Function at 0x4378d0
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using speck
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44ae9c]
mov dword [esp + 4], 0x9cc89abc
mov dword [esp + 8], 0x90ec9e14
mov dword [esp + 0xc], 0x94f692e5
mov dword [esp + 0x10], 0xa8d396e8
mov dword [esp + 0x14], 0xacd2aadb
mov dword [esp + 0x18], 0xa0caaedb
mov dword [esp + 0x1c], 0xa4a3a284
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
lea edx, [ecx - 0x77571bef]
xor edx, esi
mov esi, edx
not esi
and esi, 0x89
and edx, 0x76
sub edx, esi
inc dl
mov byte [esp + ecx + 4], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x1c
jb 0x437930
lea esi, [esp + 0x58]
lea ecx, [esp + 0x70]
lea edx, [esp + 4]
push esi
push 8
push ecx
push 0xd
push edx
push 0
call eax
test eax, eax
jns 0x4379fa
mov dword [esp + 4], 0xeaaa
mov eax, 0xe1
mov ecx, 0x1e
nop
movzx esi, byte [esp + eax - 0xdd]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xf8
mov byte [esp + eax - 0xdd], dl
inc eax
dec ecx
cmp eax, 0xe5
jne 0x437990
movzx eax, word [esp + 4]
mov word [esp + 0x70], ax
mov word [esp + 4], 0x4a03
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x41
xor cl, byte [esp + eax + 4]
add cl, 0xf8
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 3
jb 0x4379d0
movzx eax, word [esp + 4]
mov word [esp + 0x72], ax
mov dword [esp + 4], 0x289b
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
and ecx, 2
mov edx, eax
or edx, 2
imul edx, ecx
mov esi, ecx
xor esi, 2
mov ecx, eax
and ecx, 1
mov ebx, ecx
neg ebx
and ebx, esi
add edx, ebx
mov esi, eax
xor esi, 0xcc90144f
mov ebx, edx
and ebx, esi
xor esi, edx
lea edx, [esi + ebx*2]
xor dl, byte [esp + eax + 4]
add dl, 0x88
mov byte [esp + eax + 4], dl
or eax, 0xfffffff9
add eax, ecx
add eax, 8
cmp eax, 4
jb 0x437a10
movzx eax, word [esp + 4]
mov word [esp + 0x74], ax
mov word [esp + 0x76], 0
mov dword [esp + 0x64], 0x51363c59
mov dword [esp + 0x60], 0x43b2f24f
mov dword [esp + 0x5c], 0xfd9eafef
mov dword [esp + 0x58], 0xf3947e7c
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
push eax
push 0x441678
push 1
push 0
push 0x441688
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43801f
mov dword [esp + 4], 0xa3eda1f2
mov dword [esp + 8], 0xa7f2a5eb
mov dword [esp + 0xc], 0xabe9a9f4
mov dword [esp + 0x10], 0xafe3ade5
mov dword [esp + 0x14], 0xb380b1e6
mov word [esp + 0x18], 0xb5b4
mov byte [esp + 0x1a], 0
mov eax, 0xa0
mov edi, 0x88f875f
movzx esi, byte [esp + eax - 0x9c]
lea ebx, [eax - 0x88f8800]
mov ecx, edi
or ecx, esi
lea edx, [edi - 0x88f8700]
and edx, esi
xor edx, ecx
and edx, eax
add edx, edx
mov ecx, edx
not ecx
and ecx, ebx
and edx, edi
sub edx, ecx
mov ecx, edx
xor ecx, esi
not edx
and edx, esi
add edx, edx
sub edx, ecx
mov byte [esp + eax - 0x9c], dl
inc eax
dec edi
cmp eax, 0xb7
jne 0x437af0
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
mov edi, dword [ebp + 8]
js 0x43800e
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x58]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x438004
mov dword [esp + 0x6c], esi
mov dword [esp + 4], 0x18d606d2
mov dword [esp + 8], 0x1c1b1ac5
xor eax, eax
movzx edx, byte [esp + eax + 4]
mov ecx, 0x2ed24092
sub ecx, eax
or ecx, edx
mov esi, 0x92
sub esi, eax
and esi, edx
not ecx
or ecx, esi
lea edx, [ecx + 0x97]
not ecx
and ecx, 1
xor edx, 1
lea ecx, [edx + ecx*2]
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 8
jb 0x437ba0
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x48], eax
mov dword [esp + 4], 0x3e783c48
mov dword [esp + 8], 0x32743043
mov dword [esp + 0xc], 0x36413470
mov dword [esp + 0x10], 0x2a732817
mov dword [esp + 0x14], 0x2e6b2c0b
mov dword [esp + 0x18], 0x225e205d
mov dword [esp + 0x1c], 0x2605245e
mov dword [esp + 0x20], 0x5ac05850
mov dword [esp + 0x24], 0x5e0e5cc5
mov dword [esp + 0x28], 0x523e500d
mov dword [esp + 0x2c], 0x562c5411
mov dword [esp + 0x30], 0x4a3a4828
mov dword [esp + 0x34], 0x4c4b
mov eax, 0xaf3ffd23
mov ecx, 0x10c002dc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x50c002e1]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, 0xb3a0f475
and edx, 0xffffff8a
or edx, esi
mov esi, ecx
and esi, 0x10800075
mov ebx, eax
xor ebx, 0xa320f475
or ebx, esi
xor ebx, edx
mov edx, ebx
not edx
and edx, 0x19
and ebx, 0xe6
sub ebx, edx
inc bl
mov byte [esp + eax + 0x50c002e1], bl
inc eax
dec ecx
cmp eax, 0xaf3ffd57
jne 0x437c70
lea eax, [esp + 4]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esi]
lea edx, [esp + 0x54]
push edx
push 0
push 0x30
mov dword [esp + 0x74], eax
push eax
mov ebx, dword [esp + 0x58]
push ebx
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x437ff1
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
lea esi, [esp + 0x50]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437fe7
cmp eax, 1
je 0x437fe7
cmp dword [esp + 0x4c], 0
je 0x437fe7
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x50]
mov dword [esp + 4], 0x49ed47f5
mov dword [esp + 8], 0x4de54bd8
mov dword [esp + 0xc], 0xb11c4fef
mov dword [esp + 0x10], 0xb521b3fc
mov dword [esp + 0x14], 0xb91ab71b
mov dword [esp + 0x18], 0xbd2ebb1f
mov word [esp + 0x1c], 0xbfbe
mov byte [esp + 0x1e], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
movzx esi, byte [esp + edx + 4]
mov edi, ecx
and edi, 0x2c
mov ebx, edx
xor ebx, 0x90a350f6
add ebx, edi
mov edi, ebx
and edi, esi
add ebx, esi
add edi, edi
sub ebx, edi
add bl, 0x50
mov byte [esp + edx + 4], bl
inc edx
add ecx, 2
cmp edx, 0x1b
jne 0x437d80
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x88]
push esi
push 0
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
mov edi, dword [ebp + 8]
js 0x437fd2
cmp word [esp + 0x80], 8
jne 0x437fd2
mov eax, dword [esp + 0x88]
movzx ebx, word [eax]
test bx, bx
mov dword [esp], eax
je 0x437e2d
add eax, 2
xor esi, esi
mov ecx, ebx
jmp 0x437e0c
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x437e2f
cmp cx, 0x7f
jbe 0x437e00
movzx edx, cx
cmp edx, 0x7ff
ja 0x437e22
add esi, 2
jmp 0x437e01
cmp cx, 0xffff
je 0x437e01
add esi, 3
jmp 0x437e01
xor esi, esi
lea eax, [esi + 1]
push eax
call fcn.00408620
add esp, 4
mov edx, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], esi
test esi, esi
mov esi, dword [esp]
je 0x437f81
mov edx, dword [esp + 0x38]
test bx, bx
je 0x437f81
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x38]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, bx
lea eax, [esi + 2]
mov dword [esp], eax
cmp bx, 0x7f
ja 0x437e90
lea eax, [edx + 1]
mov byte [edx], bl
jmp 0x437eb2
cmp ebx, 0x7ff
ja 0x437ed0
cmp ecx, 2
jb 0x437ed0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [edx], al
and bl, 0x3f
or bl, 0x80
lea eax, [edx + 2]
mov byte [edx + 1], bl
mov esi, dword [esp]
add ecx, edx
sub ecx, eax
mov edx, eax
movzx ebx, word [esi]
test bx, bx
je 0x437f81
test ecx, ecx
jne 0x437e70
jmp 0x437f81
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x437f2d
cmp ecx, 4
jb 0x437f2d
movzx eax, word [esi + 2]
mov dword [esp], eax
add esi, 4
shl ebx, 0xa
mov eax, dword [esp]
add eax, ebx
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
or bl, 0xf0
mov byte [edx], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [edx + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edx + 2], al
mov eax, dword [esp]
and al, 0x3f
or al, 0x80
mov ebx, eax
lea eax, [edx + 4]
mov byte [edx + 3], bl
jmp 0x437eb5
movzx eax, ax
cmp eax, 0xdc00
jne 0x437f3f
mov esi, dword [esp]
jmp 0x437ebb
cmp ecx, 3
jb 0x437f7a
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [edx], al
mov esi, ebx
shr esi, 6
mov eax, esi
not eax
or eax, 0x3f
add eax, esi
add al, 0x81
mov byte [edx + 1], al
mov eax, ebx
xor eax, 0xc0
or ebx, 0x3f
and ebx, eax
add bl, 0x80
lea eax, [edx + 3]
mov byte [edx + 2], bl
jmp 0x437eb2
mov eax, edx
jmp 0x437eb2
mov byte [edx], 0
mov eax, 3
mov ecx, dword [esp + 0x44]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x437f99
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
lea esi, [esp + 0x80]
jb 0x437faf
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov ebx, dword [esp + 0x3c]
push ebx
lea eax, [esp + 0x60]
push eax
call fcn.00408650
add esp, 0xc
push ebx
call fcn.00408630
add esp, 4
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [esp + 0x48]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
call esi
push dword [esp + 0x68]
call esi
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x449e94]
call fcn.0043d470
add esp, 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea ecx, [esp + 0x8c]
push ecx
call eax
test eax, eax
je 0x438059
mov eax, dword [esp + 4]
mov dword [esp + 0x58], eax
xor esi, esi
jmp 0x43806d
add edi, 8
inc esi
cmp esi, 4
je 0x438103
mov eax, 0
test esi, esi
je 0x438080
cmp dword [esp + esi*4 + 0x58], 1
mov eax, esi
sbb eax, 0
mov eax, dword [esp + eax*4 + 0x58]
mov ecx, eax
and ecx, 0xffe5a7ba
mov edx, eax
and edx, 0x1a5845
or eax, 0x1a5845
imul eax, edx
xor edx, 0x1a5845
imul edx, ecx
add eax, edx
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x58], eax
mov ebx, 0xffffffff
push 0x10
push 9
push edi
push eax
call fcn.0041dff0
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x4380d0
mov ecx, ebx
and ecx, 0xfffffff7
not ebx
and ebx, 8
mov edx, ebx
sub edx, ecx
je 0x438060
sub ecx, ebx
add eax, ecx
push edx
push 0x30
push eax
call fcn.004086a0
add esp, 0xc
jmp 0x438060
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret