Function at 0x439030
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov edi, dword [ebp + 8]
mov eax, dword [0x44d058]
mov dword [esp + 0x20], 0x23712145
mov dword [esp + 0x24], 0x279525ad
mov dword [esp + 0x28], 0x3b9f398c
mov dword [esp + 0x2c], 0x3f7a3d81
mov dword [esp + 0x30], 0x338b3182
mov dword [esp + 0x34], 0x37933582
mov dword [esp + 0x38], 0xb0a096d
mov byte [esp + 0x3c], 0
mov ecx, 0xfc7a8088
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x3857f98]
xor edx, ecx
mov esi, edx
and esi, 1
xor edx, 0xa23f5501
lea ebx, [edx + esi*2]
add ebx, 0x57
and edx, 1
and ebx, 0xfe
sub ebx, edx
inc bl
mov byte [esp + ecx + 0x3857f98], bl
inc ecx
cmp ecx, 0xfc7a80a5
jne 0x439090
lea ebx, [esp + 8]
lea ecx, [esp + 0x8c]
lea esi, [esp + 0x20]
push ebx
push 8
push ecx
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x4390f1
mov dword [esp + 0x8c], 0x3a0043
mov dword [esp + 0x90], 0x5c
mov dword [esp + 0x14], 0x9dc3a013
mov dword [esp + 0x10], 0xd5ff2c92
mov dword [esp + 0xc], 0x89979063
mov dword [esp + 8], 0x71e70416
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
push 0x443668
push 1
push 0
push 0x443678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43968c
mov dword [esp + 0x20], 0x13c511c2
mov dword [esp + 0x24], 0xef42ed3b
mov dword [esp + 0x28], 0xeb29e94c
mov dword [esp + 0x2c], 0xe733e53d
mov dword [esp + 0x30], 0xe310e14e
mov dword [esp + 0x34], 0xfdfc
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + eax]
mov edx, ecx
and edx, 0x38
mov esi, eax
xor esi, 0x69ef0f7c
mov edi, edx
and edi, esi
xor esi, edx
lea edx, [esi + edi*2]
xor dl, byte [esp + eax + 0x20]
add dl, 0x94
mov byte [esp + eax + 0x20], dl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0x18
jb 0x439180
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi]
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x90], eax
push eax
push edi
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
js 0x439674
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x34]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43966a
mov dword [esp + 0x20], 0x19451b45
mov dword [esp + 0x24], 0x6566674c
mov word [esp + 0x28], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x20]
mov ebx, eax
and ebx, 0x16
mov edx, ecx
xor edx, 0x8d2d8bbb
add edx, ebx
xor edx, edi
mov edi, edx
not edi
and edi, 0xa8
and edx, 0x57
sub edx, edi
inc dl
mov byte [esp + ecx + 0x20], dl
inc ecx
add eax, 2
cmp ecx, 0xa
jne 0x439230
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x20], 0x19d11bc1
mov dword [esp + 0x24], 0xe52de7cc
mov dword [esp + 0x28], 0xe13ee329
mov dword [esp + 0x2c], 0xed18ef00
mov dword [esp + 0x30], 0xe920eb0c
mov dword [esp + 0x34], 0xf527f736
mov dword [esp + 0x38], 0xf112f327
mov dword [esp + 0x3c], 0xfd49ff29
mov dword [esp + 0x40], 0xf907fb4e
mov dword [esp + 0x44], 0xc567c706
mov dword [esp + 0x48], 0xc115c30a
mov dword [esp + 0x4c], 0xcd13cf11
mov dword [esp + 0x50], 0xcbcc
mov byte [esp + 0x54], 0
mov eax, 0x59fbcefb
nop
movzx ecx, byte [esp + eax - 0x59fbcedb]
xor ecx, eax
mov edx, 1
sub edx, ecx
not edx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x18
mov byte [esp + eax - 0x59fbcedb], cl
inc eax
cmp eax, 0x59fbcf30
jne 0x4392e0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
mov dword [esp + 0x80], edi
push edi
push ebx
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
lea ebx, [esp + 8]
js 0x439658
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea edi, [esp + 0x5c]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43964b
cmp eax, 1
je 0x43964b
cmp dword [esp + 0x58], 0
je 0x43964b
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 0x20], 0x43e741f3
mov dword [esp + 0x24], 0x47ef45d6
mov dword [esp + 0x28], 0x4be649e9
mov dword [esp + 0x2c], 0x4fdb4d02
mov dword [esp + 0x30], 0xb310b11d
mov dword [esp + 0x34], 0xb724b511
mov dword [esp + 0x38], 0xb9b8
mov ecx, 0x76110cf0
nop
movzx eax, byte [esp + ecx - 0x76110cd0]
mov ebx, ecx
and ebx, eax
mov edi, ebx
mov edx, ebx
xor eax, ecx
lea eax, [eax + ebx*2]
and ebx, 2
or edx, 2
imul edx, ebx
xor ebx, 2
and edi, 0xfffffffd
imul edi, ebx
add edx, edi
mov edi, edx
xor edi, eax
not edx
and edx, eax
add edx, edx
sub edx, edi
add dl, 0x50
mov byte [esp + ecx - 0x76110cd0], dl
inc ecx
cmp ecx, 0x76110d0c
jne 0x4393d0
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push 0
push 0
lea edi, [esp + 0x80]
push edi
push 0
push esi
push ecx
call dword [eax + 0x10]
test eax, eax
js 0x439636
cmp word [esp + 0x78], 8
jne 0x439636
mov ebx, dword [esp + 0x80]
movzx ecx, word [ebx]
test cx, cx
je 0x43948d
lea eax, [ebx + 2]
xor esi, esi
jmp 0x43946c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43948f
cmp cx, 0x7f
jbe 0x439460
movzx edx, cx
cmp edx, 0x7ff
ja 0x439482
add esi, 2
jmp 0x439461
cmp cx, 0xffff
je 0x439461
add esi, 3
jmp 0x439461
xor esi, esi
mov eax, esi
and eax, 1
mov dword [esp + 0x68], esi
xor esi, 1
mov dword [esp + 0x64], eax
lea eax, [esi + eax*2]
push eax
call fcn.004082b0
add esp, 4
mov edi, eax
movzx edx, word [ebx]
mov dword [esp + 4], eax
test dx, dx
je 0x4395e8
mov eax, dword [esp + 0x64]
lea eax, [esi + eax*2]
dec eax
mov edi, dword [esp + 4]
test eax, eax
je 0x4395e8
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, dx
lea esi, [ebx + 2]
cmp dx, 0x7f
ja 0x439500
lea ecx, [edi + 1]
mov byte [edi], dl
jmp 0x439590
cmp edx, 0x7ff
ja 0x439525
cmp eax, 2
jb 0x439525
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [edi], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [edi + 2]
mov byte [edi + 1], dl
jmp 0x439590
mov ecx, edx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x4395aa
cmp eax, 4
jb 0x4395aa
movzx esi, word [ebx + 2]
shl edx, 0xa
lea ecx, [edx + esi]
add ecx, 0xfca02400
mov edx, ecx
shr edx, 0x12
add dl, 0xf0
mov byte [edi], dl
mov edx, ecx
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [edi + 1], dl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 2], cl
mov ecx, esi
and cl, 0x3f
or cl, 0x80
mov byte [edi + 3], cl
lea ecx, [edi + 4]
add ebx, 4
mov esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
sub eax, ecx
mov ebx, esi
mov edi, ecx
movzx edx, word [ebx]
test dx, dx
je 0x4395e8
test eax, eax
jne 0x4394e0
jmp 0x4395e8
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x4395b9
mov ebx, esi
jmp 0x439598
cmp eax, 3
jb 0x4395e4
mov ecx, edx
shr ecx, 0xc
or cl, 0xe0
mov byte [edi], cl
mov ecx, edx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [edi + 3]
mov byte [edi + 2], dl
jmp 0x439590
mov ecx, edi
jmp 0x439590
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x68]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x439600
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
lea edi, [esp + 0x78]
jb 0x439613
mov eax, 3
lea eax, [eax*4 + 4]
lea ecx, [esp + 8]
push eax
mov esi, dword [esp + 8]
push esi
push ecx
call fcn.004082e0
add esp, 0xc
push esi
call fcn.004082c0
add esp, 4
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ebx, [esp + 8]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x70]
call esi
push dword [esp + 0x6c]
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x20]
push 0xbeb8f1a1
push dword [0x44d050]
call fcn.0043f9a0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
lea ecx, [esp + 0xa8]
push ecx
call eax
test eax, eax
je 0x4396bc
mov ebx, esi
imul eax, dword [ebx], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 8], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.00420650
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4396e0
test esi, esi
je 0x4396fe
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408330
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0xc], 0
setne cl
imul ecx, dword [esp + ecx*4 + 8], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0xc], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.00420650
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439730
test esi, esi
je 0x43974e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408330
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x10], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0xc], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x10], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.00420650
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x439780
test esi, esi
je 0x43979e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408330
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x14], 0
setne al
imul eax, dword [esp + eax*4 + 0x10], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.00420650
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4397d0
test esi, esi
je 0x4397ee
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408330
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret