Function at 0x1400e4340
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], rdx
mov rsi, rcx
mov eax, dword [0x141f46f00]
imul eax, dword [0x141f46f04]
and eax, 0x420c2204
or eax, 0x9542dd79
imul eax, eax, 0xb37ba45a
cmp eax, 0x32ca57e2
jb 0x1400e43d6
mov eax, dword [0x141f46f08]
imul eax, dword [0x141f46f0c]
mov ecx, 0xd5067ac7
imul rcx, rax
shr rcx, 0x3f
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
cmp ecx, 0x99807679
jne 0x1400e43ff
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
jmp 0x1400e4384
mov eax, dword [0x141f46f10]
sub eax, dword [0x141f46f14]
xor eax, 0x87ac8e5
imul eax, eax, 0xae595117
add eax, 0x67210e57
cmp eax, 0xaf8bcd2
jae 0x1400e4430
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
invalid
nop
mov eax, dword [0x141f46f18]
add eax, dword [0x141f46f1c]
xor eax, 0x314714
and eax, 0xa1b16736
imul ecx, eax, 0x60470d58
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r12, rsp
cmp ecx, 0x5802dc27
je 0x1400e4430
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x18], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x10], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp], rsp
mov qword [r15], 0
sub rsp, 0x30
mov qword [rsp + 0x20], r15
lea rcx, [0x141f26044]
lea r9, [0x141f26028]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
test eax, eax
js 0x1400e47e2
mov ecx, 0xbfd0bae5
nop word cs:[rax + rax]
mov eax, dword [0x141f46f20]
xor edx, edx
div dword [0x141f46f24]
add eax, 0x220a38c1
imul rax, rcx
shr rax, 0x3d
cmp eax, 0x33f40f68
ja 0x1400e4500
mov rdi, qword [r15]
nop word cs:[rax + rax]
mov eax, dword [0x141f46f28]
or eax, dword [0x141f46f2c]
add eax, 0x11ecd80a
xor eax, 0x455fb09a
cmp eax, 0x9f9ded3f
ja 0x1400e4530
test rdi, rdi
je 0x1400e4720
sub rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
call fcn.1400e2c10
add rsp, 0x20
mov r15, rax
mov qword [r12], 0
mov rax, qword [rdi]
nop dword [rax]
mov ecx, dword [0x141f46f78]
add ecx, dword [0x141f46f7c]
and ecx, 0x4194c68c
add ecx, 0x6ed6d779
and ecx, 0xeed2da88
cmp ecx, 0x7f9d7fea
popfq
jg 0x1400e461c
invalid
mov rax, qword [rax + 0x18]
sub rsp, 0x50
mov qword [rsp + 0x40], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call rax
add rsp, 0x50
test eax, eax
js 0x1400e4818
nop word cs:[rax + rax]
mov eax, dword [0x141f46f80]
and eax, dword [0x141f46f84]
cmp eax, 0x836082d0
je 0x1400e45f0
mov r14, qword [r12]
test r14, r14
je 0x1400e47b0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400e4620
nop word cs:[rax + rax]
mov eax, dword [0x141f46fb0]
sub eax, dword [0x141f46fb4]
and eax, 0x1a410488
imul eax, eax, 0x1869ecfa
or eax, 0xc19fa5b1
cmp eax, 0xf4fda029
ja 0x1400e4630
test r15, r15
je 0x1400e4669
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.oleaut32.dll_SysFreeString]
add rsp, 0x20
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
add rsp, 0x40
mov r15d, eax
nop dword [rax]
mov eax, dword [0x141f46fb8]
xor edx, edx
div dword [0x141f46fbc]
xor eax, 0x1000000
or eax, 0xe8625e28
and eax, 0xe9e37f2d
cmp eax, 0xcac59d95
jb 0x1400e46b0
test r15d, r15d
js 0x1400e49ea
mov eax, dword [0x141f46ff8]
and eax, dword [str.u_fs]
and eax, 0x3055c424
xor eax, 0x80119020
cmp eax, 0xbf1d0be6
jbe 0x1400e4701
mov qword [rsi + 8], r14
mov byte [rsi], 0x12
xor eax, eax
nop word cs:[rax + rax]
mov qword [rsi + 8], r14
mov byte [rsi], 0x12
test al, al
jne 0x1400e4710
jmp 0x1400e49d7
mov eax, dword [0x141f46f30]
and eax, dword [0x141f46f34]
add eax, 0xf5c2f579
cmp eax, 0x265a3f24
ja 0x1400e4720
mov eax, 0xad30f8b3
mov r8, qword [rbp - 8]
mov r9, qword [rbp]
nop word cs:[rax + rax]
mov ecx, dword [0x141f46f38]
add ecx, dword [0x141f46f3c]
imul rdx, rcx, 0x10696313
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1d
add ecx, 0xe4abed69
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xb7b6b9b1
ja 0x1400e4750
nop word cs:[rax + rax]
mov eax, dword [str.2V_]
add eax, dword [0x141f46f44]
and eax, 0x397ce92
cmp eax, 0xea556569
je 0x1400e4790
xor r13d, r13d
jmp 0x1400e4a3e
mov eax, dword [0x141f46f88]
and eax, dword [0x141f46f8c]
or eax, 0x6a4bb67d
xor eax, 0xae72b989
add eax, 0xd1da46b5
fcmovbe st(0), st(1)
cmp eax, 0x64ad2616
ja 0x1400e47b0
xor r13d, r13d
mov rbx, qword [rbp - 0x18]
mov r14, qword [rbp - 0x10]
jmp 0x1400e491d
mov r13d, eax
mov eax, dword [0x141f46f48]
xor edx, edx
div dword [0x141f46f4c]
add eax, 0xf45fd269
and eax, 0x446e7d8a
imul rax, rax, 0x660703f5
shr rax, 0x3b
cmp eax, 0x836e3dd1
jbe 0x1400e4a8f
jmp 0x1400e4ab9
mov r13d, eax
xor eax, eax
test al, al
je 0x1400e483b
mov qword [r14], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
mov rbx, qword [sym.imp.oleaut32.dll_GetErrorInfo]
nop word cs:[rax + rax]
mov eax, dword [0x141f46f90]
sub eax, dword [0x141f46f94]
or eax, 0xbf5751f
imul r12d, eax, 0x609adb79
mov qword [r14], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r14
call rbx
add rsp, 0x20
cmp r12d, 0x39d2fb7d
je 0x1400e4850
mov rcx, qword [r14]
mov rbx, qword [rbp - 0x18]
mov r14, qword [rbp - 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141f46f98]
sub eax, dword [0x141f46f9c]
or eax, 0x94802800
xor eax, 0x41004060
and eax, 0xd5a06860
cmp eax, 0xc0752d66
jb 0x1400e48a0
test rcx, rcx
je 0x1400e491d
nop word [rax + rax]
mov eax, dword [0x141f46fa0]
sub eax, dword [0x141f46fa4]
or eax, 0xed7f961e
add eax, 0x70f86e16
xor eax, 0xb63f24ea
cmp eax, 0xeabc8418
ja 0x1400e48d0
mov rax, qword [rcx]
sub rsp, 0x20
call qword [rax + 0x10]
add rsp, 0x20
mov eax, dword [0x141f46fa8]
or eax, dword [0x141f46fac]
or eax, 0x18401020
and eax, 0x1848902b
cmp eax, 0x28581c65
jae 0x1400e4900
movzx eax, byte [rbx + 2]
mov byte [rsi + 3], al
movzx eax, word [rbx]
mov word [rsi + 1], ax
movups xmm0, xmmword [r14]
movups xmmword [rsi + 0x10], xmm0
test r15, r15
je 0x1400e4949
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.oleaut32.dll_SysFreeString]
add rsp, 0x20
mov eax, dword [0x141f46fe0]
xor eax, dword [0x141f46fe4]
xor eax, 0x496171d7
imul rax, rax, 0x5b558aa5
shr rax, 0x3e
add eax, 0xcdca7f87
cmp eax, 0x187d9198
jae 0x1400e4980
mov byte [rsi], 0
nop word cs:[rax + rax]
mov eax, dword [0x141f46fe8]
xor edx, edx
div dword [0x141f46fec]
imul eax, eax, 0x4ef15582
add eax, 0xbf67c27c
mov byte [rsi], 0
cmp eax, 0x39c9721f
ja 0x1400e4980
nop word cs:[rax + rax]
mov eax, dword [0x141f46ff0]
xor eax, dword [0x141f46ff4]
imul rax, rax, 0x5083f72b
shr rax, 0x3e
add eax, 0xe67a38dd
cmp eax, 0x73b21149
jb 0x1400e49b0
mov dword [rsi + 4], r13d
mov rax, qword [rdi]
sub rsp, 0x20
mov rcx, rdi
call qword [rax + 0x10]
add rsp, 0x20
jmp 0x1400e4a60
mov eax, 0xf16fafb7
nop
mov ecx, dword [0x141f46fc0]
and ecx, dword [0x141f46fc4]
xor ecx, 0x1abaa708
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xea003c87
ja 0x1400e49f0
mov eax, dword [0x141f46fc8]
add eax, dword [str._O]
imul eax, eax, 0xc0e50a11
add eax, 0xb6a254ee
or eax, 0xa5f8af62
cmp eax, 0x6a52c4b3
jne 0x1400e4bad
jmp 0x1400e4bec
movzx eax, byte [r8 + 2]
mov byte [rsi + 3], al
movzx eax, word [r8]
mov word [rsi + 1], ax
movups xmm0, xmmword [r9]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
mov dword [rsi + 4], r13d
nop dword [rax]
mov eax, dword [0x141f47010]
and eax, dword [0x141f47014]
imul eax, eax, 0xfe6d2c7d
and eax, 0xc43cf2de
cmp eax, 0x1ca90033
je 0x1400e4a60
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141f46f50]
and eax, dword [0x141f46f54]
and eax, 0xad8bc7cb
imul eax, eax, 0xe03e4725
add eax, 0xac0f65a6
mov qword [rdi], 0
cmp eax, 0xa8288102
jbe 0x1400e4ac2
mov qword [rdi], 0
jmp 0x1400e4a8f
sub rsp, 0x20
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
mov rdi, qword [rdi]
nop dword [rax + rax]
mov eax, dword [0x141f46f58]
imul eax, dword [0x141f46f5c]
imul eax, eax, 0x2458587e
and eax, 0x58c66278
cmp eax, 0xf46d8521
je 0x1400e4ae0
test rdi, rdi
je 0x1400e4b59
nop word cs:[rax + rax]
mov eax, dword [0x141f46f60]
xor eax, dword [0x141f46f64]
xor eax, 0x25008088
and eax, 0x650ccaee
cmp eax, 0xbd214b9f
ja 0x1400e4b10
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov eax, dword [0x141f46f68]
xor eax, dword [0x141f46f6c]
imul eax, eax, 0xf9eaaeb2
add eax, 0x3d08480c
xor eax, 0x8636c389
ret
xchg byte ss:[0xd1d57fd2], bh
jae 0x1400e4b66
jmp 0x1400e4b9e
mov r8, qword [rbp - 8]
mov r9, qword [rbp]
jmp 0x1400e4a3e
mov eax, dword [0x141f46f70]
imul eax, dword [0x141f46f74]
imul r14d, eax, 0x99ea87b1
add r14d, 0x5e2560ce
or r14d, 0x786325a0
sub rsp, 0x20
mov rcx, rdi
call rbx
add rsp, 0x20
cmp r14d, 0x784f781d
ja 0x1400e4b59
sub rsp, 0x20
mov rcx, rdi
call rbx
add rsp, 0x20
jmp 0x1400e4b66
mov r12d, dword [0x141f46fd0]
or r12d, dword [0x141f46fd4]
xor r12d, 0xaf557182
add r12d, 0x7345ecac
mov qword [rbx], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
cmp r12d, 0x7655da76
jae 0x1400e4c10
mov qword [rbx], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
jmp 0x1400e4bad
mov eax, dword [0x141f46fd8]
xor edx, edx
div dword [0x141f46fdc]
and eax, 0x80400020
cmp eax, 0x557325cc
ja 0x1400e4c10
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e4c40
mov rax, qword [rcx]
sub rsp, 0x20
call qword [rax + 0x10]
add rsp, 0x20
mov eax, dword [0x141f47000]
xor eax, dword [0x141f47004]
imul eax, eax, 0x6562d1a5
cmp eax, 0xae6ef883
jne 0x1400e4c60
mov byte [rsi], 0
nop dword [rax]
mov eax, dword [0x141f47008]
xor eax, dword [0x141f4700c]
add eax, 0xd21e9cfe
xor eax, 0xffc63863
mov byte [rsi], 0
cmp eax, 0xe1e4859f
lahf
test esp, esp
loope 0x1400e4cf6
invalid
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400e4c90
mov dword [rsi + 4], r15d
mov rax, qword [r14]
sub rsp, 0x20
mov rcx, r14
call qword [rax + 0x10]
add rsp, 0x20
jmp 0x1400e49d7