Function at 0x1400deae0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rdx
mov eax, dword [0x141dd9270]
imul eax, dword [0x141dd9274]
scasd eax, dword [rdi]
add eax, 0x1cfa76a
and eax, 0x25a720f
imul eax, eax, 0x2e652f58
or eax, 0xfc334d75
cmp eax, 0x22500e30
jne 0x1400deb30
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
nop
mov eax, dword [0x141dd9278]
add eax, dword [0x141dd927c]
imul rax, rax, 0x2a361789
shr rax, 0x3d
imul edx, eax, 0xe6ad353d
or edx, 0xe5f3549b
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r8, rsp
cmp edx, 0x908b46af
je 0x1400deb30
mov eax, dword [0x141dd9280]
add eax, dword [0x141dd9284]
cmp eax, 0xd5ec61a
jne 0x1400debb0
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
nop word cs:[rax + rax]
mov edx, dword [0x141dd9288]
imul edx, dword [0x141dd928c]
and edx, 0x530a0aa3
add edx, 0x928988ee
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rax, rsp
cmp edx, 0xc576fb09
jb 0x1400debb0
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x20], rcx
mov eax, dword [0x141dd9290]
imul eax, dword [0x141dd9294]
imul eax, eax, 0xf7b6da59
add eax, 0x4b45a9b6
imul rax, rax, 0x7d3411ef
shr rax, 0x3e
cmp eax, 0x999645af
jne 0x1400decb0
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rcx], 0
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
lea rcx, [0x141db9b54]
lea r9, [0x141db9b38]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
nop
mov eax, dword [0x141dd9298]
add eax, dword [0x141dd929c]
imul eax, eax, 0x64acc817
imul r12, rax, 0x5019d6a3
shr r12, 0x3e
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400ef330
invalid
add dword [rax], eax
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rbx, rsp
mov qword [r15], 0
sub rsp, 0x30
mov qword [rsp + 0x20], r15
lea rcx, [0x141db9b54]
xor edx, edx
mov r8d, 1
lea r9, [0x141db9b38]
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
cmp r12d, 0x2c0de624
ja 0x1400decb0
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], rbx
mov qword [rbp], r14
mov qword [rbp - 8], rsi
test eax, eax
js 0x1400deef4
nop word cs:[rax + rax]
mov eax, dword [0x141dd92a0]
xor edx, edx
div dword [0x141dd92a4]
imul eax, eax, 0x479f547c
cmp eax, 0x729f4341
je 0x1400ded80
mov r15, qword [r15]
mov r12, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x48]
mov ecx, 0xf15200e5
nop dword [rax + rax]
mov eax, dword [str.a1p]
xor edx, edx
div dword [0x141dd92ac]
imul rax, rcx
shr rax, 0x3c
add eax, 0xf10fb016
and eax, 0x91011038
cmp eax, 0xb4f03bd1
ja 0x1400dedb0
test r15, r15
je 0x1400dee70
sub rsp, 0x20
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
call fcn.1400dd2c0
add rsp, 0x20
mov r13, rax
mov qword [rsi], 0
mov rax, qword [r15]
mov ecx, 0x87eb49d9
nop word [rax + rax]
mov edx, dword [0x141dd92e8]
imul edx, dword [0x141dd92ec]
or edx, 0x745c2b3c
imul rdx, rcx
shr rdx, 0x3e
add edx, 0x64a90ced
cmp edx, 0xf5479bc0
ja 0x1400dee10
mov rbx, qword [rax + 0x18]
mov eax, dword [0x141dd92f0]
add eax, dword [0x141dd92f4]
or eax, 0x1aa24862
imul eax, eax, 0x2a610ccc
add eax, 0x567c551
cmp eax, 0x65a7a9c2
jae 0x1400df0ab
jmp 0x1400df112
mov eax, dword [0x141dd92b0]
and eax, dword [0x141dd92b4]
and eax, 0x22489e95
add eax, 0x908d9684
cmp eax, 0xe4aa7b0d
ja 0x1400dee70
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 0x18]
nop word cs:[rax + rax]
mov eax, dword [0x141dd92b8]
or eax, dword [0x141dd92bc]
imul eax, eax, 0xe4340c9f
and eax, 0xa3622014
xor eax, 0x292dca2
cmp eax, 0x31541549
jb 0x1400deea0
nop word cs:[rax + rax]
mov eax, dword [0x141dd92c0]
and eax, dword [0x141dd92c4]
and eax, 0x35eb6140
xor eax, 0x7611b49e
cmp eax, 0x3360624d
jb 0x1400deed0
xor ebx, ebx
jmp 0x1400df007
mov ebx, eax
mov eax, dword [0x141dd92c8]
xor edx, edx
div dword [0x141dd92cc]
imul rax, rax, 0x75a948cb
shr rax, 0x3e
or eax, 0xf3249a4a
mov ecx, 0xae01d591
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xd97fcfd1
ja 0x1400def63
mov esi, dword [0x141dd92d0]
or esi, dword [0x141dd92d4]
and esi, 0xdca6c8a
add esi, 0x512e5b9c
mov qword [rdi], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
cmp esi, 0x63cc4eba
jbe 0x1400def7f
mov qword [rdi], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
jmp 0x1400def29
mov rcx, qword [rdi]
test rcx, rcx
mov r12, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
je 0x1400df003
mov rsi, qword [rbp - 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dd92d8]
and eax, dword [0x141dd92dc]
add eax, 0x6ac9d211
and eax, 0x1ad2196c
imul eax, eax, 0xc048d68f
cmp eax, 0x195e693
jb 0x1400defa0
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov edx, dword [0x141dd92e0]
sub edx, dword [0x141dd92e4]
add edx, 0x65638dc3
xor edx, 0x8210000c
or edx, 0x394bff71
cmp edx, 0x105292e2
je 0x1400defd0
sub rsp, 0x20
call qword [rax + 0x10]
add rsp, 0x20
jmp 0x1400df007
mov rsi, qword [rbp - 0x10]
mov eax, dword [0x141dd9318]
or eax, dword [0x141dd931c]
add eax, 0xeb71d937
imul rax, rax, 0x23a4b7bf
shr rax, 0x3d
cmp eax, 0xf459a9a1
jne 0x1400df050
movzx eax, byte [rdi + 2]
mov byte [r12 + 3], al
movzx eax, word [rdi]
mov word [r12 + 1], ax
movups xmm0, xmmword [rsi]
movups xmmword [r12 + 0x10], xmm0
adc byte [rcx - 0x3a], al
add al, 0x24
add byte [rcx - 0x77], al
pop rsp
and al, 4
nop
mov eax, dword [0x141dd9320]
xor eax, dword [0x141dd9324]
imul rcx, rax, 0x2d214f13
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
add eax, 0xae60f88d
and eax, 0x2e609010
movzx ecx, byte [rdi + 2]
mov byte [r12 + 3], cl
movzx ecx, word [rdi]
mov word [r12 + 1], cx
movups xmm0, xmmword [rsi]
movups xmmword [r12 + 0x10], xmm0
mov byte [r12], 0
mov dword [r12 + 4], ebx
cmp eax, 0xad6f5ec7
je 0x1400df050
jmp 0x1400df6b0
mov eax, dword [0x141dd92f8]
or eax, dword [0x141dd92fc]
mov ecx, 0xa563f833
imul rcx, rax
shr rcx, 0x3e
or ecx, 0x8936318d
imul r14, rcx, 0x5c9740ad
shr r14, 0x3d
sub rsp, 0x50
mov qword [rsp + 0x40], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r13
xor r8d, r8d
xor r9d, r9d
call rbx
add rsp, 0x50
cmp r14d, 0xf906b8ba
jne 0x1400df14b
sub rsp, 0x50
mov qword [rsp + 0x40], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r13
