Function at 0x436c50
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x44c2ac]
mov dword [esp + 4], 0x19471b77
mov dword [esp + 8], 0x65db679f
mov dword [esp + 0xc], 0x61c963d8
mov dword [esp + 0x10], 0x6d226fd3
mov dword [esp + 0x14], 0x69dd6bd2
mov dword [esp + 0x18], 0x75dd77d2
mov dword [esp + 0x1c], 0x7172731f
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
mov ecx, 0x6cece93b
mov edx, 0x931316c4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x6cece937]
lea edi, [esi + esi]
not edi
add edi, esi
mov ebx, edi
xor ebx, 0x609a38e6
or edi, 0x9f65c719
and edi, ebx
and esi, 0xffffffe6
or esi, edi
mov edi, edx
and edi, 0x93010619
mov ebx, ecx
and ebx, 0x60882866
or ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 0x58
xor ebx, 0xd8
lea ebx, [ebx + esi*2]
inc bl
mov byte [esp + ecx - 0x6cece937], bl
inc ecx
dec edx
cmp ecx, 0x6cece95a
jne 0x436cc0
lea ecx, [esp + 0x44]
lea esi, [esp + 0x84]
lea ebx, [esp + 4]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x436d42
mov dword [esp + 0x84], 0x3a0043
mov dword [esp + 0x88], 0x5c
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
push eax
push 0x443aa8
push 1
push 0
push 0x443ab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov edi, dword [ebp + 8]
js 0x4372d5
mov dword [esp + 4], 0x790b7b02
mov dword [esp + 8], 0x651a6709
mov dword [esp + 0xc], 0x612f6300
mov dword [esp + 0x10], 0x6d1d6f17
mov dword [esp + 0x14], 0x69346b16
mov dword [esp + 0x18], 0x9768
mov byte [esp + 0x1c], 0
xor eax, eax
mov ecx, eax
add cl, 0x6b
xor cl, byte [esp + eax + 4]
add cl, 0xe9
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x19
jne 0x436dd0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x88], edi
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
js 0x4372c1
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x58]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4372b7
mov dword [esp + 4], 0x29fd2bfd
mov dword [esp + 8], 0x2d2e2fe4
mov edx, 0xc7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0xc3]
mov ebx, eax
mov esi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xcd
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x1d
mov byte [esp + edx - 0xc3], al
inc edx
cmp edx, 0xcf
jne 0x436e60
lea ebx, [esp + 4]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x58], eax
mov dword [esp + 4], 0xd109cf19
mov dword [esp + 8], 0xd515d31c
mov dword [esp + 0xc], 0xd902d711
mov dword [esp + 0x10], 0xdd30db38
mov dword [esp + 0x14], 0xa118df3c
mov dword [esp + 0x18], 0xa573a372
mov dword [esp + 0x1c], 0xa946a76b
mov dword [esp + 0x20], 0xad01ab71
mov dword [esp + 0x24], 0xb15baf02
mov dword [esp + 0x28], 0xb513b342
mov dword [esp + 0x2c], 0xb97db776
mov dword [esp + 0x30], 0xbd6fbb69
mov word [esp + 0x34], 0xbfbc
mov dword [esp + 0x36], 0
mov word [esp + 0x3a], 0
mov eax, 0xeb2accad
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x14d53357]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x9c
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
xor ecx, 0x9e
add ecx, edi
add ecx, edx
inc cl
mov byte [esp + eax + 0x14d53357], cl
inc eax
cmp eax, 0xeb2acce5
jne 0x436f40
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esi]
lea edx, [esp + 0x64]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
push dword [esp + 0x68]
push esi
call dword [ecx + 0x50]
test eax, eax
mov edi, dword [ebp + 8]
js 0x43729e
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea esi, [esp + 0x60]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437294
cmp eax, 1
je 0x437294
cmp dword [esp + 0x5c], 0
je 0x437294
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0x89318b21
mov dword [esp + 8], 0x85318706
mov dword [esp + 0xc], 0x8136833b
mov dword [esp + 0x10], 0x9d159f52
mov dword [esp + 0x14], 0x99249b2f
mov dword [esp + 0x18], 0x95189723
mov word [esp + 0x1c], 0x9394
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
mov ecx, 0xe3
mov edx, 0x1c
nop
movzx esi, byte [esp + ecx - 0xdf]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x91
mov byte [esp + ecx - 0xdf], bl
inc ecx
dec edx
cmp ecx, 0x102
jne 0x437050
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x78]
push esi
push 0
lea ebx, [esp + 0x14]
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437283
cmp word [esp + 0x70], 8
jne 0x437283
mov esi, dword [esp + 0x78]
movzx ecx, word [esi]
test cx, cx
je 0x4370ed
lea eax, [esi + 2]
xor edi, edi
jmp 0x4370cc
inc edi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4370ef
cmp cx, 0x7f
jbe 0x4370c0
movzx edx, cx
cmp edx, 0x7ff
ja 0x4370e2
add edi, 2
jmp 0x4370c1
cmp cx, 0xffff
je 0x4370c1
add edi, 3
jmp 0x4370c1
xor edi, edi
lea eax, [edi + 1]
push eax
call fcn.0040cdc0
add esp, 4
mov ecx, edi
mov dword [esp], eax
mov edi, eax
mov dword [esp + 0x54], ecx
test ecx, ecx
je 0x43722d
movzx eax, word [esi]
mov edi, dword [esp]
test ax, ax
je 0x43722d
mov ecx, dword [esp + 0x54]
mov edi, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edx, [esi + 2]
cmp bx, 0x7f
ja 0x437150
mov byte [edi], bl
lea eax, [edi + 1]
jmp 0x4371d0
cmp ebx, 0x7ff
ja 0x437174
cmp ecx, 2
jb 0x437174
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [edi], al
and bl, 0x3f
or bl, 0x80
lea eax, [edi + 2]
mov byte [edi + 1], bl
jmp 0x4371d0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x4371ea
cmp ecx, 4
jb 0x4371ea
movzx edx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + edx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [edi], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [edi + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 2], al
and dl, 0x3f
or dl, 0x80
lea eax, [edi + 4]
mov byte [edi + 3], dl
mov edx, esi
nop
nop
nop
nop
nop
nop
nop
add ecx, edi
sub ecx, eax
mov esi, edx
mov edi, eax
movzx eax, word [esi]
test ax, ax
je 0x43722d
test ecx, ecx
jne 0x437130
jmp 0x43722d
movzx eax, ax
cmp eax, 0xdc00
jne 0x4371f8
mov esi, edx
jmp 0x4371d8
cmp ecx, 3
jb 0x437229
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [edi], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 1], al
mov eax, ebx
xor eax, 0xc0
or ebx, 0x3f
and ebx, eax
add bl, 0x80
lea eax, [edi + 3]
mov byte [edi + 2], bl
jmp 0x4371d0
mov eax, edi
jmp 0x4371d0
mov byte [edi], 0
mov eax, 3
mov ecx, dword [esp + 0x54]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x437245
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
mov edi, dword [ebp + 8]
lea ebx, [esp + 4]
lea esi, [esp + 0x70]
jb 0x43725f
mov eax, 3
lea eax, [eax*4 + 4]
push eax
push dword [esp + 4]
lea eax, [esp + 0x4c]
push eax
call fcn.0040cdf0
add esp, 0xc
push dword [esp]
call fcn.0040cdd0
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x58]
call esi
push dword [esp + 0x68]
call esi
lea esi, [esp + 0x84]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 4], 0
push 0x72a7c387
push dword [0x44c2a4]
call fcn.0043f9e0
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x43747a
imul eax, dword [esp + 4], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x44], eax
mov esi, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.0041e310
add esp, 0x10
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x437330
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x43735a
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.0040cf20
add esp, 0xc
lea eax, [edi + 8]
xor ecx, ecx
cmp dword [esp + 0x48], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x44], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x48], ecx
mov esi, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041e310
add esp, 0x10
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x437390
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x4373ba
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.0040cf20
add esp, 0xc
lea eax, [edi + 0x10]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x48], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
mov esi, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041e310
add esp, 0x10
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x4373f0
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x43741a
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.0040cf20
add esp, 0xc
add edi, 0x18
xor eax, eax
cmp dword [esp + 0x50], 0
setne al
imul eax, dword [esp + eax*4 + 0x4c], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.0041e310
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x437450
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x43747a
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.0040cf20
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret