Function at 0x140002820
Capabilities:
Access peb ldr_data
Connect to wmi namespace via wbemlocator
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xa0], xmm6
mov qword [rbp + 0x90], 0xfffffffffffffffe
mov qword [rbp + 0x40], r9
mov qword [rbp + 0x38], r8
mov rsi, rdx
mov qword [rbp + 0x70], 0
movaps xmm6, xmmword [0x1400d6010]
movups xmmword [rbp + 0x80], xmm6
mov word [rbp + 0x70], 0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
mov qword [rbp + 0x60], rsi
js 0x140002b84
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x140002b7e
mov qword [rbp + 0x50], 0
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400e4400]
lea r9, [0x1400e43f0]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140002b7e
mov qword [rbp + 0x58], 0
mov rsi, qword [rbp + 0x50]
movaps xmm0, xmmword [0x1400d6140]
movaps xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x320056
mov word [rbp + 0x14], 0
mov ecx, 0x18
call fcn.14009fdc4
mov rdi, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x140002f54
mov qword [rbp - 0x18], rdi
mov rcx, qword [rsi]
mov rbx, qword [rcx + 0x18]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call rbx
mov esi, eax
lock sub dword [rdi + 0x10], 1
jne 0x1400029cf
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400029b9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400029c7
call fcn.14009fe08
mov rcx, rdi
call fcn.14009fe00
test esi, esi
js 0x140002e72
mov rcx, qword [rbp + 0x58]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140002ea6
mov qword [rbp + 0x28], 0
mov rax, qword [rbp + 0x38]
cmp qword [rax + 0x18], 8
mov rbx, rax
jb 0x140002a2e
mov rbx, qword [rax]
mov r14, qword [rbp + 0x58]
mov ecx, 0x18
call fcn.14009fdc4
mov rsi, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15, rax
mov qword [rsi], rax
test rax, rax
jne 0x140002a6b
test rbx, rbx
jne 0x140002f62
mov qword [rbp], rsi
mov dword [rbp + 0x30], 0x4c5157
mov ecx, 0x18
call fcn.14009fdc4
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x68], rax
call fcn.1400a2570
mov rdi, qword [rbp + 0x68]
mov qword [rdi], rax
mov qword [rbp - 0x18], rdi
mov rcx, qword [r14]
mov rbx, qword [rcx + 0xa0]
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rax
mov r8, r15
mov r9d, 0x30
call rbx
mov esi, eax
lock sub dword [rdi + 0x10], 1
jne 0x140002b08
mov rcx, qword [rdi]
test rcx, rcx
je 0x140002af2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140002b00
call fcn.14009fe08
mov rcx, rdi
call fcn.14009fe00
mov rdi, qword [rbp]
test rdi, rdi
je 0x140002b43
lock sub dword [rdi + 0x10], 1
jne 0x140002b43
mov rcx, qword [rdi]
test rcx, rcx
je 0x140002b2d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140002b3b
call fcn.14009fe08
mov rcx, rdi
call fcn.14009fe00
test esi, esi
js 0x140002ebc
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x4c], 0
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140002e7e
lea r15, [rbp + 0x4c]
lea r13, [rbp + 0x30]
xorps xmm6, xmm6
lea r12, [rbp - 0x18]
mov r14, rbp
jmp 0x140002cec
call qword [sym.imp.ole32.dll_CoUninitialize]
movaps xmm0, xmmword [rbp + 0x70]
movaps xmm1, xmmword [rbp + 0x80]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movaps xmmword [rbp + 0x80], xmm6
mov word [rbp + 0x70], 0
mov rax, qword [rbp + 0x88]
cmp rax, 8
mov rsi, qword [rbp + 0x40]
mov rdi, qword [rbp + 0x60]
jb 0x140002bf4
mov rcx, qword [rbp + 0x70]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140002bef
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140002e6d
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14009fe08
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx + 0x18]
cmp rax, 8
movaps xmm6, xmmword [0x1400d6010]
jb 0x140002c48
mov rcx, qword [rcx]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140002c3f
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140002e6d
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14009fe08
mov rcx, qword [rbp + 0x38]
movups xmmword [rcx + 0x10], xmm6
mov word [rcx], 0
mov rax, qword [rsi + 0x18]
cmp rax, 8
jb 0x140002c96
mov rcx, qword [rsi]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140002c91
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140002e6d
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14009fe08
movups xmmword [rsi + 0x10], xmm6
mov word [rsi], 0
mov rax, rdi
movaps xmm6, xmmword [rbp + 0xa0]
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14009fe08
movups xmm0, xmmword [rbp]
movups xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0x80], xmm1
movaps xmmword [rbp + 0x70], xmm0
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140002e7e
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], r15
mov edx, 0xffffffff
mov r8d, 1
mov r9, r13
call rax
cmp dword [rbp + 0x4c], 0
je 0x140002e7e
mov rax, qword [rbp + 0x40]
cmp qword [rax + 0x18], 8
mov rdx, rax
jb 0x140002d23
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
movups xmmword [rsp + 0x20], xmm6
xor r8d, r8d
mov r9, r12
call rax
test eax, eax
js 0x140002cdf
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x88]
test rbx, rbx
je 0x140002d50
mov edx, dword [rax + rbx + 0x18]
jmp 0x140002d7d
mov esi, 0x1bd440ba
cmp esi, 0xd9159f21
je 0x140002dc0
sub rdx, 1
jb 0x140002d50
mov ecx, dword [rax + rbx + 0x20]
add rcx, rax
mov edi, dword [rcx + rdx*4]
mov cl, byte [rax + rdi]
test cl, cl
je 0x140002d70
add rdi, rax
mov esi, 0x1bd440ba
nop dword [rax]
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
movzx ecx, byte [rdi + 1]
add rdi, 1
test cl, cl
jne 0x140002da0
jmp 0x140002d75
mov ecx, dword [rax + rbx + 0x1c]
mov ebx, dword [rax + rbx + 0x24]
add rcx, rax
add rbx, rax
mov edx, edx
movzx edx, word [rbx + rdx*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [rbp - 0x10]
call rdx
mov ebx, eax
mov r9, qword [rbp - 0x10]
mov qword [rbp], 0
movaps xmm0, xmmword [0x1400d6010]
movups xmmword [rbp + 0x10], xmm0
mov word [rbp], 0
cmp eax, 7
jbe 0x140002e11
mov rcx, r14
mov rdx, rbx
call fcn.1400070d0
jmp 0x140002e2b
mov qword [rbp + 0x10], rbx
lea r8, [rbx + rbx]
mov rcx, r14
mov rdx, r9
call fcn.1400a5150
mov word [rbp + rbx*2], 0
mov rax, qword [rbp + 0x88]
cmp rax, 8
jb 0x140002ccc
mov rcx, qword [rbp + 0x70]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140002cc7
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jb 0x140002cbd
call fcn.1400b4570
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + select]
jmp 0x140002ed0
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rbp + 0x28]
mov rax, qword [rcx]
call qword [rax + select]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor edi, edi
jmp 0x140002f05
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + select]
jmp 0x140002ed0
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + select]
call qword [sym.imp.ole32.dll_CoUninitialize]
movaps xmm0, xmmword [rbp + 0x70]
movaps xmm1, xmmword [rbp + 0x80]
mov rax, qword [rbp + 0x60]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1400d6010]
movaps xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], 0
mov edi, 1
mov rsi, qword [rbp - 0x28]
test rsi, rsi
je 0x140002f2d
lock sub dword [rsi + 8], 1
jne 0x140002f2d
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
lock sub dword [rsi + 0xc], 1
jne 0x140002f2d
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + VariantCopy]
test edi, edi
jne 0x140002ba3
movaps xmm0, xmmword [rbp + 0x70]
movaps xmm1, xmmword [rbp + 0x80]
mov rdi, qword [rbp + 0x60]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rsi, qword [rbp + 0x40]
jmp 0x140002bf4
mov qword [rbp + 0x68], rdi
mov ecx, 0x8007000e
call fcn.1400a2710
mov qword [rbp + 0x68], rsi
mov ecx, 0x8007000e
call fcn.1400a2710
int3