Function at 0x437fa0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x44ce60]
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0xff09f9dd
mov dword [esp + 0x18], 0xe375fd65
mov dword [esp + 0x1c], 0xe703e174
mov dword [esp + 0x20], 0xeb2ee509
mov dword [esp + 0x24], 0xef07e97e
mov dword [esp + 0x28], 0x9377ed76
mov dword [esp + 0x2c], 0x979691b5
mov ecx, 0xaa
mov edx, 0x55
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x96]
mov eax, ecx
and eax, esi
mov edi, edx
and edi, esi
mov ebx, ecx
xor ebx, esi
sub ebx, esi
add ebx, eax
or ebx, edi
add bl, 0xae
mov byte [esp + ecx - 0x96], bl
inc ecx
dec edx
cmp ecx, 0xc6
jne 0x438000
lea eax, [esp + 0x58]
lea edi, [esp + 0x84]
lea ebx, [esp + 0x14]
push eax
push 8
push edi
push 0xd
push ebx
push 0
call dword [esp + 0x20]
test eax, eax
jns 0x438059
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x64], 0x156fe8f9
mov dword [esp + 0x60], 0x13f90c9d
mov dword [esp + 0x5c], 0xd96be950
mov dword [esp + 0x58], 0x74b214b4
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push 0x443668
push 1
push 0
push 0x443678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x438477
mov dword [esp + 0x14], 0x519f4f9e
mov dword [esp + 0x18], 0x55865381
mov dword [esp + 0x1c], 0x59935788
mov dword [esp + 0x20], 0x5d955b93
mov dword [esp + 0x24], 0x616c5f8a
mov word [esp + 0x28], 0x6360
mov dword [esp + 0x2a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x8d
xor cl, byte [esp + eax + 0x14]
add cl, 0x3f
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x1a
jne 0x4380f0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x438466
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x28]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43845c
mov dword [esp + 0x14], 0x4fbf49a3
mov dword [esp + 0x18], 0x43424db0
mov byte [esp + 0x1c], 0
mov eax, 0x12
mov ecx, 0x561d7d6d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 2]
lea edx, [ecx - 0x561d7d60]
mov edi, eax
and edi, 0x26
and edx, 0x19
or edx, edi
mov edi, ecx
or edi, ebx
xor edx, 0x66
and edx, ebx
sub edx, edi
add edx, 0xae937324
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov byte [esp + eax + 2], dl
inc eax
dec ecx
cmp eax, 0x1b
jne 0x438180
mov dword [esp + 0x68], esi
lea ebx, [esp + 0x14]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x14], 0xc109c779
mov dword [esp + 0x18], 0xcd0dc374
mov dword [esp + 0x1c], 0xc972cf01
mov dword [esp + 0x20], 0xb520cb28
mov dword [esp + 0x24], 0xb178b754
mov dword [esp + 0x28], 0xbd03b302
mov dword [esp + 0x2c], 0xb95ebf0b
mov dword [esp + 0x30], 0xa511bb01
mov dword [esp + 0x34], 0xa17ba732
mov dword [esp + 0x38], 0xad03a372
mov dword [esp + 0x3c], 0xa965af6e
mov dword [esp + 0x40], 0x9517ab19
mov word [esp + 0x44], 0x9794
mov dword [esp + 0x46], 0
mov eax, 0xce9cea31
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x316315e3]
xor ecx, eax
mov edx, 0x2f
sub edx, ecx
add ecx, 0x50
and edx, 0x46
and ecx, 0xb9
sub ecx, edx
inc cl
mov byte [esp + eax + 0x316315e3], cl
inc eax
cmp eax, 0xce9cea67
jne 0x438250
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0xc]
mov ecx, dword [esi]
lea edx, [esp + 0x54]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
mov dword [esp + 0x18], edi
push edi
push esi
call dword [ecx + 0x50]
test eax, eax
mov esi, dword [esp + 0x68]
js 0x438443
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
lea edi, [esp + 0x50]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x438439
cmp eax, 1
je 0x438439
cmp dword [esp + 0x4c], 0
je 0x438439
lea edi, [esp + 0x70]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], 0x9f7b994f
mov dword [esp + 0x18], 0xa34b9d6a
mov dword [esp + 0x1c], 0xa74aa141
mov dword [esp + 0x20], 0xab5fa576
mov dword [esp + 0x24], 0xaf48a945
mov dword [esp + 0x28], 0xb344ad49
mov dword [esp + 0x2c], 0xb1b0
mov byte [esp + 0x30], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xda
xor dl, byte [esp + ecx + 0x14]
add dl, 0xbe
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 0x1d
jne 0x438340
mov ecx, dword [eax]
push 0
push 0
push edi
push 0
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x438428
cmp word [esp + 0x70], 8
jne 0x438428
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 4], eax
je 0x4383bd
add eax, 2
xor ebx, ebx
jmp 0x43839c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4383bf
cmp cx, 0x7f
jbe 0x438390
movzx edx, cx
cmp edx, 0x7ff
ja 0x4383b2
add ebx, 2
jmp 0x438391
cmp cx, 0xffff
je 0x438391
add ebx, 3
jmp 0x438391
xor ebx, ebx
lea edi, [ebx + 1]
push edi
call fcn.00408730
add esp, 4
push dword [esp + 4]
push edi
mov dword [esp + 0xc], eax
push eax
call fcn.004274e0
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x4383ee
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
lea edi, [esp + 0x70]
jb 0x438401
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 8]
push ebx
lea eax, [esp + 0x60]
push eax
call fcn.00408760
add esp, 0xc
push ebx
call fcn.00408740
add esp, 4
lea ebx, [esp + 0x14]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 8]
call edi
push dword [esp + 0x6c]
call edi
lea edi, [esp + 0x84]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44ce58]
call fcn.0043f1e0
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push edi
call eax
test eax, eax
mov edi, dword [ebp + 8]
je 0x4384a9
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
xor esi, esi
jmp 0x4384bd
inc esi
add edi, 8
cmp esi, 4
je 0x438543
mov eax, 0
test esi, esi
je 0x4384dd
cmp dword [esp + esi*4 + 0x58], 0
mov eax, esi
jne 0x4384dd
mov eax, esi
and eax, 2
mov ecx, esi
not ecx
and ecx, 1
sub eax, ecx
mov eax, dword [esp + eax*4 + 0x58]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x58], eax
mov ebx, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.00420680
add esp, 0x10
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne 0x438520
test ebx, ebx
je 0x4384b0
add eax, ebx
neg ebx
push ebx
push 0x30
push eax
call fcn.004087b0
add esp, 0xc
jmp 0x4384b0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret