Function at 0x140008520
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x1400781b0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13, rdx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor ebx, ebx
test eax, eax
jns 0x140008595
mov dword [rsp + 0x50], 0x4d4c6a70
mov word [rsp + 0x54], 0x100
nop
lea eax, [rbx + 0x1e]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x140008570
mov byte [rsp + 0x55], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
jmp 0x140008cb7
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov r14, 0xffffffffffffffff
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rbp - 0x41], rbx
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
lea r9, [0x14005a328]
xor edx, edx
lea r8d, [r14 + 2]
lea rcx, [0x14005a318]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140008635
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x50], 0x4d4c6a70
mov word [rsp + 0x54], 0x100
nop word [rax + rax]
lea eax, [rbx + 0x1e]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x140008610
mov byte [rsp + 0x55], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
jmp 0x140008cb7
mov qword [rbp - 0x49], rbx
mov rax, qword [rbp - 0x41]
mov rcx, qword [rax]
mov r15, qword [rcx + 0x18]
mov ecx, 0x18
call fcn.14004de90
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000868d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x140008ce9
jmp 0x140008690
mov rdi, rbx
mov qword [rsp + 0x58], rdi
test rdi, rdi
je 0x140008cff
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x41]
call r15
mov r15d, eax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14000870a
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400086eb
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400086fd
call fcn.14004dbe0
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.14004dbe0
test r15d, r15d
jns 0x140008755
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x50], 0x4d4c6a70
mov word [rsp + 0x54], 0x100
nop
lea eax, [rbx + 0x1e]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x140008730
mov byte [rsp + 0x55], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
jmp 0x140008cb7
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x1400087d5
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x50], 0x4d4c6a70
mov word [rsp + 0x54], 0x100
nop
lea eax, [rbx + 0x1e]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x1400087b0
mov byte [rsp + 0x55], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
jmp 0x140008cb7
mov qword [rbp - 9], rbx
mov qword [rbp + 7], rbx
mov qword [rbp + send], 0xf
mov byte [rbp - 9], 0
mov r8d, send
lea rdx, str.SELECT__FROM
lea rcx, [rbp - 9]
call fcn.14001f770
nop
mov r8, r14
inc r8
cmp byte [rsi + r8], 0
jne 0x140008803
mov rdx, rsi
lea rcx, [rbp - 9]
call fcn.14001f8d0
mov qword [rbp - 0x31], rbx
mov rax, qword [rbp - 0x49]
mov rcx, qword [rax]
mov r12, qword [rcx + 0xa0]
lea rdi, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rdi, qword [rbp - 9]
mov ecx, 0x18
call fcn.14004de90
mov rsi, rax
mov qword [rbp - 0x79], rax
test rax, rax
je 0x140008873
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rbx
mov dword [rsi + 0x10], 1
mov rcx, rdi
call fcn.140035f00
mov qword [rsi], rax
jmp 0x140008876
mov rsi, rbx
mov qword [rbp - 0x69], rsi
test rsi, rsi
je 0x140008d0a
mov r15, qword [rsi]
mov ecx, 0x18
call fcn.14004de90
mov rdi, rax
mov qword [rbp - 0x79], rax
test rax, rax
je 0x1400088c4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], 1
lea rcx, [0x14005a750]
call fcn.140035f00
mov qword [rdi], rax
jmp 0x1400088c7
mov rdi, rbx
mov qword [rbp - 0x61], rdi
test rdi, rdi
je 0x140008d15
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, 0x30
mov r8, r15
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x49]
call r12
mov r15d, eax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x140008936
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008916
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140008928
call fcn.14004dbe0
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.14004dbe0
nop
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x140008973
mov rcx, qword [rsi]
test rcx, rcx
je 0x140008954
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], rbx
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140008966
call fcn.14004dbe0
mov qword [rsi + 8], rbx
mov edx, 0x18
mov rcx, rsi
call fcn.14004dbe0
test r15d, r15d
jns 0x1400089cf
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x50], 0x4d4c6a70
mov word [rsp + 0x54], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x1e]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x1400089b0
mov byte [rsp + 0x55], 0
lea rcx, [rsp + 0x50]
jmp 0x140008b59
mov qword [rbp - 0x39], rbx
mov dword [rbp - 0x11], ebx
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140008af9
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x39]
mov r8d, 1
mov edx, r14d
call qword [rax + 0x20]
cmp dword [rbp - 0x11], 0
je 0x140008af9
test eax, eax
js 0x140008af9
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x20]
mov ecx, 0x18
call fcn.14004de90
mov rdi, rax
mov qword [rbp - 0x71], rax
test rax, rax
je 0x140008a63
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], 1
mov rcx, r13
call fcn.140035f00
mov qword [rdi], rax
jmp 0x140008a66
mov rdi, rbx
mov qword [rbp - 0x59], rdi
test rdi, rdi
je 0x140008cde
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x29]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x39]
call rsi
mov esi, eax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x140008acc
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008aad
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140008abf
call fcn.14004dbe0
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.14004dbe0
test esi, esi
jns 0x140008ba7
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbp - 0x39], rbx
mov rcx, qword [rbp - 0x31]
test rcx, rcx
jne 0x1400089f0
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140008b26
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x58], 0x4d4c6a70
mov word [rbp - 0x7d], 0x100
nop word [rax + rax]
lea eax, [rbx + 0x1e]
xor byte [rsp + rbx + 0x58], al
inc rbx
cmp rbx, 4
jb 0x140008b40
mov byte [rbp - 0x7c], 0
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rsi, rax
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140008cb4
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008caf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008caf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp word [rbp - 0x29], 2
jb 0x140008c75
mov rsi, qword [rbp - 0x21]
mov ecx, 0x18
call fcn.14004de90
mov rdi, rax
mov qword [rbp - 0x71], rax
test rax, rax
je 0x140008bff
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140008c02
test rsi, rsi
jne 0x140008cf4
jmp 0x140008c02
mov rdi, rbx
mov qword [rbp - 0x51], rdi
test rdi, rdi
je 0x140008cde
mov rax, qword [rdi + 8]
test rax, rax
jne 0x140008c24
mov rcx, qword [rdi]
call fcn.140035de0
mov qword [rdi + 8], rax
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rsi, rax
lock xadd dword [rdi + 0x10], r14d
cmp r14d, 1
jne 0x140008b62
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008c51
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140008c63
call fcn.14004dbe0
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.14004dbe0
jmp 0x140008b62
mov dword [rsp + 0x50], 0x4d4c6a70
mov word [rsp + 0x54], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x1e]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x140008c90
mov byte [rsp + 0x55], 0
lea rcx, [rsp + 0x50]
jmp 0x140008b59
call fcn.14004dbe0
mov rax, rsi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14004dbc0
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140035dd0
nop
mov ecx, 0x8007000e
call fcn.140035dd0
nop
mov ecx, 0x8007000e
call fcn.140035dd0
nop
mov ecx, 0x8007000e
call fcn.140035dd0
nop
mov ecx, 0x8007000e
call fcn.140035dd0
nop
mov ecx, 0x8007000e
call fcn.140035dd0
int3