Function at 0x43aae0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x44f268]
mov dword [esp], 0x13c111ed
mov dword [esp + 4], 0xef5ded65
mov dword [esp + 8], 0xeb57e964
mov dword [esp + 0xc], 0xe73ae551
mov dword [esp + 0x10], 0xe35be152
mov dword [esp + 0x14], 0xff43fd72
mov dword [esp + 0x18], 0xfbfaf905
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
mov ecx, 0x3f017fc
nop
movzx edx, byte [esp + ecx - 0x3f017fc]
lea esi, [ecx - 0x3f01700]
and esi, edx
or edx, ecx
xor edx, esi
neg edx
mov esi, edx
and esi, 0x6d
add esi, esi
xor edx, 0x12
sub edx, esi
add dl, 2
mov byte [esp + ecx - 0x3f017fc], dl
inc ecx
cmp ecx, 0x3f0181b
jne 0x43ab40
lea ecx, [esp + 0x50]
lea esi, [esp + 0x7c]
mov ebx, esp
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
test eax, eax
jns 0x43ab96
mov dword [esp + 0x7c], 0x3a0043
mov dword [esp + 0x80], 0x5c
mov dword [esp + 0x5c], 0x542db00e
mov dword [esp + 0x58], 0x6959d6a0
mov dword [esp + 0x54], 0x899a8f55
mov dword [esp + 0x50], 0x4e208e6f
mov dword [esp + 0x3c], 0
lea eax, [esp + 0x3c]
push eax
push 0x445668
push 1
push 0
push 0x445678
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43afb5
mov dword [esp], 0x81578756
mov dword [esp + 4], 0x8d5e8351
mov dword [esp + 8], 0x89438f28
mov dword [esp + 0xc], 0x955d8b43
mov dword [esp + 0x10], 0x9164974a
mov dword [esp + 0x14], 0x9390
mov eax, 0xcb40c361
nop
nop
movzx ecx, byte [esp + eax + 0x34bf3c9f]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0x1a
mov byte [esp + eax + 0x34bf3c9f], cl
inc eax
cmp eax, 0xcb40c379
jne 0x43ac20
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x80], ebx
push ebx
lea ebx, [esp + 0x20]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x43afa1
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x54]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x43af97
mov dword [esp], 0x4fff49e3
mov dword [esp + 4], 0x43424df0
mov byte [esp + 8], 0
mov esi, 0x2c85cdf2
mov ecx, 0x537a320d
nop
nop
nop
movzx edx, byte [esp + esi - 0x2c85cdf2]
mov ebx, ecx
and ebx, 0x405012f7
mov eax, esi
and eax, 0x20004908
or eax, ebx
xor eax, edx
xor eax, 0xf7
lea ebx, [esi - 0x2c85cd00]
and ebx, edx
or ebx, eax
not edx
mov eax, esi
or eax, edx
sub edx, eax
add edx, ebx
add dl, 0x46
mov byte [esp + esi - 0x2c85cdf2], dl
inc esi
dec ecx
cmp esi, 0x2c85cdfb
jne 0x43acc0
mov ebx, esp
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x40], eax
mov dword [esp], 0x9f5b994f
mov dword [esp + 4], 0xa3679d50
mov dword [esp + 8], 0xa772a167
mov dword [esp + 0xc], 0xab84a584
mov dword [esp + 0x10], 0xaf64a988
mov dword [esp + 0x14], 0xb361ad7a
mov dword [esp + 0x18], 0xb796b17d
mov dword [esp + 0x1c], 0xbb53b56f
mov dword [esp + 0x20], 0xbf89b94a
mov dword [esp + 0x24], 0x43a1bd8a
mov dword [esp + 0x28], 0x478f4186
mov dword [esp + 0x2c], 0x4b9d4597
mov dword [esp + 0x30], 0x4948
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0xda
xor cl, byte [esp + eax]
add cl, 0xbe
mov byte [esp + eax], cl
inc eax
cmp eax, 0x34
jne 0x43ad80
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x38]
mov ecx, dword [esi]
lea edx, [esp + 0x4c]
push edx
push 0
push 0x30
mov dword [esp + 0x6c], eax
push eax
push dword [esp + 0x50]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x43af81
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
lea esi, [esp + 0x48]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43af77
cmp eax, 1
je 0x43af77
cmp dword [esp + 0x44], 0
je 0x43af77
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x48]
mov dword [esp], 0x31d93fe9
mov dword [esp + 4], 0x35c933c2
mov dword [esp + 8], 0xc9ca37d7
mov dword [esp + 0xc], 0xcd3dcb16
mov dword [esp + 0x10], 0xc12ccf33
mov dword [esp + 0x14], 0xc530c327
mov word [esp + 0x18], 0xc7c4
mov dword [esp + 0x1a], 0
mov word [esp + 0x1e], 0
mov ecx, 0xf9ea71f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x6158e0b]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
not esi
and esi, 0xca
and edx, 0x35
sub edx, esi
inc dl
mov byte [esp + ecx + 0x6158e0b], dl
inc ecx
cmp ecx, 0xf9ea7215
jne 0x43ae60
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x70]
push esi
push 0
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43af66
cmp word [esp + 0x68], 8
jne 0x43af66
mov eax, dword [esp + 0x70]
movzx ecx, word [eax]
test cx, cx
mov dword [esp + 0x34], eax
je 0x43aefd
add eax, 2
xor ebx, ebx
jmp 0x43aedc
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43aeff
cmp cx, 0x7f
jbe 0x43aed0
movzx edx, cx
cmp edx, 0x7ff
ja 0x43aef2
add ebx, 2
jmp 0x43aed1
cmp cx, 0xffff
je 0x43aed1
add ebx, 3
jmp 0x43aed1
xor ebx, ebx
lea esi, [ebx + 1]
push esi
call fcn.004083e0
add esp, 4
push dword [esp + 0x34]
push esi
mov dword [esp + 0x3c], eax
push eax
call fcn.004302d0
add esp, 0xc
mov eax, 3
sub eax, ebx
cmp eax, 0xfffffffd
jae 0x43af2e
mov eax, 0xfffffffc
add eax, ebx
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x68]
jb 0x43af41
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 0x38]
push ebx
lea eax, [esp + 0x58]
push eax
call fcn.00408410
add esp, 0xc
push ebx
call fcn.004083f0
add esp, 4
mov ebx, esp
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x40]
call esi
push dword [esp + 0x60]
call esi
lea esi, [esp + 0x7c]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x64]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xbeb8f1a1
push dword [0x44f260]
call fcn.00441930
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
test eax, eax
je 0x43afe3
mov eax, dword [esp]
mov dword [esp + 0x50], eax
xor esi, esi
jmp 0x43affd
inc esi
add edi, 8
cmp esi, 4
je 0x43b093
mov eax, 0
test esi, esi
je 0x43b010
cmp dword [esp + esi*4 + 0x50], 1
mov eax, esi
sbb eax, 0
mov eax, dword [esp + eax*4 + 0x50]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x50], eax
mov ebx, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.00421050
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x43b060
mov ecx, ebx
and ecx, 0xfffffff7
not ebx
and ebx, 8
mov edx, ebx
sub edx, ecx
je 0x43aff0
sub ecx, ebx
add eax, ecx
push edx
push 0x30
push eax
call fcn.00408600
add esp, 0xc
jmp 0x43aff0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret