Function at 0x433710
Capabilities:
Authenticate hmac
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x4490f0]
mov dword [esp + 0x14], 0x15b072b
mov dword [esp + 0x18], 0xd7f037b
mov dword [esp + 0x1c], 0x9610f70
mov dword [esp + 0x20], 0x15460b7f
mov dword [esp + 0x24], 0x117d1766
mov dword [esp + 0x28], 0x1d7d136e
mov dword [esp + 0x2c], 0x191e1f33
mov dword [esp + 0x30], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 2
mov ebx, edx
xor ebx, 1
add ebx, esi
xor bl, byte [esp + edx + 0x14]
add bl, 0xfb
mov byte [esp + edx + 0x14], bl
inc edx
add ecx, 2
cmp edx, 0x20
jne 0x433770
lea ecx, [esp + 4]
lea ebx, [esp + 0x68]
lea esi, [esp + 0x14]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x4337b3
mov dword [esp + 0x68], 0x3a0043
mov dword [esp + 0x6c], 0x5c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x50], 0
lea eax, [esp + 0x50]
push eax
push 0x43f670
push 1
push 0
push 0x43f680
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x433d5b
mov dword [esp + 0x14], 0xd90bdb12
mov dword [esp + 0x18], 0xdd0adf09
mov dword [esp + 0x1c], 0xd117d370
mov dword [esp + 0x20], 0xd505d70f
mov dword [esp + 0x24], 0xa95cab7e
mov dword [esp + 0x28], 0xafa8
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
and ecx, 0xd
mov edx, eax
and edx, 2
mov esi, edx
xor esi, 2
imul esi, ecx
or ecx, 2
imul ecx, edx
mov edx, eax
xor edx, 0x2f
add edx, esi
add edx, ecx
xor dl, byte [esp + eax + 0x14]
add dl, 0x15
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x18
jne 0x433840
lea esi, [esp + 0x14]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x98], ebx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
lea ebx, [esp + 0x68]
js 0x433d47
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x433d3d
mov dword [esp + 0x14], 0xf303f11f
mov dword [esp + 0x18], 0xefeeed18
mov word [esp + 0x1c], 0
mov eax, 0x2c
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x18]
mov ecx, eax
and ecx, edx
lea esi, [ecx + ecx]
not esi
add esi, ecx
lea ecx, [eax - 0x64410d00]
or ecx, edx
and ecx, esi
mov edx, ecx
not edx
and edx, 0xdd
and ecx, 0x22
sub ecx, edx
inc cl
mov byte [esp + eax - 0x18], cl
inc eax
cmp eax, 0x36
jne 0x4338f0
lea esi, [esp + 0x14]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 0x14], 0xf7abf957
mov dword [esp + 0x18], 0xf3aff5a0
mov dword [esp + 0x1c], 0xcf62f1af
mov dword [esp + 0x20], 0xcbbccdac
mov dword [esp + 0x24], 0xc79cc9a8
mov dword [esp + 0x28], 0xc391c56a
mov dword [esp + 0x2c], 0xdfbec195
mov dword [esp + 0x30], 0xdb63dd77
mov dword [esp + 0x34], 0xd799d96a
mov dword [esp + 0x38], 0xd371d59a
mov dword [esp + 0x3c], 0x2f77d18e
mov dword [esp + 0x40], 0x2b852d7f
mov dword [esp + 0x44], 0x2928
xor ecx, ecx
mov eax, ecx
mov edx, ecx
add dl, 0x56
xor dl, byte [esp + ecx + 0x14]
add dl, 0x52
mov byte [esp + ecx + 0x14], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 0x3e
sub eax, edx
add eax, ecx
mov ecx, eax
cmp eax, 0x34
jb 0x4339a0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x84], eax
push eax
push dword [esp + 0x68]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x433d27
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x433d1d
cmp eax, 1
je 0x433d1d
cmp dword [esp + 0x5c], 0
je 0x433d1d
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], 0x1fbb194f
mov dword [esp + 0x18], 0x63cb1daa
mov dword [esp + 0x1c], 0x67ca61c1
mov dword [esp + 0x20], 0x6bdf6536
mov dword [esp + 0x24], 0x6fc869c5
mov dword [esp + 0x28], 0x73c46dc9
mov word [esp + 0x2c], 0x7170
mov dword [esp + 0x2e], 0
mov ecx, 0x131e5d3a
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x131e5d26]
xor edx, ecx
lea esi, [edx + edx]
and esi, 0x101bba
mov edi, edx
or edi, 0x4c818222
not edx
or edx, 0xa0682ddd
and edx, edi
not edx
mov edi, esi
and edi, edx
xor edx, esi
lea edx, [edx + edi*2]
inc dl
mov byte [esp + ecx - 0x131e5d26], dl
inc ecx
cmp ecx, 0x131e5d58
jne 0x433a90
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x88]
push esi
push 0
lea edx, [esp + 0x24]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
mov edi, dword [ebp + 8]
js 0x433d0c
cmp word [esp + 0x80], 8
jne 0x433d0c
mov esi, dword [esp + 0x88]
movzx ecx, word [esi]
test cx, cx
je 0x433b4d
lea eax, [esi + 2]
xor ebx, ebx
jmp 0x433b2c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x433b4f
cmp cx, 0x7f
jbe 0x433b20
movzx edx, cx
cmp edx, 0x7ff
ja 0x433b42
add ebx, 2
jmp 0x433b21
cmp cx, 0xffff
je 0x433b21
add ebx, 3
jmp 0x433b21
xor ebx, ebx
lea eax, [ebx + 1]
push eax
call fcn.004081b0
add esp, 4
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], ebx
test ebx, ebx
lea ebx, [esp + 0x68]
je 0x433ca3
movzx ecx, word [esi]
mov eax, dword [esp + 0x48]
test cx, cx
je 0x433ca3
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x433bb0
lea ecx, [eax + 1]
mov byte [eax], bl
jmp 0x433c40
cmp ebx, 0x7ff
ja 0x433bd5
cmp edx, 2
jb 0x433bd5
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x433c40
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x433c61
cmp edx, 4
jb 0x433c61
movzx edi, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [eax], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ecx, edi
and cl, 0x3f
or cl, 0x80
mov ebx, ecx
lea ecx, [eax + 4]
mov byte [eax + 3], bl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ebx, [esp + 0x68]
add edx, eax
sub edx, ecx
mov esi, edi
mov eax, ecx
movzx ecx, word [esi]
test cx, cx
mov edi, dword [ebp + 8]
je 0x433ca3
test edx, edx
jne 0x433b90
jmp 0x433ca3
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x433c74
mov esi, edi
lea ebx, [esp + 0x68]
jmp 0x433c4c
cmp edx, 3
jb 0x433c9f
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x433c40
mov ecx, eax
jmp 0x433c40
mov byte [eax], 0
mov edx, dword [esp + 0x48]
mov eax, dword [edx]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x54]
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x433cfc
mov eax, dword [edx + 4]
mov dword [esp + 8], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x433cfc
mov eax, dword [edx + 8]
mov dword [esp + 0xc], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x433cfc
mov eax, dword [edx + 0xc]
mov dword [esp + 0x10], eax
push edx
call fcn.004081c0
add esp, 4
lea esi, [esp + 0x80]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push dword [esp + 0x78]
call esi
lea esi, [esp + 0x14]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x7c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x14], 0
push 0x72a7c387
push dword [0x4490e8]
call fcn.0043b9b0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x433ece
imul eax, dword [esp + 0x14], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 4], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041a470
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433dc0
test esi, esi
je 0x433dde
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408240
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
imul ecx, dword [esp + ecx*4 + 4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 8], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041a470
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433e10
test esi, esi
je 0x433e2e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408240
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0xc], 0
setne cl
imul ecx, dword [esp + ecx*4 + 8], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0xc], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041a470
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433e60
test esi, esi
je 0x433e7e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408240
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x10], 0
setne al
imul eax, dword [esp + eax*4 + 0xc], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041a470
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433eb0
test esi, esi
je 0x433ece
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408240
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret