Function at 0x439470
Capabilities:
Authenticate hmac
Connect to wmi namespace via wbemlocator
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44cda8]
mov dword [esp + 0x1c], 0x83d181e5
mov dword [esp + 0x20], 0x8735853d
mov dword [esp + 0x24], 0x8b2f893c
mov dword [esp + 0x28], 0x8fca8d21
mov dword [esp + 0x2c], 0x933b9122
mov dword [esp + 0x30], 0x97339522
mov dword [esp + 0x34], 0x9b9a99fd
mov word [esp + 0x38], 0
mov ecx, 0x57208ab7
mov edx, 0xae41156e
mov esi, edx
and esi, 0xd2
mov ebx, ecx
xor ebx, 0xe9
add ebx, esi
xor bl, byte [esp + ecx - 0x57208a9b]
add bl, 0xe0
mov byte [esp + ecx - 0x57208a9b], bl
inc ecx
add edx, 2
cmp ecx, 0x57208ad5
jne 0x4394d0
lea ecx, [esp + 4]
lea ebx, [esp + 0x84]
lea esi, [esp + 0x1c]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x439528
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x10], 0xe9638814
mov dword [esp + 0xc], 0x2239c5d7
mov dword [esp + 8], 0x47fba8b4
mov dword [esp + 4], 0x371400f0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x58]
push eax
push 0x443668
push 1
push 0
push 0x443678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x439b3d
mov dword [esp + 0x1c], 0x17651976
mov dword [esp + 0x20], 0x137e1567
mov dword [esp + 0x24], 0xf711174
mov dword [esp + 0x28], 0xb7f0d75
mov dword [esp + 0x2c], 0x7480962
mov word [esp + 0x30], 0x504
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
xor eax, eax
mov ecx, 0xffffffff
nop
mov dword [esp + 0x14], eax
mov dword [esp], ecx
movzx edx, byte [esp + eax + 0x1c]
mov esi, dword [esp]
or esi, 0x67c8ed06
mov ebx, eax
or ebx, 0x67c8ed06
lea ecx, [ebx + esi]
add ecx, eax
inc ecx
mov edi, edx
not edi
and edi, ecx
mov ecx, eax
and ecx, 0x19
xor ecx, 0x983712f9
sub ecx, esi
add ecx, dword [esp]
or ecx, edi
mov edi, ecx
not edi
and ecx, 2
mov eax, edi
and eax, 0xfffffffd
imul eax, ecx
mov ecx, edi
and ecx, 2
or edi, 2
imul edi, ecx
add edi, eax
sub edi, ebx
sub edi, esi
sub edi, edx
add edi, dword [esp]
lea eax, [edi + edi]
and eax, 0xdd9423e
xor edi, 0xf9135ee0
sub edi, eax
lea edx, [edi + 1]
mov eax, edx
not eax
or eax, 1
lea esi, [edi + eax]
add esi, 2
mov eax, esi
and eax, 2
mov edi, esi
or esi, 2
imul esi, eax
xor eax, 2
and edi, 0xfd
imul edi, eax
xor edx, 1
add edx, esi
mov ecx, dword [esp]
add edx, edi
mov eax, dword [esp + 0x14]
mov byte [esp + eax + 0x1c], dl
inc eax
dec ecx
cmp eax, 0x1b
jne 0x4395c0
lea esi, [esp + 0x1c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x58]
mov ecx, dword [edi]
lea edx, [esp + 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x1c], eax
push eax
push edi
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
lea ebx, [esp + 0x84]
js 0x439b2a
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x70]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x439b20
mov dword [esp + 0x1c], 0x77a779d3
mov dword [esp + 0x20], 0x737275a0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x16
xor cl, byte [esp + eax + 0x1c]
add cl, 0x92
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 8
jne 0x4396f0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0xe139e709
mov dword [esp + 0x20], 0xfd3de334
mov dword [esp + 0x24], 0xf912ff21
mov dword [esp + 0x28], 0xf5c0fbd8
mov dword [esp + 0x2c], 0xf128f7d4
mov dword [esp + 0x30], 0x8d23f322
mov dword [esp + 0x34], 0x89ae8f5b
mov dword [esp + 0x38], 0x85718b61
mov dword [esp + 0x3c], 0x814b8772
mov dword [esp + 0x40], 0x9d6383b2
mov dword [esp + 0x44], 0x99459f5e
mov dword [esp + 0x48], 0x95779b49
mov word [esp + 0x4c], 0x9794
mov dword [esp + 0x4e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x1c]
lea edx, [eax + 0x59904ea9]
lea ecx, [eax + 0xa9]
and ecx, esi
mov edi, 0x66fb156
sub edi, eax
and edi, 0x40c317b
and edx, 0x48100e84
or edx, edi
xor edx, esi
xor edx, 0x158c717b
not ecx
and ecx, edx
add ecx, 0xb5b44e8e
mov edx, ecx
xor edx, 0xdb
and ecx, 0x24
add ecx, ecx
sub ecx, edx
mov byte [esp + eax + 0x1c], cl
mov ecx, eax
and ecx, 1
xor eax, 0x2b27d441
lea eax, [eax + ecx*2]
add eax, 0xd4d82bc0
cmp eax, 0x36
jb 0x439790
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x54]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
push dword [esp + 0x24]
push esi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
js 0x439b0a
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x439b00
cmp eax, 1
je 0x439b00
cmp dword [esp + 0x5c], 0
je 0x439b00
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], 0x21b92749
mov dword [esp + 0x20], 0x5db923b2
mov dword [esp + 0x24], 0x59ca5f3f
mov dword [esp + 0x28], 0x55d55b2e
mov dword [esp + 0x2c], 0x513457c3
mov dword [esp + 0x30], 0x4dc053cf
mov dword [esp + 0x34], 0x4f4c
mov byte [esp + 0x38], 0
xor ecx, ecx
lea esi, [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb9
xor dl, byte [esp + ecx + 0x1c]
add dl, 0x63
mov byte [esp + ecx + 0x1c], dl
inc ecx
cmp ecx, 0x1d
jne 0x4398c0
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0x78]
push edx
push 0
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x439aeb
cmp word [esp + 0x70], 8
jne 0x439aeb
mov esi, dword [esp + 0x78]
movzx ecx, word [esi]
test cx, cx
je 0x43993d
lea eax, [esi + 2]
xor ebx, ebx
jmp 0x43991c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43993f
cmp cx, 0x7f
jbe 0x439910
movzx edx, cx
cmp edx, 0x7ff
ja 0x439932
add ebx, 2
jmp 0x439911
cmp cx, 0xffff
je 0x439911
add ebx, 3
jmp 0x439911
xor ebx, ebx
mov edi, ebx
and edi, 1
mov dword [esp + 0x68], ebx
xor ebx, 1
lea eax, [ebx + edi*2]
push eax
call fcn.004083e0
add esp, 4
movzx edx, word [esi]
mov dword [esp + 0x18], eax
test dx, dx
je 0x439a88
lea ecx, [ebx + edi*2]
dec ecx
mov eax, dword [esp + 0x18]
test ecx, ecx
je 0x439a88
mov eax, dword [esp + 0x18]
nop
nop
nop
nop
nop
movzx ebx, dx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x4399a0
mov byte [eax], bl
lea edx, [eax + 1]
jmp 0x439a30
cmp ebx, 0x7ff
ja 0x4399c5
cmp ecx, 2
jb 0x4399c5
mov edx, ebx
shr edx, 6
add dl, 0xc0
mov byte [eax], dl
and bl, 0x3f
or bl, 0x80
lea edx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x439a30
mov edx, ebx
and edx, 0xfc00
cmp edx, 0xd800
jne 0x439a4a
cmp ecx, 4
jb 0x439a4a
movzx edi, word [esi + 2]
shl ebx, 0xa
lea edx, [ebx + edi]
add edx, 0xfca02400
mov ebx, edx
shr ebx, 0x12
add bl, 0xf0
mov byte [eax], bl
mov ebx, edx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
shr edx, 6
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
lea edx, [eax + 4]
mov ebx, edi
and bl, 0x3f
or bl, 0x80
add esi, 4
mov byte [eax + 3], bl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add ecx, eax
sub ecx, edx
mov esi, edi
mov eax, edx
movzx edx, word [esi]
test dx, dx
je 0x439a88
test ecx, ecx
jne 0x439980
jmp 0x439a88
movzx edx, dx
cmp edx, 0xdc00
jne 0x439a59
mov esi, edi
jmp 0x439a38
cmp ecx, 3
jb 0x439a84
mov edx, ebx
shr edx, 0xc
or dl, 0xe0
mov byte [eax], dl
mov edx, ebx
shr edx, 6
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
and bl, 0x3f
or bl, 0x80
lea edx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x439a30
mov edx, eax
jmp 0x439a30
mov byte [eax], 0
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x68]
mov eax, ecx
not eax
and eax, 4
and ecx, 0xfffffffb
sub ecx, eax
cmp ecx, 4
jb 0x439ad8
mov eax, dword [edx + 4]
mov dword [esp + 8], eax
mov eax, ecx
not eax
and eax, 4
and ecx, 0xfffffffb
sub ecx, eax
cmp ecx, 4
jb 0x439ad8
mov eax, dword [edx + 8]
mov dword [esp + 0xc], eax
and ecx, 0xfffffffc
cmp ecx, 4
je 0x439ad8
mov eax, dword [edx + 0xc]
mov dword [esp + 0x10], eax
push edx
call fcn.004083f0
add esp, 4
mov edi, dword [ebp + 8]
lea ebx, [esp + 0x84]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x14]
call esi
push dword [esp + 0x6c]
call esi
lea esi, [esp + 0x1c]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44cda0]
call fcn.004402e0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x439b6c
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 4], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.00420440
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439bb0
test esi, esi
je 0x439bce
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408460
add esp, 0xc
xor eax, eax
cmp dword [esp + 8], 0
setne al
mov eax, dword [esp + eax*4 + 4]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 8]
mov dword [esp + 8], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.00420440
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439c20
test esi, esi
je 0x439c3e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408460
add esp, 0xc
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
mov eax, dword [esp + eax*4 + 8]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 0x10]
mov dword [esp + 0xc], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.00420440
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439c90
test esi, esi
je 0x439cae
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408460
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x10], 0
setne al
mov eax, dword [esp + eax*4 + 0xc]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 0x10], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.00420440
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439d00
test esi, esi
je 0x439d1e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408460
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret