ee8
mov word [esp + ecx*2 + 0xc], dx
inc ecx
cmp ecx, 0xd
jne 0x433470
mov ecx, dword [eax]
push 0
push 0
push edi
push 0
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x433693
cmp word [esp + 0x70], 8
jne 0x433693
mov esi, dword [esp + 0x78]
movzx ecx, word [esi]
test cx, cx
je 0x4334fd
lea eax, [esi + 2]
xor edi, edi
jmp 0x4334dc
inc edi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4334ff
cmp cx, 0x7f
jbe 0x4334d0
movzx edx, cx
cmp edx, 0x7ff
ja 0x4334f2
add edi, 2
jmp 0x4334d1
cmp cx, 0xffff
je 0x4334d1
add edi, 3
jmp 0x4334d1
xor edi, edi
mov ebx, edi
lea eax, [edi + 1]
push eax
call fcn.00408000
add esp, 4
mov edx, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edi
test edi, edi
je 0x43363e
movzx eax, word [esi]
mov edx, dword [esp + 0x40]
test ax, ax
je 0x43363e
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x433560
lea eax, [edx + 1]
mov byte [edx], bl
jmp 0x4335e0
cmp ebx, 0x7ff
ja 0x433584
cmp ecx, 2
jb 0x433584
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [edx], al
and bl, 0x3f
or bl, 0x80
lea eax, [edx + 2]
mov byte [edx + 1], bl
jmp 0x4335e0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x433604
cmp ecx, 4
jb 0x433604
movzx edi, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + edi]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [edx], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [edx + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edx + 2], al
mov eax, edi
and al, 0x3f
or al, 0x80
mov ebx, eax
lea eax, [edx + 4]
mov byte [edx + 3], bl
mov edi, esi
nop
nop
nop
nop
nop
mov esi, eax
not esi
and esi, edx
not edx
and edx, eax
sub ecx, edx
add ecx, esi
mov esi, edi
mov edx, eax
movzx eax, word [esi]
test ax, ax
je 0x43363e
test ecx, ecx
jne 0x433540
jmp 0x43363e
movzx eax, ax
cmp eax, 0xdc00
jne 0x433612
mov esi, edi
jmp 0x4335f2
cmp ecx, 3
jb 0x43363a
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [edx], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edx + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [edx + 3]
mov byte [edx + 2], bl
jmp 0x4335e0
mov eax, edx
jmp 0x4335e0
mov byte [edx], 0
mov eax, 3
sub eax, dword [esp + 0x44]
cmp eax, 0xfffffffd
jae 0x433654
mov eax, 0xfffffffc
add eax, dword [esp + 0x44]
shr eax, 2
cmp eax, 3
lea ebx, [esp + 0x84]
jb 0x43366c
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov esi, dword [esp + 0x44]
push esi
lea eax, [esp + 0x64]
push eax
call fcn.00408030
add esp, 0xc
push esi
call fcn.00408010
add esp, 4
lea edi, [esp + 0x70]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [esp + 4]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 8]
call esi
push dword [esp + 0x6c]
call esi
lea esi, [esp + 0xc]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x444314]
call fcn.00438a90
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
test eax, eax
mov edi, dword [ebp + 8]
je 0x433715
mov eax, dword [esp + 0xc]
mov dword [esp + 0x5c], eax
xor esi, esi
jmp 0x43372d
add edi, 8
inc esi
cmp esi, 4
je 0x433807
mov dword [esp + 8], edi
mov eax, 0
test esi, esi
je 0x433744
cmp dword [esp + esi*4 + 0x5c], 1
mov eax, esi
sbb eax, 0
mov eax, dword [esp + eax*4 + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x11d46f2a
mov dword [esp + 0x10], 0xe53ce53b
xor ecx, ecx
nop
nop
movzx ebx, word [esp + ecx*2 + 0xc]
lea edx, [ecx + 0xe0b1]
and edx, ebx
mov eax, edx
and eax, 2
mov edi, edx
or edx, 2
imul edx, eax
xor eax, 2
and edi, 0xe0b5
imul edi, eax
add edx, edi
lea eax, [ecx + ebx]
add eax, 0xe0f7e0b1
mov edi, edx
xor edi, eax
not edx
and edx, eax
add edx, edx
sub edx, edi
add edx, 0xfffffa78
mov word [esp + ecx*2 + 0xc], dx
mov eax, ecx
or eax, 1
xor ecx, 0xfffffffe
and ecx, eax
add ecx, eax
cmp ecx, 4
jb 0x433760
imul eax, dword [esp + 4], 0x1a5845
add eax, dword [esp + 0xc]
mov dword [esp + esi*4 + 0x5c], eax
mov ebx, 0xfffffff7
push 0x10
push 9
mov edi, dword [esp + 0x10]
push edi
push eax
call fcn.0041c4c0
add esp, 0x10
nop
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne 0x4337e0
test ebx, ebx
je 0x433720
add eax, ebx
neg ebx
push ebx
push 0x30
push eax
call fcn.00408080
add esp, 0xc
jmp 0x433720
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret