Function at 0x435770
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x449e9c]
mov dword [esp + 8], 0x9fc999bd
mov dword [esp + 0xc], 0xa3d59de5
mov dword [esp + 0x10], 0xa7c3a1d4
mov dword [esp + 0x14], 0xabeea5c9
mov dword [esp + 0x18], 0xafc7a9de
mov dword [esp + 0x1c], 0xb3d7add6
mov dword [esp + 0x20], 0xb7b6b195
mov byte [esp + 0x24], 0
lea ecx, [esp + 8]
mov edx, 0x65
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
lea esi, [edx - 0x51f34400]
or esi, edi
and edi, edx
not esi
add esi, edi
lea edi, [esi + esi]
and edi, 0xcc7f5bfa
xor esi, 0x663fadfd
mov ebx, edi
and ebx, esi
xor esi, edi
lea ebx, [esi + ebx*2]
inc bl
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x48
jne 0x4357d0
lea ecx, [esp + 0x48]
lea esi, [esp + 0x8c]
lea edi, [esp + 8]
push ecx
push 8
push esi
push 0xd
push edi
push 0
call eax
test eax, eax
jns 0x43582d
mov dword [esp + 0x8c], 0x3a0043
mov dword [esp + 0x90], 0x5c
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
lea eax, [esp + 0x44]
push eax
push 0x441aa8
push 1
push 0
push 0x441ab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x435ddd
mov dword [esp + 8], 0x19cb1bc2
mov dword [esp + 0xc], 0xe53ae7c9
mov dword [esp + 0x10], 0xe12fe340
mov dword [esp + 0x14], 0xed3def37
mov dword [esp + 0x18], 0xe914eb36
mov word [esp + 0x1c], 0xf7e8
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
mov eax, 0xf83b60fb
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x7c49f0d]
xor ecx, eax
mov edx, ecx
and edx, 0x18
xor ecx, 0x18
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x7c49f0d], cl
inc eax
cmp eax, 0xf83b6117
jne 0x4358d0
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x90], ebx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x435dc9
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x5c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x435dbf
mov dword [esp + 8], 0x9e50be5
mov dword [esp + 0xc], 0x50607dc
mov byte [esp + 0x10], 0
mov eax, 0x443a3c3
mov ecx, 0x3bbc5c3c
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x443a3bb]
mov edi, ecx
and edi, 0x30081808
mov edx, eax
and edx, 0x442a0d7
or edx, edi
xor edx, esi
xor edx, 0xf0091b08
add edx, 0x2aadcd30
mov edi, edx
xor edi, 0xfffffffe
mov esi, edx
or esi, 1
and esi, edi
mov ebx, esi
and ebx, 2
mov edi, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and edi, 0xfd
imul edi, ebx
xor edx, 1
add edx, esi
add edx, edi
mov byte [esp + eax - 0x443a3bb], dl
inc eax
dec ecx
cmp eax, 0x443a3cc
jne 0x435970
lea edi, [esp + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 8], 0x73bf71a3
mov dword [esp + 0xc], 0x7fb37da8
mov dword [esp + 0x10], 0x7ba679bb
mov dword [esp + 0x14], 0x47ac45a4
mov dword [esp + 0x18], 0x438c41a0
mov dword [esp + 0x1c], 0x4f994d9e
mov dword [esp + 0x20], 0x4baa499d
mov dword [esp + 0x24], 0x57ff558b
mov dword [esp + 0x28], 0x53a151e6
mov dword [esp + 0x2c], 0x5ff95dae
mov dword [esp + 0x30], 0x5b93599a
mov dword [esp + 0x34], 0x27f525f3
mov dword [esp + 0x38], 0x2120
mov byte [esp + 0x3c], 0
xor eax, eax
mov ecx, eax
add cl, 0x14
xor cl, byte [esp + eax + 8]
add cl, 0x9c
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0x35
jne 0x435a50
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x40]
mov ecx, dword [ebx]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
mov dword [esp + 0x80], esi
push esi
push ebx
call dword [ecx + 0x50]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x435da6
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x435d9c
cmp eax, 1
je 0x435d9c
cmp dword [esp + 0x5c], 0
je 0x435d9c
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 0x77db09b7
mov dword [esp + 0xc], 0x73db75ea
mov dword [esp + 0x10], 0x7fea71d1
mov dword [esp + 0x14], 0x7be77dce
mov dword [esp + 0x18], 0x67c879ed
mov dword [esp + 0x1c], 0x63fc65c9
mov word [esp + 0x20], 0x6160
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 8]
lea edx, [ecx - 0x2b99ce42]
mov edi, 0xb99ce41
sub edi, ecx
and edi, 0xb104e1c
and edx, 0x902231e3
or edx, edi
xor edx, esi
mov esi, edx
and esi, 0x49
add esi, esi
xor esi, 0x10
xor edx, 0x55
add edx, esi
inc dl
mov byte [esp + ecx + 8], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x1f
jb 0x435b30
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x80]
push esi
push 0
lea edi, [esp + 0x18]
push edi
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x435d8b
cmp word [esp + 0x78], 8
jne 0x435d8b
mov esi, dword [esp + 0x80]
movzx ecx, word [esi]
test cx, cx
je 0x435bed
lea eax, [esi + 2]
xor edi, edi
jmp 0x435bcc
inc edi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x435bef
cmp cx, 0x7f
jbe 0x435bc0
movzx edx, cx
cmp edx, 0x7ff
ja 0x435be2
add edi, 2
jmp 0x435bc1
cmp cx, 0xffff
je 0x435bc1
add edi, 3
jmp 0x435bc1
xor edi, edi
lea eax, [edi + 1]
push eax
call fcn.0040ca10
add esp, 4
mov ecx, edi
mov dword [esp + 4], eax
mov edi, eax
mov dword [esp + 0x58], ecx
test ecx, ecx
je 0x435d34
movzx edx, word [esi]
mov edi, dword [esp + 4]
test dx, dx
je 0x435d34
mov ecx, dword [esp + 0x58]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, dx
lea edx, [esi + 2]
cmp bx, 0x7f
ja 0x435c50
lea eax, [edi + 1]
mov byte [edi], bl
jmp 0x435ce0
cmp ebx, 0x7ff
ja 0x435c74
cmp ecx, 2
jb 0x435c74
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [edi], al
and bl, 0x3f
or bl, 0x80
lea eax, [edi + 2]
mov byte [edi + 1], bl
jmp 0x435ce0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x435cfa
cmp ecx, 4
jb 0x435cfa
movzx eax, word [esi + 2]
mov dword [esp + 0x68], eax
shl ebx, 0xa
add ebx, eax
add ebx, 0xfca02400
mov eax, ebx
shr eax, 0x12
add al, 0xf0
mov byte [edi], al
mov eax, ebx
shr eax, 0xc
mov edx, eax
xor edx, 0xc0
or eax, 0x3f
and eax, edx
add al, 0x80
mov byte [edi + 1], al
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [edi + 2], bl
mov al, 0x3f
sub al, byte [esp + 0x68]
add esi, 4
or al, 0xc0
xor al, 0x7f
mov byte [edi + 3], al
lea eax, [edi + 4]
mov edx, esi
nop
nop
nop
nop
nop
add ecx, edi
sub ecx, eax
mov esi, edx
mov edi, eax
movzx edx, word [esi]
test dx, dx
je 0x435d34
test ecx, ecx
jne 0x435c30
jmp 0x435d34
movzx eax, ax
cmp eax, 0xdc00
jne 0x435d08
mov esi, edx
jmp 0x435ce8
cmp ecx, 3
jb 0x435d30
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [edi], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [edi + 3]
mov byte [edi + 2], bl
jmp 0x435ce0
mov eax, edi
jmp 0x435ce0
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x58]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x435d4c
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
mov ebx, dword [ebp + 8]
lea edi, [esp + 8]
lea esi, [esp + 0x78]
jb 0x435d66
mov eax, 3
lea eax, [eax*4 + 4]
push eax
push dword [esp + 8]
lea eax, [esp + 0x50]
push eax
call fcn.0040ca40
add esp, 0xc
push dword [esp + 4]
call fcn.0040ca20
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x70]
call esi
push dword [esp + 0x6c]
call esi
lea esi, [esp + 0x8c]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 8], 0
push 0x72a7c387
push dword [0x449e94]
call fcn.0043dd20
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push esi
call eax
test eax, eax
je 0x435f4e
imul eax, dword [esp + 8], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x48], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.0041dee0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x435e40
test esi, esi
je 0x435e5e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040cac0
add esp, 0xc
lea eax, [ebx + 8]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x48], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041dee0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x435e90
test esi, esi
je 0x435eae
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040cac0
add esp, 0xc
lea eax, [ebx + 0x10]
xor ecx, ecx
cmp dword [esp + 0x50], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x4c], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x50], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041dee0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x435ee0
test esi, esi
je 0x435efe
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040cac0
add esp, 0xc
add ebx, 0x18
xor eax, eax
cmp dword [esp + 0x54], 0
setne al
imul eax, dword [esp + eax*4 + 0x50], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.0041dee0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x435f30
test esi, esi
je 0x435f4e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.0040cac0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret