Function at 0x7ff65ed3ed80
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x160
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x128], rax
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x50], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x7ff65ed3edd7
xor eax, eax
jmp 0x7ff65ed3f3ba
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x7ff65ed3ee16
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x7ff65ed3f3ba
mov qword [rsp + 0x60], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff65f09d480]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x7ff65f09d470]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x7ff65ed3ee50
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x7ff65ed3f3ba
mov qword [rsp + 0x58], r14
mov ecx, 0x18
call fcn.7ff65efe06d0
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x7ff65ed3ee95
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x7ff65f151330]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x7ff65ed3f3f3
jmp 0x7ff65ed3ee98
mov rbx, r14
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x7ff65ed3f3fe
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x7ff65ed3ef19
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3eefa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3ef0c
call fcn.7ff65efe070c
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
test edi, edi
jns 0x7ff65ed3ef35
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x7ff65ed3f3ba
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x7ff65ed3ef8b
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x7ff65ed3f3ba
mov qword [rsp + 0x78], r14
movdqa xmm6, xmmword [0x7ff65f153cb0]
movdqu xmmword [rsp + 0xf0], xmm6
movdqa xmm7, xmmword [0x7ff65f153d70]
movdqu xmmword [rsp + 0x100], xmm7
movdqa xmm8, xmmword [0x7ff65f153d30]
movdqu xmmword [rsp + 0x110], xmm8
mov word [rsp + 0x120], 0xc4b
mov byte [rsp + 0x122], 0x2e
mov edx, 0x14
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x7ff65f42f84c], eax
jg 0x7ff65ed3f408
lea rdx, [0x7ff65f42f730]
cmp byte [0x7ff65f42f762], 0
je 0x7ff65ed3f04d
mov rax, r14
movdqa xmm2, xmmword [0x7ff65f153b30]
movdqu xmm0, xmmword [rax + rdx]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + rdx], xmm1
add rax, 0x10
cmp rax, 0x30
jb 0x7ff65ed3f012
cmp rax, 0x33
jae 0x7ff65ed3f04d
nop dword [rax]
nop dword [rax + rax]
xor byte [rax + rdx], 0x2e
inc rax
cmp rax, 0x33
jb 0x7ff65ed3f040
lea rcx, [rsp + 0x88]
call fcn.7ff65ed3c920
mov rdi, rax
mov ecx, 0x18
call fcn.7ff65efe06d0
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x7ff65ed3f090
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x7ff65f15132c]
call fcn.7ff65efe1870
mov qword [rbx], rax
jmp 0x7ff65ed3f093
mov rbx, r14
mov qword [rsp + 0x90], rbx
test rbx, rbx
je 0x7ff65ed3f46a
mov rax, qword [rdi]
test rax, rax
je 0x7ff65ed3f0b1
mov r8, qword [rax]
jmp 0x7ff65ed3f0b4
mov r8, r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
mov r9d, 0x30
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x7ff65ed3f11c
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3f0fc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3f10e
call fcn.7ff65efe070c
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
nop
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x7ff65ed3f16d
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x7ff65ed3f16d
test rbx, rbx
je 0x7ff65ed3f16d
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3f14e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3f160
call fcn.7ff65efe070c
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
test edi, edi
jns 0x7ff65ed3f194
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x7ff65ed3f3ba
mov qword [rsp + 0x80], r14
mov ebx, r14d
mov dword [rsp + 0x50], r14d
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x7ff65ed3f37f
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x80]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rsp + 0x50], 0
je 0x7ff65ed3f37f
mov qword [rsp + 0x68], r14
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.ReadOperationCount
call qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov edx, eax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VarUI8FromDisp]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xd0]
call fcn.7ff65ecba9f0
nop
mov r8, qword [rsp + 0xe0]
cmp r8, 4
lea rcx, [r8 - 4]
ja 0x7ff65ed3f25f
mov rcx, r14
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
cmp r8, rcx
jb 0x7ff65ed3f475
mov rax, r8
sub rax, rcx
cmp rax, r8
cmovb r8, rax
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdx, qword [rsp + 0xd0]
add rdx, rcx
lea rcx, [rsp + 0xb0]
call fcn.7ff65ec85ad0
or esi, 1
lea rcx, [rsp + 0xb0]
call fcn.7ff65ed2d5d0
cdqe
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x7ff65ed3f322
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3f318
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3f47a
call fcn.7ff65efe070c
mov rax, qword [rsp + 0x68]
add ebx, eax
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x7ff65ed3f1b0
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3f375
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3f480
call fcn.7ff65efe070c
jmp 0x7ff65ed3f1b0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
jmp 0x7ff65ed3f3ba
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.7ff65efe06b0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r14
ret
mov ecx, 0x8007000e
call fcn.7ff65efe1860
nop
mov ecx, 0x8007000e
call fcn.7ff65efe1860
lea rcx, [0x7ff65f42f84c]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f84c], 0xffffffff
jne 0x7ff65ed3eff7
movaps xmmword [0x7ff65f42f730], xmm6
movaps xmmword [0x7ff65f42f740], xmm7
movaps xmmword [0x7ff65f42f750], xmm8
movzx eax, word [rsp + 0x120]
mov word [0x7ff65f42f760], ax
mov byte [0x7ff65f42f762], 0x2e
lea rcx, [0x7ff65f019e50]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f84c]
call fcn.7ff65efe0868
jmp 0x7ff65ed3eff7
mov ecx, 0x8007000e
call fcn.7ff65efe1860
nop
call fcn.7ff65ec987b0
call fcn.7ff65efe777c
nop
call fcn.7ff65efe777c
int3