Function at 0x4389d0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [esp + 0x48], eax
mov eax, dword [0x44d2b4]
mov dword [esp + 0xc], 0xc1bbc7eb
mov dword [esp + 0x10], 0xcd5fc35b
mov dword [esp + 0x14], 0xc9a1cf50
mov dword [esp + 0x18], 0xf586cb5f
mov dword [esp + 0x1c], 0xf19df766
mov dword [esp + 0x20], 0xfd9df36e
mov dword [esp + 0x24], 0xf9feffd3
mov word [esp + 0x28], 0
mov ecx, 0x39e7e9d2
mov edx, 0x618162e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x39e7e9c6]
mov edi, esi
and edi, 0xffffffec
xor edi, 0x1a2ffaec
mov ebx, esi
xor ebx, 0x1a2ffaec
or esi, 0x13
and esi, ebx
or esi, edi
mov edi, edx
and edi, 0x208122c
mov ebx, edx
or ebx, 0xe5d00513
add ebx, ecx
or ebx, edi
xor ebx, esi
mov esi, 1
sub esi, ebx
not esi
and esi, 1
or ebx, 1
add ebx, esi
add bl, 0xea
mov byte [esp + ecx - 0x39e7e9c6], bl
inc ecx
dec edx
cmp ecx, 0x39e7e9f0
jne 0x438a40
lea ecx, [esp + 0x58]
lea ebx, [esp + 0x84]
lea edi, [esp + 0xc]
push ecx
push 8
push ebx
push 0xd
push edi
push 0
call eax
test eax, eax
jns 0x438ac6
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x64], 0x125070fb
mov dword [esp + 0x60], 0xacfe261e
mov dword [esp + 0x5c], 0xdaf5c966
mov dword [esp + 0x58], 0xbe4c19dc
mov dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x443668
push 1
push 0
push 0x443678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x438f56
mov dword [esp + 0xc], 0x79cb7bb2
mov dword [esp + 0x10], 0x7dca7fc9
mov dword [esp + 0x14], 0x713773d0
mov dword [esp + 0x18], 0x75c577cf
mov dword [esp + 0x1c], 0x693c6bde
mov word [esp + 0x20], 0x6f68
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
mov eax, 0xeb8d8bf
mov ecx, 0x40
movzx edx, byte [esp + eax - 0xeb8d8b3]
mov esi, ecx
and esi, edx
mov edi, eax
and edi, edx
add edi, esi
mov esi, eax
xor esi, edx
add esi, edx
sub esi, edi
add esi, 0x96a92c49
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xfb
mov byte [esp + eax - 0xeb8d8b3], dl
inc eax
dec ecx
cmp eax, 0xeb8d8da
jne 0x438b60
lea edi, [esp + 0xc]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x438f45
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x20]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x438f3b
mov dword [esp + 0x6c], esi
mov dword [esp + 0xc], 0x8f5f8923
mov dword [esp + 0x10], 0x83828d50
mov eax, 0x6fba1ee2
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x6fba1ed6]
lea edx, [eax - 0x6fba1e00]
or edx, eax
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, 0x14
sub edx, ecx
add ecx, 0xab
and edx, 0x16
and ecx, 0xe9
sub ecx, edx
inc cl
mov byte [esp + eax - 0x6fba1ed6], cl
inc eax
cmp eax, 0x6fba1eea
jne 0x438c10
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x44], eax
mov dword [esp + 0xc], 0x21592749
mov dword [esp + 0x10], 0x5d5d2354
mov dword [esp + 0x14], 0x59325f21
mov dword [esp + 0x18], 0x55005b78
mov dword [esp + 0x1c], 0x51285774
mov dword [esp + 0x20], 0x4d235322
mov dword [esp + 0x24], 0x496e4f3b
mov dword [esp + 0x28], 0x45d14b21
mov dword [esp + 0x2c], 0x410b47d2
mov dword [esp + 0x30], 0x7d234312
mov dword [esp + 0x34], 0x79057f3e
mov dword [esp + 0x38], 0x75177b09
mov word [esp + 0x3c], 0x7774
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
mov eax, 0x5d6a5d39
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x5d6a5d2d]
xor edx, eax
mov esi, edx
mov ecx, edx
xor ecx, 0xe2
add ecx, edx
and edx, 0xe2
and esi, 0x1d
sub ecx, esi
add ecx, edx
inc cl
mov byte [esp + eax - 0x5d6a5d2d], cl
inc eax
cmp eax, 0x5d6a5d71
jne 0x438ce0
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 4]
mov ecx, dword [esi]
lea edx, [esp + 0x54]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x54]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x438f25
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
lea esi, [esp + 0x50]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x438f1b
cmp eax, 1
je 0x438f1b
cmp dword [esp + 0x4c], 0
je 0x438f1b
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 0xc], 0xd77bc917
mov dword [esp + 0x10], 0xd37bd56a
mov dword [esp + 0x14], 0xdf6ad171
mov dword [esp + 0x18], 0xdb67dd0e
mov dword [esp + 0x1c], 0xa708d96d
mov dword [esp + 0x20], 0xa31ca509
mov dword [esp + 0x24], 0xa1a0
mov byte [esp + 0x28], 0
xor edx, edx
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0xc]
lea eax, [esi + 1]
or eax, 0xfcb5242e
mov ebx, edx
or ebx, 0xfcb5242e
add ebx, eax
lea eax, [edi + edi]
not eax
add eax, edi
mov ecx, esi
sub ecx, ebx
and ecx, edi
not edi
or edi, eax
lea eax, [edx + ebx]
inc eax
and edi, eax
or ecx, edi
add cl, 0x1a
mov byte [esp + edx + 0xc], cl
inc edx
dec esi
cmp edx, 0x1d
jne 0x438de0
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea edi, [esp + 0x1c]
push edi
push ecx
call dword [eax + 0x10]
test eax, eax
js 0x438f03
cmp word [esp + 0x70], 8
jne 0x438f03
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp], eax
je 0x438e9d
add eax, 2
xor ebx, ebx
jmp 0x438e7c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x438e9f
cmp cx, 0x7f
jbe 0x438e70
movzx edx, cx
cmp edx, 0x7ff
ja 0x438e92
add ebx, 2
jmp 0x438e71
cmp cx, 0xffff
je 0x438e71
add ebx, 3
jmp 0x438e71
xor ebx, ebx
lea esi, [ebx + 1]
push esi
call fcn.00408380
add esp, 4
push dword [esp]
push esi
mov dword [esp + 8], eax
push eax
call fcn.0042ec40
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x438ecd
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
lea ecx, [esp + 0x58]
lea esi, [esp + 0x70]
jb 0x438ee4
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 4]
push ebx
push ecx
call fcn.004083b0
add esp, 0xc
push ebx
call fcn.00408390
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ebx, [esp + 0x84]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x44]
call esi
push dword [esp + 0x68]
call esi
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44d2ac]
call fcn.0043f550
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x438f85
mov eax, dword [esp + 0xc]
mov dword [esp + 0x58], eax
xor esi, esi
jmp 0x438f9f
add dword [esp + 0x48], 8
inc esi
cmp esi, 4
je 0x439034
mov eax, 0
test esi, esi
je 0x438fb2
cmp dword [esp + esi*4 + 0x58], 1
mov eax, esi
sbb eax, 0
mov eax, dword [esp + eax*4 + 0x58]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x58], eax
mov edi, 0xffffffff
mov ebx, 0xfffffffe
push 0x10
push 9
push dword [esp + 0x50]
push eax
call fcn.0041f900
add esp, 0x10
nop
nop
nop
add ebx, 2
cmp byte [eax + edi + 1], 0
lea edi, [edi + 1]
jne 0x439000
xor edi, 8
not ebx
and ebx, 0x10
mov ecx, ebx
sub ecx, edi
je 0x438f90
sub edi, ebx
add eax, edi
push ecx
push 0x30
push eax
call fcn.00408400
add esp, 0xc
jmp 0x438f90
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret