Function at 0x438760
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov ebx, dword [ebp + 8]
mov eax, dword [0x44cd54]
mov dword [esp + 4], 0xb74989a5
mov dword [esp + 8], 0xb32db52d
mov dword [esp + 0xc], 0xbf53b12c
mov dword [esp + 0x10], 0xbb76bd29
mov dword [esp + 0x14], 0xa74fb926
mov dword [esp + 0x18], 0xa34fa53e
mov dword [esp + 0x1c], 0xafaea18d
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
xor ecx, ecx
nop
nop
nop
mov edx, ecx
add dl, 0x5e
xor dl, byte [esp + ecx + 4]
add dl, 0x2a
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x1f
jne 0x4387c0
lea edi, [esp + 0x40]
lea ecx, [esp + 0x84]
lea esi, [esp + 4]
push edi
push 8
push ecx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x4387ff
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x4c], 0xa5455e50
mov dword [esp + 0x48], 0x87ba1ec2
mov dword [esp + 0x44], 0x2a41c6e1
mov dword [esp + 0x40], 0x50dd0200
mov dword [esp + 0x3c], 0
lea eax, [esp + 0x3c]
push eax
push 0x443670
push 1
push 0
push 0x443680
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x438d6d
mov dword [esp + 4], 0xb17f8f7e
mov dword [esp + 8], 0xb546b341
mov dword [esp + 0xc], 0xb973b748
mov dword [esp + 0x10], 0xbd75bb73
mov dword [esp + 0x14], 0xa16cbf4a
mov word [esp + 0x18], 0xa3a0
mov dword [esp + 0x1a], 0
xor eax, eax
xor ecx, ecx
nop
nop
mov esi, eax
and esi, 0x3a
mov edx, ecx
xor edx, 0xdd
add edx, esi
xor dl, byte [esp + ecx + 4]
add dl, 0xaf
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 0x1a
jne 0x438890
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], esi
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x438d55
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x54]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x438d4b
mov dword [esp + 4], 0x23f321f7
mov dword [esp + 8], 0x272625f8
mov word [esp + 0xc], 0
mov eax, 0x513bef48
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x513bef44]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x98
mov byte [esp + eax - 0x513bef44], cl
inc eax
cmp eax, 0x513bef52
jne 0x438930
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 4], 0x1490759
mov dword [esp + 8], 0xd4d0354
mov dword [esp + 0xc], 0x9520f41
mov dword [esp + 0x10], 0x15200b28
mov dword [esp + 0x14], 0x11581734
mov dword [esp + 0x18], 0x1d431342
mov dword [esp + 0x1c], 0x193e1f4b
mov dword [esp + 0x20], 0x25711b41
mov dword [esp + 0x24], 0x211b2752
mov dword [esp + 0x28], 0x2d432312
mov dword [esp + 0x2c], 0x29652f6e
mov dword [esp + 0x30], 0x35772b79
mov dword [esp + 0x34], 0x3734
xor eax, eax
xor ecx, ecx
mov edi, eax
and edi, 2
mov edx, ecx
xor edx, 0x81
add edx, edi
xor dl, byte [esp + ecx + 4]
add dl, 0x7b
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 0x34
jne 0x4389d0
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
push edx
push 0
push 0x30
push edi
mov dword [esp + 0x78], esi
push esi
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x438d38
mov dword [esp + 0x64], edi
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
lea edi, [esp + 0x54]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x438d2a
cmp eax, 1
je 0x438d2a
cmp dword [esp + 0x50], 0
je 0x438d2a
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x54]
mov dword [esp], eax
mov dword [esp + 4], 0xff1bf90f
mov dword [esp + 8], 0xe30bfd6a
mov dword [esp + 0xc], 0xe70ae101
mov dword [esp + 0x10], 0xeb7fe516
mov dword [esp + 0x14], 0xef08e905
mov dword [esp + 0x18], 0x9304ed09
mov dword [esp + 0x1c], 0x9190
mov byte [esp + 0x20], 0
mov ecx, 0x7b4eeaaa
mov edx, 0x84b11555
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x7b4eeaa6]
mov edi, edx
or edi, ebx
lea eax, [edx + 0x7b4eeb00]
and eax, ebx
not edi
or edi, eax
lea eax, [edi + edi]
not eax
add eax, edi
and eax, ecx
add al, al
sub bl, al
movzx eax, bl
add eax, ecx
add al, 0xae
mov byte [esp + ecx - 0x7b4eeaa6], al
inc ecx
dec edx
cmp ecx, 0x7b4eeac7
jne 0x438ac0
mov edx, dword [esp]
mov eax, dword [edx]
push 0
push 0
push esi
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [eax + 0x10]
test eax, eax
js 0x438d16
cmp word [esp + 0x70], 8
jne 0x438d16
mov ebx, dword [esp + 0x78]
movzx ecx, word [ebx]
test cx, cx
je 0x438b6d
lea eax, [ebx + 2]
xor esi, esi
jmp 0x438b4c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x438b6f
cmp cx, 0x7f
jbe 0x438b40
movzx edx, cx
cmp edx, 0x7ff
ja 0x438b62
add esi, 2
jmp 0x438b41
cmp cx, 0xffff
je 0x438b41
add esi, 3
jmp 0x438b41
xor esi, esi
mov eax, esi
and eax, 1
mov dword [esp + 0x60], esi
xor esi, 1
mov dword [esp + 0x5c], eax
lea eax, [esi + eax*2]
push eax
call fcn.004083b0
add esp, 4
mov edi, eax
movzx edx, word [ebx]
mov dword [esp], eax
test dx, dx
je 0x438cc8
mov eax, dword [esp + 0x5c]
lea eax, [esi + eax*2]
dec eax
mov edi, dword [esp]
test eax, eax
je 0x438cc8
mov edi, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, dx
lea esi, [ebx + 2]
cmp dx, 0x7f
ja 0x438be0
lea ecx, [edi + 1]
mov byte [edi], dl
jmp 0x438c70
cmp edx, 0x7ff
ja 0x438c05
cmp eax, 2
jb 0x438c05
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [edi], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [edi + 2]
mov byte [edi + 1], dl
jmp 0x438c70
mov ecx, edx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x438c8a
cmp eax, 4
jb 0x438c8a
movzx esi, word [ebx + 2]
add ebx, 4
shl edx, 0xa
lea ecx, [edx + esi]
add ecx, 0xfca02400
mov edx, ecx
shr edx, 0x12
add dl, 0xf0
mov byte [edi], dl
mov edx, ecx
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [edi + 1], dl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 2], cl
mov ecx, esi
and cl, 0x3f
or cl, 0x80
mov edx, ecx
lea ecx, [edi + 4]
mov byte [edi + 3], dl
mov esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
sub eax, ecx
mov ebx, esi
mov edi, ecx
movzx edx, word [ebx]
test dx, dx
je 0x438cc8
test eax, eax
jne 0x438bc0
jmp 0x438cc8
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x438c99
mov ebx, esi
jmp 0x438c78
cmp eax, 3
jb 0x438cc4
mov ecx, edx
shr ecx, 0xc
or cl, 0xe0
mov byte [edi], cl
mov ecx, edx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [edi + 3]
mov byte [edi + 2], dl
jmp 0x438c70
mov ecx, edi
jmp 0x438c70
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x60]
sub eax, ecx
cmp eax, 0xfffffffd
lea esi, [esp + 0x70]
jae 0x438ce4
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
jb 0x438cf3
mov eax, 3
lea eax, [eax*4 + 4]
lea ecx, [esp + 0x40]
push eax
mov edi, dword [esp + 4]
push edi
push ecx
call fcn.004083e0
add esp, 0xc
push edi
call fcn.004083c0
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp + 8]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [esp + 0x64]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x68]
call esi
push edi
call esi
lea edi, [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 4]
push 0xbeb8f1a1
push dword [0x44cd4c]
call fcn.0043f9f0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x438d9d
mov edi, esi
mov ecx, dword [edi]
imul eax, ecx, 0x1a5845
imul ecx, ecx, 0x34b08a
and ecx, 0xd7bd1426
xor eax, 0xebde8a13
add eax, ecx
mov dword [esp + 0x40], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.004206f0
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438dd0
test esi, esi
je 0x438dee
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408430
add esp, 0xc
lea eax, [ebx + 8]
xor ecx, ecx
cmp dword [esp + 0x44], 0
setne cl
mov edx, dword [esp + ecx*4 + 0x40]
imul ecx, edx, 0x1a5845
imul edx, edx, 0x34b08a
and edx, 0xd7bd1426
xor ecx, 0xebde8a13
add ecx, edx
mov dword [esp + 0x44], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.004206f0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438e30
test esi, esi
je 0x438e4e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408430
add esp, 0xc
lea eax, [ebx + 0x10]
xor ecx, ecx
cmp dword [esp + 0x48], 0
setne cl
mov edx, dword [esp + ecx*4 + 0x44]
imul ecx, edx, 0x1a5845
imul edx, edx, 0x34b08a
and edx, 0xd7bd1426
xor ecx, 0xebde8a13
add ecx, edx
mov dword [esp + 0x48], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.004206f0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438e90
test esi, esi
je 0x438eae
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408430
add esp, 0xc
add ebx, 0x18
xor eax, eax
cmp dword [esp + 0x4c], 0
setne al
mov ecx, dword [esp + eax*4 + 0x48]
imul eax, ecx, 0x1a5845
imul ecx, ecx, 0x34b08a
and ecx, 0xd7bd1426
xor eax, 0xebde8a13
add eax, ecx
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.004206f0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438ef0
test esi, esi
je 0x438f0e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408430
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret