Function at 0x433870
Capabilities:
Authenticate hmac
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x444994]
mov dword [esp + 4], 0x59eb5733
mov dword [esp + 8], 0x5dcf5bc3
mov dword [esp + 0xc], 0x41e55fca
mov dword [esp + 0x10], 0x450043ef
mov dword [esp + 0x14], 0x49e147d4
mov dword [esp + 0x18], 0x4de94bdc
mov dword [esp + 0x1c], 0xb1b04f2b
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x66
xor dl, byte [esp + ecx + 4]
add dl, 0xd0
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x1c
jne 0x4338d0
lea esi, [esp + 0x40]
lea ecx, [esp + 0x7c]
lea ebx, [esp + 4]
push esi
push 8
push ecx
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x433909
mov dword [esp + 0x7c], 0x3a0043
mov dword [esp + 0x80], 0x5c
mov dword [esp + 0x4c], 0xe48a92f1
mov dword [esp + 0x48], 0x56d6b35d
mov dword [esp + 0x44], 0x1af76899
mov dword [esp + 0x40], 0xede96444
mov dword [esp + 0x3c], 0
lea eax, [esp + 0x3c]
push eax
push 0x43b678
push 1
push 0
push 0x43b688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x433d85
mov dword [esp + 4], 0x26da24d1
mov dword [esp + 8], 0xda2dd8d8
mov dword [esp + 0xc], 0xde1edc37
mov dword [esp + 0x10], 0xd22cd026
mov dword [esp + 0x14], 0xd607d425
mov word [esp + 0x18], 0xc8d7
xor ecx, ecx
xor ebx, ebx
mov edx, ebx
not edx
mov edi, ecx
mov ecx, ebx
shr cl, 1
and cl, 1
mov eax, ebx
and eax, 0x19
and edx, 2
imul edx, eax
or al, 2
mul cl
mov ecx, edi
add al, al
add dl, al
mov eax, ecx
and al, 0x36
sub dl, al
movzx eax, dl
add eax, ebx
add al, 0xfb
xor al, byte [esp + ebx + 4]
add al, 0x28
mov byte [esp + ebx + 4], al
inc ebx
add ecx, 2
cmp ebx, 0x16
jne 0x433990
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x3c]
mov ecx, dword [ebx]
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x80], eax
push eax
push ebx
call dword [ecx + 0xc]
test eax, eax
lea ebx, [esp + 4]
mov edi, dword [ebp + 8]
js 0x433d71
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x54]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x433d67
mov dword [esp + 4], 0x29992791
mov dword [esp + 8], 0x2d2c2b66
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 4]
mov ecx, 0x69
sub ecx, eax
mov esi, 0x3d85a669
sub esi, eax
mov ebx, esi
xor ebx, ecx
or ecx, edx
add ebx, esi
mov esi, edx
not esi
or esi, ebx
add esi, edx
mov edx, 0xfe
sub edx, esi
and edx, ecx
mov cl, 0x4f
sub cl, dl
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 8
jb 0x433a50
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 4], 0xb175cf7d
mov dword [esp + 8], 0xb571b37e
mov dword [esp + 0xc], 0xb90cb775
mov dword [esp + 0x10], 0xbd56bb5a
mov dword [esp + 0x14], 0xa166bf5e
mov dword [esp + 0x18], 0xa56ba310
mov dword [esp + 0x1c], 0xa948a76b
mov dword [esp + 0x20], 0xad05ab1d
mov dword [esp + 0x24], 0x9143af00
mov dword [esp + 0x28], 0x952b9340
mov dword [esp + 0x2c], 0x99519754
mov dword [esp + 0x30], 0x9d2f9b55
mov word [esp + 0x34], 0x9f9e
mov eax, 0xb487333e
nop
nop
nop
movzx edx, byte [esp + eax + 0x4b78ccc6]
xor edx, eax
mov ecx, edx
and ecx, 0xf
add ecx, ecx
xor edx, 0xf0
sub ecx, edx
mov byte [esp + eax + 0x4b78ccc6], cl
inc eax
cmp eax, 0xb4873370
jne 0x433b10
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x38]
mov ecx, dword [ebx]
lea edx, [esp + 0x58]
push edx
push 0
push 0x30
mov dword [esp + 0x68], eax
push eax
mov dword [esp + 0x70], esi
push esi
push ebx
call dword [ecx + 0x50]
test eax, eax
lea ebx, [esp + 4]
js 0x433d51
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
lea esi, [esp + 0x54]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x433d47
cmp eax, 1
je 0x433d47
cmp dword [esp + 0x50], 0
je 0x433d47
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x54]
mov dword [esp], eax
mov dword [esp + 4], 0x27832577
mov dword [esp + 8], 0x2b83299a
mov dword [esp + 0xc], 0x2f822d8d
mov dword [esp + 0x10], 0x3387317e
mov dword [esp + 0x14], 0x37943599
mov dword [esp + 0x18], 0x3b88399d
mov word [esp + 0x1c], 0x3d3c
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
lea eax, [ecx + ecx]
mov edx, eax
and edx, 8
mov ebx, ecx
xor ebx, 0x1829a104
add ebx, edx
xor ebx, esi
mov esi, ebx
and esi, 0xdd
mov edi, ebx
and edi, 2
mov edx, edi
xor edx, 2
imul edx, esi
or esi, 2
imul esi, edi
xor ebx, 0xdf
add ebx, edx
add ebx, esi
inc bl
mov byte [esp + ecx + 4], bl
and eax, 2
xor ecx, 1
add ecx, eax
cmp ecx, 0x1a
jb 0x433c00
mov edx, dword [esp]
mov eax, dword [edx]
push 0
push 0
lea esi, [esp + 0x70]
push esi
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [eax + 0x10]
test eax, eax
mov edi, dword [ebp + 8]
lea ebx, [esp + 4]
js 0x433d36
cmp word [esp + 0x68], 8
jne 0x433d36
mov eax, dword [esp + 0x70]
movzx ecx, word [eax]
test cx, cx
mov dword [esp], eax
je 0x433ccd
add eax, 2
xor esi, esi
jmp 0x433cac
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x433ccf
cmp cx, 0x7f
jbe 0x433ca0
movzx edx, cx
cmp edx, 0x7ff
ja 0x433cc2
add esi, 2
jmp 0x433ca1
cmp cx, 0xffff
je 0x433ca1
add esi, 3
jmp 0x433ca1
xor esi, esi
lea edi, [esi + 1]
push edi
call fcn.00408310
add esp, 4
push dword [esp]
push edi
mov dword [esp + 8], eax
push eax
call fcn.00409170
add esp, 0xc
mov eax, 3
sub eax, esi
cmp eax, 0xfffffffd
jae 0x433cfd
mov eax, 0xfffffffc
add eax, esi
shr eax, 2
cmp eax, 3
mov edi, dword [ebp + 8]
jb 0x433d0f
mov eax, 3
lea eax, [eax*4 + 4]
lea ecx, [esp + 0x40]
push eax
mov esi, dword [esp + 4]
push esi
push ecx
call fcn.00408340
add esp, 0xc
push esi
call fcn.00408320
add esp, 4
lea esi, [esp + 0x68]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x60]
call esi
push dword [esp + 0x5c]
call esi
lea esi, [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x64]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x44398c]
call fcn.00438950
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
lea ecx, [esp + 0x98]
push ecx
call eax
test eax, eax
je 0x433db5
mov esi, ebx
imul eax, dword [esi], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x40], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041b0c0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433de0
test esi, esi
je 0x433dfe
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.004084a0
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0x44], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x40], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x44], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041b0c0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433e30
test esi, esi
je 0x433e4e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.004084a0
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x48], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x44], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x48], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041b0c0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433e80
test esi, esi
je 0x433e9e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.004084a0
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x4c], 0
setne al
imul eax, dword [esp + eax*4 + 0x48], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041b0c0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433ed0
test esi, esi
je 0x433eee
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.004084a0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret