Function at 0x437990
Capabilities:
Authenticate hmac
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x44da98]
mov dword [esp + 4], 0xe10be7db
mov dword [esp + 8], 0xfd6fe36b
mov dword [esp + 0xc], 0xf901ff70
mov dword [esp + 0x10], 0xf526fb0f
mov dword [esp + 0x14], 0xf10df706
mov dword [esp + 0x18], 0x8d0df37e
mov dword [esp + 0x1c], 0x898e8fb3
xor ecx, ecx
xor edx, edx
mov esi, edx
xor esi, 0xdcb97257
mov ebx, ecx
and ebx, 0x10
sub ebx, esi
mov esi, ebx
not esi
and esi, 6
mov edi, ebx
xor edi, 6
or ebx, 0xf9
and ebx, edi
or ebx, esi
xor bl, byte [esp + edx + 4]
xor bl, 6
add bl, 0xb3
mov byte [esp + edx + 4], bl
inc edx
add ecx, 2
cmp edx, 0x1c
jne 0x4379e0
lea ecx, [esp + 0x48]
lea ebx, [esp + 0x84]
lea esi, [esp + 4]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x437a45
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
lea eax, [esp + 0x44]
push eax
push 0x444aa8
push 1
push 0
push 0x444ab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov edi, dword [ebp + 8]
js 0x437eaa
mov dword [esp + 4], 0x19cb1bc2
mov dword [esp + 8], 0xe53ae7c9
mov dword [esp + 0xc], 0xe12fe340
mov dword [esp + 0x10], 0xed3def37
mov dword [esp + 0x14], 0xe914eb36
mov dword [esp + 0x18], 0xf7e8
mov byte [esp + 0x1c], 0
mov eax, 0x7b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x77]
mov edx, eax
and edx, ecx
lea esi, [eax - 0x59bc4100]
or esi, ecx
xor esi, edx
mov ecx, esi
and ecx, 0x18
xor esi, 0x98
lea ecx, [esi + ecx*2]
inc cl
mov byte [esp + eax - 0x77], cl
inc eax
cmp eax, 0x94
jne 0x437ae0
lea esi, [esp + 4]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], edi
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
js 0x437e96
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x5c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x437e8c
mov dword [esp + 4], 0x9e50be5
mov dword [esp + 8], 0x50607dc
mov word [esp + 0xc], 0
mov esi, 0x43
mov ecx, 0xbc
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x3f]
lea edi, [ecx - 0xa0]
and edi, 0x1b
mov eax, esi
and eax, 0x44
or eax, edi
mov ebx, ecx
or ebx, edx
xor eax, 0xe4
or eax, ecx
and eax, edx
not ebx
or ebx, eax
add bl, 0xb1
mov byte [esp + esi - 0x3f], bl
inc esi
dec ecx
cmp esi, 0x4d
jne 0x437b90
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 4], 0x49b14ba1
mov dword [esp + 8], 0x45bd47bc
mov dword [esp + 0xc], 0x41ae43b9
mov dword [esp + 0x10], 0x7da87f60
mov dword [esp + 0x14], 0x79807b5c
mov dword [esp + 0x18], 0x75877796
mov dword [esp + 0x1c], 0x71527387
mov dword [esp + 0x20], 0x6df96f99
mov dword [esp + 0x24], 0x69a76bfe
mov dword [esp + 0x28], 0x658767a6
mov dword [esp + 0x2c], 0x6195639a
mov dword [esp + 0x30], 0x1df31f91
mov word [esp + 0x34], 0x1b1c
mov dword [esp + 0x36], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0x26
mov edx, ecx
xor edx, 0x93
add edx, esi
xor dl, byte [esp + ecx + 4]
add dl, 0x21
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 0x36
jne 0x437c50
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x40]
mov ecx, dword [esi]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
mov dword [esp + 0x70], eax
push eax
mov dword [esp + 0x78], edi
push edi
push esi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
lea ebx, [esp + 0x84]
js 0x437e76
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea esi, [esp + 0x5c]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437e6c
cmp eax, 1
je 0x437e6c
cmp dword [esp + 0x58], 0
je 0x437e6c
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], 0xb921bb71
mov dword [esp + 8], 0xbd21bf2e
mov dword [esp + 0xc], 0xb12eb35b
mov dword [esp + 0x10], 0xb53db742
mov dword [esp + 0x14], 0xa94cab27
mov dword [esp + 0x18], 0xad38af33
mov dword [esp + 0x1c], 0xa3ac
mov byte [esp + 0x20], 0
mov ecx, 0x57e788df
mov edx, 0x20
nop
movzx esi, byte [esp + ecx - 0x57e788db]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
mov esi, edi
and esi, 0x24
xor edi, 0xa4
lea ebx, [edi + esi*2]
inc bl
mov byte [esp + ecx - 0x57e788db], bl
inc ecx
dec edx
cmp ecx, 0x57e788fc
jne 0x437d40
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
mov edi, dword [ebp + 8]
js 0x437e54
cmp word [esp + 0x70], 8
jne 0x437e54
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x3c], eax
je 0x437ded
add eax, 2
xor ebx, ebx
jmp 0x437dcc
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x437def
cmp cx, 0x7f
jbe 0x437dc0
movzx edx, cx
cmp edx, 0x7ff
ja 0x437de2
add ebx, 2
jmp 0x437dc1
cmp cx, 0xffff
je 0x437dc1
add ebx, 3
jmp 0x437dc1
xor ebx, ebx
lea esi, [ebx + 1]
push esi
call fcn.0040c8c0
add esp, 4
push dword [esp + 0x3c]
push esi
mov dword [esp + 0x44], eax
push eax
call fcn.0042c970
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x437e1e
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x70]
jb 0x437e31
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 0x40]
push ebx
lea eax, [esp + 0x50]
push eax
call fcn.0040c8f0
add esp, 0xc
push ebx
call fcn.0040c8d0
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ebx, [esp + 0x84]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x68]
call esi
push dword [esp + 0x64]
call esi
lea esi, [esp + 4]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 4], 0
push 0x72a7c387
push dword [0x44da90]
call fcn.00440ed0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x43801e
imul eax, dword [esp + 4], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x48], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041db10
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x437f10
test esi, esi
je 0x437f2e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040c940
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x48], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041db10
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x437f60
test esi, esi
je 0x437f7e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040c940
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x50], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x4c], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x50], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041db10
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x437fb0
test esi, esi
je 0x437fce
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040c940
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x54], 0
setne al
imul eax, dword [esp + eax*4 + 0x50], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041db10
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438000
test esi, esi
je 0x43801e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040c940
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret