Function at 0x436fc0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov edi, dword [ebp + 8]
mov eax, dword [0x44c00c]
mov dword [esp + 0x18], 0x1db072b
mov dword [esp + 0x1c], 0xdff03fb
mov dword [esp + 0x20], 0x9e10ff0
mov dword [esp + 0x24], 0x15c60bff
mov dword [esp + 0x28], 0x11fd17e6
mov dword [esp + 0x2c], 0x1dfd13ee
mov dword [esp + 0x30], 0x191e1f33
mov word [esp + 0x34], 0
mov byte [esp + 0x36], 0
xor ecx, ecx
nop
nop
nop
movzx edx, byte [esp + ecx + 0x18]
lea esi, [ecx + 0x41]
and esi, edx
add edx, ecx
add esi, esi
sub edx, esi
add dl, 0xfc
mov byte [esp + ecx + 0x18], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x1f
jb 0x437020
lea ecx, [esp + 8]
lea esi, [esp + 0x8c]
lea ebx, [esp + 0x18]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x437070
mov dword [esp + 0x8c], 0x3a0043
mov dword [esp + 0x90], 0x5c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x58]
push eax
push 0x443aa8
push 1
push 0
push 0x443ab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43762a
mov dword [esp + 0x18], 0x73a571a2
mov dword [esp + 0x1c], 0x7fa27dab
mov dword [esp + 0x20], 0x7bb979dc
mov dword [esp + 0x24], 0x4793458d
mov dword [esp + 0x28], 0x43b0419e
mov dword [esp + 0x2c], 0x4d4c
mov byte [esp + 0x30], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x94
xor cl, byte [esp + eax + 0x18]
add cl, 0x1c
mov byte [esp + eax + 0x18], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x19
jb 0x437100
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x90], edi
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
js 0x437616
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x70]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43760c
mov dword [esp + 0x18], 0x3530157
mov dword [esp + 0x1c], 0x7060548
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x18]
mov edx, eax
and edx, ecx
add ecx, eax
add edx, edx
sub ecx, edx
add ecx, 0xd44c6800
mov edx, ecx
and edx, 0xd00067ff
xor ecx, 0xda81f7ff
lea edx, [ecx + edx*2]
mov ecx, edx
xor ecx, 0xfe
or edx, 1
and ecx, edx
add ecx, edx
mov byte [esp + eax + 0x18], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xb
jb 0x4371a0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x18], 0x23e721f3
mov dword [esp + 0x1c], 0x27e325f8
mov dword [esp + 0x20], 0x3bee39fb
mov dword [esp + 0x24], 0x3fc43ddc
mov dword [esp + 0x28], 0x33f431d0
mov dword [esp + 0x2c], 0x37e935e6
mov dword [esp + 0x30], 0xbea09d5
mov dword [esp + 0x34], 0xfb70ddb
mov dword [esp + 0x38], 0x3f101be
mov dword [esp + 0x3c], 0x7a905f6
mov dword [esp + 0x40], 0x1bc319da
mov dword [esp + 0x44], 0x1fcd1dc3
mov word [esp + 0x48], 0x1110
mov dword [esp + 0x4a], 0
mov byte [esp + 0x4e], 0
mov edx, 0x48
nop
nop
nop
movzx eax, byte [esp + edx - 0x30]
mov ebx, eax
not ebx
or ebx, edx
add ebx, eax
mov esi, eax
inc bl
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x98
mov byte [esp + edx - 0x30], al
inc edx
cmp edx, 0x7f
jne 0x437270
lea ebx, [esp + 0x18]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x54]
mov ecx, dword [esi]
lea edx, [esp + 0x68]
push edx
push 0
push 0x30
mov dword [esp + 0x7c], eax
push eax
push dword [esp + 0x6c]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x4375f3
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
lea esi, [esp + 0x64]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4375e9
cmp eax, 1
je 0x4375e9
cmp dword [esp + 0x60], 0
je 0x4375e9
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [esp + 0x64]
mov dword [esp + 0x18], 0x59e15b11
mov dword [esp + 0x1c], 0x5de15fee
mov dword [esp + 0x20], 0x51ee53fb
mov dword [esp + 0x24], 0x55dd5702
mov dword [esp + 0x28], 0xa90cabe7
mov dword [esp + 0x2c], 0xad18af13
mov dword [esp + 0x30], 0xa3ac
mov ecx, 0x6f
mov edx, 0x90
movzx esi, byte [esp + ecx - 0x57]
mov ebx, ecx
xor ebx, edx
and ebx, esi
xor ebx, edx
mov al, 0xd4
sub al, bl
mov byte [esp + ecx - 0x57], al
inc ecx
dec edx
cmp ecx, 0x8b
jne 0x437370
mov eax, dword [edi]
push 0
push 0
lea esi, [esp + 0x80]
push esi
push 0
lea ebx, [esp + 0x28]
push ebx
push edi
call dword [eax + 0x10]
test eax, eax
mov edi, dword [ebp + 8]
js 0x4375d8
cmp word [esp + 0x78], 8
jne 0x4375d8
mov eax, dword [esp + 0x80]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x6c], eax
je 0x43740d
add eax, 2
xor esi, esi
jmp 0x4373ec
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43740f
cmp cx, 0x7f
jbe 0x4373e0
movzx edx, cx
cmp edx, 0x7ff
ja 0x437402
add esi, 2
jmp 0x4373e1
cmp cx, 0xffff
je 0x4373e1
add esi, 3
jmp 0x4373e1
xor esi, esi
mov dword [esp + 0x50], esi
lea eax, [esi + 1]
push eax
call fcn.0040cf60
add esp, 4
mov esi, eax
mov dword [esp + 4], eax
cmp dword [esp + 0x50], 0
mov eax, dword [esp + 0x6c]
je 0x437563
movzx ecx, word [eax]
mov esi, dword [esp + 4]
test cx, cx
je 0x437563
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 4]
nop
nop
nop
nop
movzx ebx, cx
lea edi, [eax + 2]
cmp bx, 0x7f
ja 0x437470
lea ecx, [esi + 1]
mov byte [esi], bl
jmp 0x437500
cmp ebx, 0x7ff
ja 0x437495
cmp edx, 2
jb 0x437495
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [esi], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [esi + 2]
mov byte [esi + 1], bl
jmp 0x437500
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x437521
cmp edx, 4
jb 0x437521
movzx edi, word [eax + 2]
add eax, 4
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [esi], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [esi + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 2], cl
mov ecx, edi
and cl, 0x3f
or cl, 0x80
mov ebx, ecx
lea ecx, [esi + 4]
mov byte [esi + 3], bl
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ebx, [esp + 0x18]
add edx, esi
sub edx, ecx
mov eax, edi
mov esi, ecx
movzx ecx, word [eax]
test cx, cx
mov edi, dword [ebp + 8]
je 0x437563
test edx, edx
jne 0x437450
jmp 0x437563
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x437534
mov eax, edi
lea ebx, [esp + 0x18]
jmp 0x43750c
cmp edx, 3
jb 0x43755f
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [esi], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 1], cl
and bl, 0x3f
or bl, 0x80
mov byte [esi + 2], bl
lea ecx, [esi + 3]
jmp 0x437500
mov ecx, esi
jmp 0x437500
mov byte [esi], 0
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x50]
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x4375c8
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x4375c8
mov eax, dword [esp + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x4375c8
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], eax
push dword [esp + 4]
call fcn.0040cf70
add esp, 4
lea esi, [esp + 0x78]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x5c]
call esi
push dword [esp + 0x70]
call esi
lea esi, [esp + 0x8c]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x18], 0
push 0x72a7c387
push dword [0x44c004]
call fcn.00440000
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x43780e
mov eax, dword [esp + 0x18]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 8], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041daa0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4376a0
test esi, esi
je 0x4376be
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040d0f0
add esp, 0xc
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
mov eax, dword [esp + eax*4 + 8]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 8]
mov dword [esp + 0xc], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041daa0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x437710
test esi, esi
je 0x43772e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040d0f0
add esp, 0xc
xor eax, eax
cmp dword [esp + 0x10], 0
setne al
mov eax, dword [esp + eax*4 + 0xc]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
lea ecx, [edi + 0x10]
mov dword [esp + 0x10], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041daa0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x437780
test esi, esi
je 0x43779e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040d0f0
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x14], 0
setne al
mov eax, dword [esp + eax*4 + 0x10]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + 0x14], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041daa0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4377f0
test esi, esi
je 0x43780e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040d0f0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret