Function at 0x4361e0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x4486a4]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0xc7c6c5cc
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add al, 0xe4
xor al, byte [esp + ecx + 0x48]
add al, 0xe0
mov byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 4
jne 0x436210
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp], 0x8373628
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov eax, 0xc8ebfb22
sub eax, edx
mov edi, eax
or edi, esi
add eax, esi
not eax
add eax, edi
and eax, edi
lea ebx, [eax + eax]
not ebx
add ebx, eax
add bl, 0x18
mov byte [esp + edx], bl
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, 4
jb 0x436240
mov edx, dword [esp]
mov dword [esp + 0x10], 0x2c782a0c
mov dword [esp + 0x14], 0x205c2ea4
mov dword [esp + 0x18], 0x24462255
mov dword [esp + 0x1c], 0x38632658
mov dword [esp + 0x20], 0x3c423a4b
mov dword [esp + 0x24], 0x305a3e4b
mov dword [esp + 0x28], 0x34333214
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi + 0x10]
mov eax, 0xd126ffde
sub eax, esi
xor eax, edi
mov ebx, 0x1126ffde
sub ebx, esi
or ebx, eax
add ebx, esi
add ebx, 0x2ed90022
mov ecx, ebx
and ecx, 0xfffffffd
mov eax, ebx
or eax, 0xfffffffd
inc eax
imul eax, ecx
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
sub eax, ebx
add edi, esi
lea ebx, [eax + edi]
add ebx, 0xb810ff18
mov eax, ebx
xor eax, 0xfffffffe
mov edi, ebx
or edi, 1
and edi, eax
mov ecx, edi
and ecx, 2
mov eax, edi
or edi, 2
imul edi, ecx
xor ecx, 2
and eax, 0xfd
imul eax, ecx
xor ebx, 1
add ebx, edi
add ebx, eax
mov byte [esp + esi + 0x10], bl
mov eax, esi
and eax, 1
xor esi, 1
lea esi, [esi + eax*2]
cmp esi, 0x1c
jb 0x4362c0
lea ecx, [esp + 0x68]
lea ebx, [esp + 0x84]
lea eax, [esp + 0x10]
push ecx
push dword [esp + 0x10]
push ebx
push edx
push eax
push 0
call dword [esp + 0x1c]
test eax, eax
jns 0x436374
mov dword [esp + 0x84], 0x3a0043
mov word [esp + 0x10], 0x980b
xor eax, eax
mov cl, 1
nop
movzx esi, byte [esp + eax + 0x10]
mov edx, 0x74f37aa0
sub edx, eax
or edx, esi
mov edi, 0xa0
sub edi, eax
and edi, esi
not edx
or edx, edi
add edx, 0xa79bd507
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + eax + 0x10], dl
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x436380
movzx eax, word [esp + 0x10]
mov word [esp + 0x88], ax
mov word [esp + 0x8a], 0
mov dword [esp + 0x74], 0xe80e014f
mov dword [esp + 0x70], 0x9481c900
mov dword [esp + 0x6c], 0x3ecd3294
mov dword [esp + 0x68], 0xc04245cc
mov dword [esp], 0
mov eax, esp
push eax
push 0x43f67c
push 1
push 0
push 0x43f68c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4367c2
mov dword [esp + 0x10], 0xfa46f8b5
mov dword [esp + 0x14], 0xfe49fc44
mov dword [esp + 0x18], 0xf232f053
mov dword [esp + 0x1c], 0xf648f44a
mov dword [esp + 0x20], 0xea3be841
mov word [esp + 0x24], 0xeceb
xor eax, eax
nop
nop
nop
mov ecx, eax
dec cl
xor cl, byte [esp + eax + 0x10]
add cl, 8
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x16
jne 0x436450
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4367b2
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4367a8
mov dword [esp + 0x10], 0x23732177
mov dword [esp + 0x14], 0x27262568
mov eax, 0xbc430d20
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x43bcf2f0]
xor ecx, eax
mov edx, ecx
not edx
and edx, 1
dec ecx
or ecx, 1
add ecx, edx
mov byte [esp + eax + 0x43bcf2f0], cl
inc eax
cmp eax, 0xbc430d28
jne 0x4364d0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0x35713341
mov dword [esp + 0x14], 0x397d377a
mov dword [esp + 0x18], 0x3d483b79
mov dword [esp + 0x1c], 0x210a3f1e
mov dword [esp + 0x20], 0x25622302
mov dword [esp + 0x24], 0x29672754
mov dword [esp + 0x28], 0x2d0c2b67
mov dword [esp + 0x2c], 0x51392f59
mov dword [esp + 0x30], 0x5507533c
mov dword [esp + 0x34], 0x59275704
mov dword [esp + 0x38], 0x5d155b18
mov dword [esp + 0x3c], 0x41335f11
mov word [esp + 0x40], 0x4342
mov eax, 0x22
mov ecx, 0xdd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x12]
mov edx, eax
xor edx, ecx
and edx, edi
xor edx, ecx
mov bl, 0xef
sub bl, dl
mov byte [esp + eax - 0x12], bl
inc eax
dec ecx
cmp eax, 0x54
jne 0x436580
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x44]
mov ecx, dword [edi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x18], eax
push eax
push dword [esp + 0x14]
push edi
call dword [ecx + 0x50]
test eax, eax
lea ebx, [esp + 0x84]
js 0x436796
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea edi, [esp + 0x60]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43678c
cmp eax, 1
je 0x43678c
cmp dword [esp + 0x5c], 0
je 0x43678c
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], 0x3294308c
mov dword [esp + 0x14], 0x36ac34a1
mov dword [esp + 0x18], 0x2ab52896
mov dword [esp + 0x1c], 0x2eb82c95
mov dword [esp + 0x20], 0x228320b2
mov dword [esp + 0x24], 0x26b72486
mov word [esp + 0x28], 0x1827
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
and edx, 5
mov ebx, ecx
and ebx, 2
mov edi, ebx
xor edi, 2
imul edi, edx
or edx, 2
imul edx, ebx
mov ebx, ecx
xor ebx, 7
add ebx, edi
add ebx, edx
xor bl, byte [esp + ecx + 0x10]
add bl, 0xc8
mov byte [esp + ecx + 0x10], bl
inc ecx
cmp ecx, 0x1a
jne 0x436660
mov ecx, dword [eax]
push 0
push 0
lea edi, [esp + 0x50]
push edi
push 0
lea edx, [esp + 0x20]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x436774
cmp word [esp + 0x48], 8
jne 0x436774
mov eax, dword [esp + 0x50]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 8], eax
je 0x43670d
add eax, 2
xor ebx, ebx
jmp 0x4366ec
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43670f
cmp cx, 0x7f
jbe 0x4366e0
movzx edx, cx
cmp edx, 0x7ff
ja 0x436702
add ebx, 2
jmp 0x4366e1
cmp cx, 0xffff
je 0x4366e1
add ebx, 3
jmp 0x4366e1
xor ebx, ebx
lea edi, [ebx + 1]
push edi
call fcn.00407f60
add esp, 4
push dword [esp + 8]
push edi
mov dword [esp + 0x10], eax
push eax
call fcn.00408d90
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x43673e
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
lea edi, [esp + 0x48]
jb 0x436751
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 0xc]
push ebx
lea eax, [esp + 0x70]
push eax
call fcn.00407f90
add esp, 0xc
push ebx
call fcn.00407f70
add esp, 4
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ebx, [esp + 0x84]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 4]
call edi
push dword [esp + 0xc]
call edi
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x44769c]
call fcn.0043c280
add esp, 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push ebx
call eax
test eax, eax
mov esi, dword [ebp + 8]
je 0x4367f8
mov eax, dword [esp + 0x10]
mov dword [esp + 0x68], eax
xor ebx, ebx
jmp 0x436817
mov eax, ebx
xor eax, 1
and ebx, 1
lea ebx, [eax + ebx*2]
add esi, 8
cmp ebx, 4
jae 0x436997
mov eax, 0
test ebx, ebx
je 0x436837
cmp dword [esp + ebx*4 + 0x68], 0
mov eax, ebx
jne 0x436837
mov eax, ebx
and eax, 2
mov ecx, ebx
not ecx
and ecx, 1
sub eax, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], esi
mov edx, dword [esp + eax*4 + 0x68]
mov dword [esp + 0x48], 0x817a275b
xor ecx, ecx
nop
nop
nop
mov eax, ecx
add al, 0xee
xor al, byte [esp + ecx + 0x48]
add al, 0x90
mov byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 4
jne 0x436850
mov ecx, dword [esp + 0x48]
mov eax, edx
not eax
mov dword [esp + 0x78], eax
mov eax, ecx
not eax
and eax, edx
mov dword [esp + 0x7c], eax
mov eax, ecx
and eax, edx
mov dword [esp + 0x80], ecx
or edx, ecx
imul edx, eax
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0x3e2a59e1
mov dword [esp + 0x14], 0xd9d8d7d6
mov eax, 0xda340c2
mov ebx, 0x725cbf3d
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xda340b2]
lea esi, [ebx - 0x725cbf20]
mov ecx, eax
and ecx, 0x8a10088
and esi, 0x17
or esi, ecx
xor esi, edx
xor esi, 0x5024057
mov edi, eax
or edi, edx
not edi
or edi, esi
mov esi, ebx
and esi, 0x62148d2c
mov ecx, eax
and ecx, 0x9a10083
or ecx, esi
xor ecx, edx
lea esi, [eax - 0xda34000]
and esi, edx
lea edx, [edi + edi]
not edx
add edx, edi
xor ecx, 0x6616cd6c
or esi, ecx
mov ecx, esi
or ecx, edi
and edi, 0x6c
and edx, 0x93
or edx, edi
xor edx, esi
xor edx, 0x6c
and edx, ecx
add dl, 0xf0
mov byte [esp + eax - 0xda340b2], dl
inc eax
dec ebx
cmp eax, 0xda340ca
jne 0x4368b0
mov eax, dword [esp + 0x80]
and eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
imul ecx, eax
mov eax, dword [esp + 8]
add eax, ecx
add eax, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
mov dword [esp + ebx*4 + 0x68], eax
mov edi, 0xfffffff7
push 0x10
push 9
mov esi, dword [esp + 0xc]
push esi
push eax
call fcn.0041dd50
add esp, 0x10
nop
nop
nop
nop
nop
nop
cmp byte [eax + edi + 9], 0
lea edi, [edi + 1]
jne 0x436970
test edi, edi
je 0x436800
add eax, edi
neg edi
push edi
push 0x30
push eax
call fcn.00407fe0
add esp, 0xc
jmp 0x436800
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret