Function at 0x1400a5ca0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
movaps xmmword [rsp + 0x140], xmm6
mov rax, qword [0x1401b66f8]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r15, r8
mov r13, rdx
mov rsi, rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], r8
xor r12d, r12d
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rbx, [r12 - 1]
test eax, eax
jns 0x1400a5d65
mov eax, dword [str.ayz7]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140198120]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor al, 0x37
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a5d47
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001fd20
jmp 0x1400a66ed
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x1400a5dfe
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.ayz7]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140198120]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor al, 0x37
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a5de0
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001fd20
jmp 0x1400a66ed
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x1401649a0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1401649b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400a5e8e
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.ayz7]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140198120]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor al, 0x37
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a5e70
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001fd20
jmp 0x1400a66ed
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x18]
movups xmm0, xmmword [str.azbkpwm]
movups xmmword [rsp + 0x60], xmm0
mov ecx, dword [0x140198648]
mov dword [rsp + 0x70], ecx
movzx eax, word [0x14019864c]
mov edx, 0x52
mov word [rsp + 0x60], dx
xor word [rsp + 0x62], 0x34
xor word [rsp + 0x64], 0x35
xor word [rsp + 0x66], 0x36
xor word [rsp + 0x68], 0x37
xor word [rsp + 0x6a], 0x38
xor word [rsp + 0x6c], 0x39
xor word [rsp + 0x6e], 0x3a
xor cx, 0x3b
mov word [rsp + 0x70], cx
xor word [rsp + 0x72], 0x3c
xor ax, 0x3d
mov word [rsp + 0x74], ax
lea ecx, [rdx - 0x3a]
call fcn.14012e6c4
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400a5f47
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1400a6736
jmp 0x1400a5f4a
mov rdi, r12
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x1400a6757
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x50]
call r14
mov r14d, eax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1400a5fc4
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400a5fa5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400a5fb7
call fcn.14012e950
mov qword [rdi + 8], r12
mov edx, Ordinal_26
mov rcx, rdi
call fcn.14012e950
test r14d, r14d
jns 0x1400a6035
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.ayz7]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140198120]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor al, 0x37
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a6017
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001fd20
jmp 0x1400a66ed
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x1400a60de
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.ayz7]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140198120]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor al, 0x37
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a60c0
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001fd20
jmp 0x1400a66ed
mov qword [rbp - 0x48], r12
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0xa0]
mov qword [rsp + 0x78], rax
mov r14, r13
cmp qword [r13 + 0x18], 0x10
jb 0x1400a6103
mov r14, qword [r13]
mov ecx, Ordinal_26
call fcn.14012e6c4
mov rdi, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x1400a613d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
mov rcx, r14
call fcn.14012e290
mov qword [rdi], rax
jmp 0x1400a6140
mov rdi, r12
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x1400a6762
mov r12, qword [rdi]
mov eax, dword [str.dey6]
mov dword [rsp + 0x58], eax
cmp byte [0x140198473], 0
je 0x1400a6240
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400a6202
movdqa xmm3, xmmword [0x140198b10]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140198d60]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140198d60]
shufps xmm2, xmm0, 0xdd
mov ecx, 4
movd xmm0, ecx
psrad xmm2, xmm0
mov ecx, Ordinal_33
movd xmm0, ecx
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x140198b80]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140198ce0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140198d20]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x58], xmm2
jmp 0x1400a6240
lea r9, [rsp + 0x58]
xor r8d, r8d
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400a6210
mov ecx, Ordinal_26
call fcn.14012e6c4
mov r14, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400a627e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rax
mov qword [r14 + 8], rax
mov dword [r14 + 0x10], 1
lea rcx, [rsp + 0x58]
call fcn.14012e290
mov qword [r14], rax
jmp 0x1400a6281
xor r14d, r14d
mov qword [rbp - 0x70], r14
test r14, r14
je 0x1400a676d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, Ordinal_50
mov r8, r12
mov rdx, qword [r14]
mov rcx, qword [rbp - 0x58]
call qword [rsp + 0x78]
mov r12d, eax
mov ecx, ebx
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x1400a62fd
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a62d9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400a62ef
call fcn.14012e950
mov qword [r14 + 8], 0
mov edx, Ordinal_26
mov rcx, r14
call fcn.14012e950
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400a6341
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400a631e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400a6334
call fcn.14012e950
mov qword [rdi + 8], 0
mov edx, Ordinal_26
mov rcx, rdi
call fcn.14012e950
test r12d, r12d
jns 0x1400a63be
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.ayz7]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140198120]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor al, 0x37
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a63a0
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001fd20
jmp 0x1400a66ed
xor r8d, r8d
mov qword [rbp - 0x40], r8
mov dword [rbp - 0x10], r8d
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movdqa xmm6, xmmword [0x140198ad0]
movdqu xmmword [rbp + 0x28], xmm6
mov byte [rbp + 0x18], r8b
cmp qword [r15 + 0x18], 0x10
jb 0x1400a63f4
mov r12, qword [r15]
mov r14, r12
add r12, qword [r15 + 0x10]
jmp 0x1400a63fe
mov r12, qword [r15 + 0x10]
add r12, r15
mov r14, r15
movups xmmword [rbp - 8], xmm0
mov edi, 7
mov qword [rbp + 0x10], rdi
cmp r14, r12
jne 0x1400a6421
xor r12d, r12d
mov qword [rbp + 8], r12
mov word [rbp - 8], r12w
jmp 0x1400a6534
mov rax, r12
sub rax, r14
mov rdx, r8
mov qword [rbp + 8], rdx
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x1400a6778
cmp rax, 8
jb 0x1400a64f0
mov rdi, rax
or rdi, 7
cmp rdi, rcx
jbe 0x1400a645c
mov rdi, rcx
jmp 0x1400a6469
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
mov rax, rdi
add rax, 1
cmovb rax, rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x1400a6730
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x1400a64ca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400a6730
mov rcx, rax
call fcn.14012e6c4
mov rcx, rax
test rax, rax
je 0x1400a64c3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rbp + 8]
jmp 0x1400a64dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400a64da
call fcn.14012e6c4
mov rdx, qword [rbp + 8]
jmp 0x1400a64dd
mov rax, r8
mov qword [rbp - 8], rax
mov qword [rbp + 0x10], rdi
nop word [rax + rax]
lea rcx, [rbp - 8]
cmp rdi, 8
cmovae rcx, qword [rbp - 8]
movsx eax, byte [r14]
mov word [rcx + rdx*2], ax
mov rdx, qword [rbp + 8]
inc rdx
mov qword [rbp + 8], rdx
inc r14
cmp r14, r12
je 0x1400a651e
mov rdi, qword [rbp + 0x10]
jmp 0x1400a64f0
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rax, qword [rbp - 8]
xor r12d, r12d
mov word [rax + rdx*2], r12w
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400a6699
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
mov r8d, 1
mov edx, ebx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 0x10], 0
je 0x1400a6694
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x28]
xor r8d, r8d
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x1400a667d
mov r14, qword [rbp - 0x20]
mov ecx, Ordinal_26
call fcn.14012e6c4
mov rdi, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1400a65f3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x1400a65f6
test r14, r14
jne 0x1400a6741
jmp 0x1400a65f6
mov rdi, r12
mov qword [rbp - 0x60], rdi
test rdi, rdi
je 0x1400a674c
mov rax, qword [rdi + 8]
test rax, rax
jne 0x1400a6618
mov rcx, qword [rdi]
call fcn.14012e170
mov qword [rdi + 8], rax
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400a6620
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.14001d4f0
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400a6673
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400a6654
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400a6666
call fcn.14012e950
mov qword [rdi + 8], r12
mov edx, Ordinal_26
mov rcx, rdi
call fcn.14012e950
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x1400a6550
movdqu xmm6, xmmword [rbp + 0x28]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm6
movdqa xmm0, xmmword [0x140198ad0]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
lea rcx, [rbp - 8]
call fcn.1400a7440
nop
lea rcx, [rbp + 0x18]
call fcn.14000c460
nop
mov rcx, r13
call fcn.14000c460
nop
mov rcx, r15
call fcn.14000c460
mov rax, rsi
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.14012e5c0
mov rbx, qword [rsp + 0x1a8]
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000bc60
nop
mov ecx, 0x8007000e
call fcn.14012e160
nop
mov ecx, 0x8007000e
call fcn.14012e160
nop
mov ecx, 0x8007000e
call fcn.14012e160
nop
mov ecx, 0x8007000e
call fcn.14012e160
int3
mov ecx, 0x8007000e
call fcn.14012e160
nop
mov ecx, 0x8007000e
call fcn.14012e160
nop
call fcn.14000c5b0
int3