xor r8d, r8d
xor r9d, r9d
call rbx
add rsp, 0x50
jmp 0x1400df0ab
mov edi, eax
test eax, eax
js 0x1400df2b6
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400df160
mov r14, qword [rsi]
nop word [rax + rax]
mov eax, dword [0x141dd9300]
xor edx, edx
div dword [0x141dd9304]
xor eax, 0x4e96a99d
add eax, 0x8a337396
or eax, 0x861de219
cmp eax, 0x4a600b85
jb 0x1400df170
test r14, r14
je 0x1400df290
nop dword [rax]
mov eax, dword [0x141dd9328]
and eax, dword [0x141dd932c]
xor eax, 0x561b2060
imul eax, eax, 0xa4cb78c6
cmp eax, 0x515a4143
je 0x1400df1a0
mov rbx, r15
test r13, r13
je 0x1400df1d7
sub rsp, 0x20
mov rcx, r13
call qword [sym.imp.oleaut32.dll_SysFreeString]
add rsp, 0x20
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
add rsp, 0x40
mov r15d, eax
xor eax, eax
mov r13, qword [rbp - 0x30]
nop dword [rax]
test al, al
jne 0x1400df220
nop word cs:[rax + rax]
mov eax, dword [0x141dd9330]
and eax, dword [0x141dd9334]
movabs al, byte [0xa5a44dbec06901cf]
add eax, 0xa49a19b2
and eax, 0xba2c369c
cmp eax, 0xa0065831
ja 0x1400df230
test r15d, r15d
js 0x1400df360
invalid
mov eax, dword [0x141dd9378]
imul eax, dword [0x141dd937c]
add eax, 0x3b275c3a
xor eax, 0xfbbff750
imul rax, rax, 0x3bb477db
shr rax, 0x3d
cmp eax, 0x4f2acbd3
jbe 0x1400df608
jmp 0x1400df644
mov eax, dword [0x141dd9308]
or eax, dword [0x141dd930c]
xor eax, 0x80020004
or eax, 0x649d4071
and eax, 0xe49fc0f5
cmp eax, 0x6e12d0ad
ja 0x1400df290
xor edi, edi
jmp 0x1400df30c
mov rsi, qword [rbp - 0x28]
mov qword [rsi], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rsi
bnd call qword [sym.imp.oleaut32.dll_GetErrorInfo]
xor eax, eax
test al, al
je 0x1400df381
mov qword [r13], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
mov rsi, qword [sym.imp.oleaut32.dll_GetErrorInfo]
nop dword [rax + rax]
mov edi, dword [0x141dd9338]
imul edi, dword [0x141dd933c]
xor edi, 0x8564d583
mov qword [r13], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r13
call rsi
add rsp, 0x20
cmp edi, 0x70448016
jb 0x1400df390
mov rcx, qword [r13]
nop word cs:[rax + rax]
mov eax, dword [0x141dd9340]
or eax, dword [0x141dd9344]
imul eax, eax, 0x3acc5efb
and eax, 0x71a057b3
cmp eax, 0xad313f5e
je 0x1400df3d0
test rcx, rcx
je 0x1400df453
nop word cs:[rax + rax]
mov eax, dword [0x141dd9348]
sub eax, dword [0x141dd934c]
cmp eax, 0x28010349
je 0x1400df400
mov rax, qword [rcx]
sub rsp, 0x20
call qword [rax + 0x10]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd9350]
add eax, dword [0x141dd9354]
imul eax, eax, 0x83fb6832
or eax, 0x113620
and eax, 0x11553ea0
cmp eax, 0xb25aca74
jae 0x1400df430
mov byte [r12], 0
mov dword [r12 + 4], r15d
mov eax, dword [0x141dd9380]
or eax, dword [0x141dd9384]
imul rcx, rax, 0x60c3ce9b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0xdd024252
or eax, 0xa5eadd19
mov qword [r12 + 8], r14
mov byte [r12], 0x12
cmp eax, 0xca19e268
jae 0x1400df650
mov qword [r12 + 8], r14
mov byte [r12], 0x12
jmp 0x1400df608
mov rsi, qword [rbx]
xor eax, eax
test al, al
jne 0x1400df69b