Function at 0x43f9c0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov esi, dword [0x456550]
mov dword [esp + 0x28], 0x83d181e5
mov dword [esp + 0x2c], 0x8735853d
mov dword [esp + 0x30], 0x8b2f893c
mov dword [esp + 0x34], 0x8fca8d21
mov dword [esp + 0x38], 0x933b9122
mov dword [esp + 0x3c], 0x97339522
mov dword [esp + 0x40], 0x9b9a99fd
mov byte [esp + 0x44], 0
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x88]
cmp eax, 0x1c
ja 0x43fa6a
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x88]
movzx eax, byte [esp + eax + 0x28]
push dword [esp + 0x88]
push eax
call fcn.00443790
add esp, 8
mov ecx, dword [esp + 0x88]
mov byte [esp + ecx + 0x28], al
inc dword [esp + 0x88]
mov eax, dword [esp + 0x88]
cmp eax, 0x1d
jb 0x43fa30
lea eax, [esp + 0x78]
lea ebx, [esp + 0x88]
lea ecx, [esp + 0x28]
push eax
push 8
push ebx
push 0xd
push ecx
push 0
call esi
shr eax, 0x1f
jmp dword [eax*4 + 0x453c04]
mov dword [esp + 0x88], 0x3a0043
mov dword [esp + 0x8c], 0x5c
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x64], 0
lea eax, [esp + 0x64]
push eax
push 0x44dcd0
push 1
push 0
push 0x44dce0
call dword [sym.imp.ole32.dll_CoCreateInstance]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x453c0c]
mov dword [esp + 0x28], 0x237d2172
mov dword [esp + 0x2c], 0x2772257b
mov dword [esp + 0x30], 0x3b793994
mov dword [esp + 0x34], 0x3f633d65
mov dword [esp + 0x38], 0x33403166
mov word [esp + 0x3c], 0x3534
mov dword [esp + 0x3e], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x19
ja 0x43fb6b
nop
mov eax, dword [esp + 0x10]
movzx eax, byte [esp + eax + 0x28]
push dword [esp + 0x10]
push eax
call fcn.004437e0
add esp, 8
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x28], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 0x1a
jb 0x43fb40
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x453c14]
mov dword [esp + 0xa8], esi
mov esi, dword [esp + 0x60]
jmp dword [0x453c1c]
xor eax, eax
test edi, edi
setne al
jmp dword [eax*4 + 0x453cf4]
xor eax, eax
cmp dword [esp + edi*4 + 0x78], 0
sete al
jmp dword [eax*4 + 0x453cfc]
mov eax, dword [case.0x43fe99.55]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, edi
jmp 0x43fc03
lea eax, [edi - 1]
mov eax, dword [esp + eax*4 + 0x78]
mov ecx, eax
and ecx, 0x1a5845
mov edx, eax
or eax, 0x1a5845
imul eax, ecx
xor ecx, 0x1a5845
and edx, 0xffe5a7ba
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + edi*4 + 0x78], eax
mov ebx, 0xfffffff7
push 0x10
push 9
push esi
push eax
call fcn.00437420
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne case.default.0x43fc64
xor edx, edx
cmp ebx, 0
setne dl
xor ecx, ecx
jmp dword [edx*4 + 0x453d14]
add esi, 8
inc edi
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x453cdc]
mov eax, dword [case.0x43fe99.40]
nop
nop
nop
nop
jmp eax
mov dword [esp + 0x24], edi
jmp dword [esp + 4]
mov edx, dword [eax + ebx*4]
mov dword [esp + ebx*4 + 0x78], edx
nop
mov edx, ebx
and edx, 0xfffffffb
mov edi, ebx
and edi, 4
mov esi, ebx
or esi, 4
imul esi, edi
xor edi, 4
imul edi, edx
add esi, eax
mov edx, dword [edi + esi]
mov dword [esp + ebx*4 + 0x78], edx
jmp dword [0x453c60]
mov edi, dword [esp + 0x24]
mov edx, edi
not edx
and edx, 4
and edi, 0xfffffffb
sub edi, edx
xor edx, edx
cmp edi, 4
setb dl
jmp dword [edx*4 + 0x453c64]
jmp ecx
mov edx, ebx
xor edx, 1
and ebx, 1
lea ebx, [edx + ebx*2]
xor edx, edx
cmp ebx, 4
setb dl
jmp dword [edx*4 + 0x453c4c]
mov ebx, dword [esp + 0x9c]
lea edi, [esp + 0x10]
jmp dword [0x453c7c]
push eax
call fcn.0040cc00
add esp, 4
jmp case.0x43ff90.0
mov dword [esp + 0x28], 0xcfbfc9a3
mov dword [esp + 0x2c], 0xc3c2cdb0
mov byte [esp + 0x30], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 8
ja 0x43fdab
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x10]
movzx eax, byte [esp + eax + 0x28]
push dword [esp + 0x10]
push eax
call fcn.00443830
add esp, 8
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x28], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 9
jb 0x43fd80
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x28], 0xf941fbb1
mov dword [esp + 0x2c], 0xfd45ff44
mov dword [esp + 0x30], 0xf146f339
mov dword [esp + 0x34], 0xf528f710
mov dword [esp + 0x38], 0xe950eb14
mov dword [esp + 0x3c], 0xed5fef5e
mov dword [esp + 0x40], 0xe102e35f
mov dword [esp + 0x44], 0xe579e749
mov dword [esp + 0x48], 0xd90fdb76
mov dword [esp + 0x4c], 0xdd7fdf0e
mov dword [esp + 0x50], 0xd16dd31a
mov dword [esp + 0x54], 0xd563d761
mov word [esp + 0x58], 0xcbd4
mov dword [esp + 0x5a], 0
mov word [esp + 0x5e], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x37
ja 0x43fe6b
nop
mov eax, dword [esp + 0x10]
movzx eax, byte [esp + eax + 0x28]
push dword [esp + 0x10]
push eax
call fcn.004438a0
add esp, 8
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x28], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 0x38
jb 0x43fe40
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x74]
push edx
push 0
push 0x30
push ebx
mov dword [esp + 0xb4], esi
push esi
push eax
call dword [ecx + 0x50]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x453c34]
mov dword [esp + 0x6c], 0
mov eax, dword [esp + 0x74]
mov ecx, dword [eax]
lea edx, [esp + 0x6c]
lea esi, [esp + 0x70]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
setns cl
cmp eax, 1
setne al
cmp dword [esp + 0x6c], 0
setne dl
and dl, al
and dl, cl
movzx eax, dl
jmp dword [eax*4 + 0x453c3c]
lea edi, [esp + 0x10]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x70]
mov dword [esp + 0x28], 0x23472153
mov dword [esp + 0x2c], 0x27bf25b6
mov dword [esp + 0x30], 0x5bc65939
mov dword [esp + 0x34], 0x5fcb5d22
mov dword [esp + 0x38], 0x533051cd
mov dword [esp + 0x3c], 0x57c45531
mov dword [esp + 0x40], 0x4948
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x1b
ja 0x43ff6b
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
movzx eax, byte [esp + eax + 0x28]
push dword [esp + 0xc]
push eax
call fcn.004438f0
add esp, 8
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x28], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x1c
jb 0x43ff40
mov eax, dword [esi]
push 0
push 0
push edi
push 0
lea ecx, [esp + 0x38]
push ecx
push esi
call dword [eax + 0x10]
test eax, eax
setns al
cmp word [esp + 0x10], 8
sete cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x453c44]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [0x453c90]
mov esi, dword [esp + 0x74]
mov edi, dword [esi]
jmp dword [0x453c98]
push esi
call dword [edi + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
call dword [edi + 8]
jmp dword [0x453ca0]
mov edi, ebx
mov ebx, dword [esp + 0xa4]
jmp dword [0x453ca4]
push dword [esp + 0x18]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edx, dword [esp + 0x18]
mov dword [esp + 8], eax
lea eax, [edx + eax*2]
mov dword [esp + 0x24], eax
movzx ecx, word [edx]
test cx, cx
mov dword [esp + 4], edx
je 0x44004a
xor edi, edi
mov eax, edx
jmp 0x440022
add edi, edx
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
je 0x44004c
cmp eax, dword [esp + 0x24]
jae 0x44004c
movzx esi, cx
cmp esi, 0x800
mov ecx, 3
sbb ecx, 0
mov edx, 1
cmp esi, 0x80
jb 0x440014
mov edx, ecx
jmp 0x440014
xor edi, edi
mov dword [esp + 0x9c], ebx
lea eax, [edi + 1]
mov dword [esp + 0x68], eax
push eax
call fcn.0040cbf0
add esp, 4
mov ecx, eax
test edi, edi
mov esi, dword [esp + 4]
jle 0x44015e
mov ecx, eax
cmp dword [esp + 8], 0
jle 0x44015e
lea ecx, [eax + edi]
mov dword [esp + 0xa0], ecx
add dword [esp + 0x68], eax
add esi, 2
mov ecx, eax
movzx edx, word [esi - 2]
test dx, dx
je 0x44015e
cmp dx, 0x7f
ja 0x4400b3
mov byte [ecx], dl
mov dword [esp + 4], 1
jmp 0x44013e
mov dword [esp + 8], ecx
not ecx
add ecx, dword [esp + 0x68]
movzx ebx, dx
cmp ecx, 2
jb 0x4400f0
cmp ebx, 0x7ff
ja 0x4400f0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov ebx, dword [esp + 8]
mov byte [ebx], cl
mov ecx, ebx
and dl, 0x3f
or dl, 0x80
mov byte [ebx + 1], dl
mov dword [esp + 4], 2
jmp 0x44013e
mov dword [esp + 4], 0
cmp ecx, 3
mov ecx, dword [esp + 8]
jb 0x44013e
mov ecx, ebx
mov dword [esp + 0x98], ebx
shr ecx, 0xc
or cl, 0xe0
mov ebx, dword [esp + 8]
mov byte [ebx], cl
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0x98]
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ecx + 1], bl
and dl, 0x3f
or dl, 0x80
mov byte [ecx + 2], dl
mov dword [esp + 4], 3
add ecx, dword [esp + 4]
cmp ecx, dword [esp + 0xa0]
jae 0x44015e
mov edx, ecx
lea ecx, [esi + 2]
cmp esi, dword [esp + 0x24]
mov esi, ecx
mov ecx, edx
jb 0x440091
mov byte [ecx], 0
mov ecx, dword [case.0x43ff90.5]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [case.0x43ff90.13]
xor edx, edx
cmp ebx, 4
setb dl
jmp dword [edx*4 + 0x453c4c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push esi
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push esi
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
jmp dword [0x453c28]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x453c2c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x78], eax
xor edi, edi
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x453cdc]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push ebx
call eax
mov ecx, dword [case.0x43fe99.39]
nop
nop
nop
nop
nop
nop
nop
jmp ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x453cd4]
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], 0
push 0xd2e7977e
push dword [0x456548]
call fcn.00449860
add esp, 8
jmp 0x4401df
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ebx, [esp + 0x88]
mov esi, dword [esp + 0xa8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esp + 0x64]
mov eax, dword [esi]
mov edi, dword [eax + 8]
jmp dword [0x453cb4]
push esi
call edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
call edi
jmp dword [0x453cc0]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
call esi
push edi
call esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
call esi
push edi
call esi
jmp dword [0x453cb0]