Function at 0x436330
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x44ae00]
mov dword [esp], 0x37593905
mov dword [esp + 4], 0x33bd35bd
mov dword [esp + 8], 0x4f3331bc
mov dword [esp + 0xc], 0x4b164d39
mov dword [esp + 0x10], 0x473f49c6
mov dword [esp + 0x14], 0x433f45ce
mov dword [esp + 0x18], 0x5f5e417d
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
xor ecx, ecx
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
lea edx, [ecx + 0x7d061a36]
xor edx, esi
mov esi, edx
not esi
or esi, 0xee17cf1
add esi, edx
lea esi, [esi*2 + 2]
xor edx, 0x8ee17cf1
mov ebx, esi
and ebx, edx
xor edx, esi
lea edx, [edx + ebx*2]
inc dl
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x1f
jb 0x436390
lea ecx, [esp + 0x40]
lea esi, [esp + 0x7c]
mov ebx, esp
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x4363f4
mov dword [esp + 0x7c], 0x3a0043
mov dword [esp + 0x80], 0x5c
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
lea eax, [esp + 0x3c]
push eax
push 0x442aa8
push 1
push 0
push 0x442ab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4367f9
mov dword [esp], 0x57854996
mov dword [esp + 4], 0x538e5587
mov dword [esp + 8], 0x5f9151b4
mov dword [esp + 0xc], 0x5b8f5d95
mov dword [esp + 0x10], 0x67585982
mov dword [esp + 0x14], 0x6564
mov eax, 0x8e
mov ecx, 0x71
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x8e]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
mov bl, 0x39
sub bl, dl
mov byte [esp + eax - 0x8e], bl
inc eax
dec ecx
cmp eax, 0xa6
jne 0x436490
mov ebx, esp
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4367e4
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x54]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4367da
mov dword [esp], 0xe353e157
mov dword [esp + 4], 0xe7e6e558
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
movzx edx, byte [esp + eax]
lea ecx, [eax - 0x333b7c28]
lea ebx, [eax*2 - 0x6676f850]
sub ebx, eax
add ebx, 0x28
and ebx, edx
or ecx, edx
sub ecx, ebx
add cl, 0xc8
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xb
jb 0x436520
mov ebx, esp
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x50], eax
mov dword [esp], 0x21792789
mov dword [esp + 4], 0x3d7d2374
mov dword [esp + 8], 0x39923f61
mov dword [esp + 0xc], 0x35403b58
mov dword [esp + 0x10], 0x31683754
mov dword [esp + 0x14], 0xd633362
mov dword [esp + 0x18], 0x96e0f5b
mov dword [esp + 0x1c], 0x5b10ba1
mov dword [esp + 0x20], 0x14b07b2
mov dword [esp + 0x24], 0x1da30372
mov dword [esp + 0x28], 0x19451f5e
mov dword [esp + 0x2c], 0x15b71b49
mov dword [esp + 0x30], 0x1714
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 9
xor cl, byte [esp + eax]
add cl, 0xd3
mov byte [esp + eax], cl
inc eax
cmp eax, 0x34
jne 0x4365d0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x38]
mov ecx, dword [ebx]
lea edx, [esp + 0x5c]
push edx
push 0
push 0x30
mov dword [esp + 0x70], eax
push eax
push dword [esp + 0x60]
push ebx
call dword [ecx + 0x50]
test eax, eax
js 0x4367c6
mov dword [esp + 0x54], 0
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
lea ebx, [esp + 0x58]
push edx
push ebx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4367bc
cmp eax, 1
je 0x4367bc
cmp dword [esp + 0x54], 0
je 0x4367bc
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x58]
mov dword [esp], 0x63c761d3
mov dword [esp + 4], 0x67ff65f6
mov dword [esp + 8], 0x5bc659f9
mov dword [esp + 0xc], 0x5fcb5de2
mov dword [esp + 0x10], 0x53f051cd
mov dword [esp + 0x14], 0x57c455f1
mov word [esp + 0x18], 0x4948
mov dword [esp + 0x1a], 0
mov byte [esp + 0x1e], 0
xor ecx, ecx
mov ebx, esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x98
xor dl, byte [esp + ecx]
add dl, 8
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x1f
jne 0x4366b0
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0x70]
push edx
push 0
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4367a7
cmp word [esp + 0x68], 8
jne 0x4367a7
mov eax, dword [esp + 0x70]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x34], eax
je 0x43673d
add eax, 2
xor ebx, ebx
jmp 0x43671c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43673f
cmp cx, 0x7f
jbe 0x436710
movzx edx, cx
cmp edx, 0x7ff
ja 0x436732
add ebx, 2
jmp 0x436711
cmp cx, 0xffff
je 0x436711
add ebx, 3
jmp 0x436711
xor ebx, ebx
lea eax, [ebx + 1]
mov dword [esp + 0x60], eax
push eax
call fcn.0040c860
add esp, 4
push dword [esp + 0x34]
push dword [esp + 0x64]
mov dword [esp + 0x3c], eax
push eax
call fcn.00424dc0
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x436775
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
jb 0x436784
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 0x38]
push ebx
lea eax, [esp + 0x48]
push eax
call fcn.0040c890
add esp, 0xc
push ebx
call fcn.0040c870
add esp, 4
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x50]
call ebx
push dword [esp + 0x64]
call ebx
mov ebx, esp
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x7c]
mov dword [esp], 0
push 0x72a7c387
push dword [0x44adf8]
call fcn.0043eac0
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x4369c1
imul eax, dword [esp], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x40], eax
push 0x10
push 9
push edi
push eax
call fcn.0041db20
add esp, 0x10
mov ecx, eax
neg ecx
mov edx, eax
nop
dec ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x436850
mov esi, ecx
not esi
and ecx, eax
mov edx, eax
not edx
and edx, esi
mov esi, ecx
sub esi, edx
add esi, 8
je 0x436881
sub edx, ecx
add eax, edx
add eax, 0xfffffff8
push esi
push 0x30
push eax
call fcn.0040c8e0
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0x44], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x40], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x44], ecx
push 0x10
push 9
push eax
push ecx
call fcn.0041db20
add esp, 0x10
mov ecx, eax
neg ecx
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x4368c0
mov esi, ecx
not esi
and ecx, eax
mov edx, eax
not edx
and edx, esi
mov esi, ecx
sub esi, edx
add esi, 8
je 0x4368f1
sub edx, ecx
add eax, edx
add eax, 0xfffffff8
push esi
push 0x30
push eax
call fcn.0040c8e0
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x48], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x44], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x48], ecx
push 0x10
push 9
push eax
push ecx
call fcn.0041db20
add esp, 0x10
mov ecx, eax
neg ecx
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x436930
mov esi, ecx
not esi
and ecx, eax
mov edx, eax
not edx
and edx, esi
mov esi, ecx
sub esi, edx
add esi, 8
je 0x436961
sub edx, ecx
add eax, edx
add eax, 0xfffffff8
push esi
push 0x30
push eax
call fcn.0040c8e0
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x4c], 0
setne al
imul eax, dword [esp + eax*4 + 0x48], 0x1a5845
add eax, 0xebde8a13
push 0x10
push 9
push edi
push eax
call fcn.0041db20
add esp, 0x10
mov ecx, eax
neg ecx
mov edx, eax
nop
dec ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x436990
mov esi, ecx
not esi
and ecx, eax
mov edx, eax
not edx
and edx, esi
mov esi, ecx
sub esi, edx
add esi, 8
je 0x4369c1
sub edx, ecx
add eax, edx
add eax, 0xfffffff8
push esi
push 0x30
push eax
call fcn.0040c8e0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret