Function at 0x1400d1260
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov rsi, rcx
xor r15d, r15d
mov r14d, r15d
mov dword [rsp + 0x50], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x1400d12b8
xor eax, eax
jmp 0x1400d1d97
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x1400d12f7
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400d1d97
mov qword [rsp + 0x60], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x14044d6b8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14044d6a8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400d1331
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400d1d97
mov qword [rsp + 0x58], r15
mov ecx, 0x18
call fcn.14036fce4
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400d1376
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.rootCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400d1dce
jmp 0x1400d1379
mov rbx, r15
mov qword [rsp + 0xa0], rbx
test rbx, rbx
je 0x1400d1dd9
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1400d13fd
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400d13de
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400d13f0
call fcn.14036fd20
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14036fd20
test edi, edi
jns 0x1400d1419
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400d1d97
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x1400d146f
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400d1d97
mov qword [rsp + 0x68], r15
movdqa xmm6, xmmword [0x140505120]
movdqu xmmword [rsp + 0x128], xmm6
movdqa xmm7, xmmword [0x1405050e0]
movdqu xmmword [rsp + 0x138], xmm7
mov dword [rsp + 0x148], 0x4242415c
mov word [rsp + 0x14c], 0x5c4b
mov byte [rsp + 0x14e], 0x2e
mov r12d, 0x1c
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r12 + rcx]
cmp dword [0x1407f3428], eax
jg 0x1400d1de3
lea rbx, [0x1407f3400]
cmp byte [0x1407f3426], 0
je 0x1400d151f
mov rax, r15
movdqa xmm2, xmmword [0x140505000]
movdqu xmm0, xmmword [rax + rbx]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + rbx], xmm1
add rax, 0x10
cmp rax, 0x20
jb 0x1400d14f0
cmp rax, 0x27
jae 0x1400d151f
xor byte [rax + rbx], 0x2e
inc rax
cmp rax, 0x27
jb 0x1400d1512
mov ecx, 0x18
call fcn.14036fce4
mov rdi, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x1400d1551
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rbx
call fcn.140370e80
mov qword [rdi], rax
jmp 0x1400d1554
mov rdi, r15
mov qword [rsp + 0x90], rdi
test rdi, rdi
je 0x1400d1e4a
mov ecx, 0x18
call fcn.14036fce4
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400d159b
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x140501714]
call fcn.140370e80
mov qword [rbx], rax
jmp 0x1400d159e
mov rbx, r15
mov qword [rsp + 0x88], rbx
test rbx, rbx
je 0x1400d1e55
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r15
mov r9d, 0x30
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov ebx, eax
lea rcx, [rsp + 0x88]
call fcn.1400ce3e0
nop
lea rcx, [rsp + 0x90]
call fcn.1400ce3e0
test ebx, ebx
jns 0x1400d161c
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400d1d97
mov dword [rsp + 0x50], r15d
mov rcx, qword [rsi + 0x148]
add rcx, 0x3b8
xor r8d, r8d
lea rdx, [0x14045aac0]
call fcn.140005ff0
lea r13, [0x1405002d8]
nop word [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400d18f7
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rsp + 0x50], 0
je 0x1400d18f2
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + 0x20]
mov rdi, qword [rsp + 0xc0]
mov ecx, 0x18
call fcn.14036fce4
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400d16f4
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400d16f7
test rdi, rdi
jne 0x1400d1e60
jmp 0x1400d16f7
mov rbx, r15
mov qword [rsp + 0xa8], rbx
test rbx, rbx
je 0x1400d1e6b
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400d171d
mov rcx, qword [rbx]
call fcn.140370d60
mov qword [rbx + 8], rax
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], 0xf
mov byte [rsp + 0xe8], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400d1740
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.140005ff0
nop
mov rax, qword [rsi + 0x148]
lea r8, [0x14045aac0]
cmp qword [rax + 0x3c8], 0
cmova r8, r13
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [r8 + r9], 0
jne 0x1400d1780
lea rcx, [rsp + 0xe8]
call fcn.140041e60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x160], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r14d, 1
mov rcx, qword [rsi + 0x148]
add rcx, 0x3b8
lea rdx, [rsp + 0x150]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, r8
movq r8, xmm1
call fcn.1400223b0
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 0x10
jb 0x1400d1841
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d183b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1e76
call fcn.14036fd20
nop
mov rdx, qword [rsp + 0x100]
cmp rdx, 0x10
jb 0x1400d1884
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d187f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1e7c
call fcn.14036fd20
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], 0xf
mov byte [rsp + 0xe8], 0
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400d18df
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400d18c0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400d18d2
call fcn.14036fd20
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14036fd20
lea rcx, [rsp + 0xb8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1400d1650
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
movdqa xmm6, xmmword [0x140505120]
movdqu xmmword [rsp + 0x190], xmm6
movdqa xmm7, xmmword [0x1405050f0]
movdqu xmmword [rsp + 0x1a0], xmm7
mov byte [rsp + 0x1b0], 0x2e
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r12 + rcx]
cmp dword [0x1407f3430], eax
jg 0x1400d1e82
lea rbx, [0x1407f33a0]
cmp byte [0x1407f33c0], 0
je 0x1400d199f
mov rax, r15
movdqa xmm2, xmmword [0x140505000]
nop dword [rax]
movdqu xmm0, xmmword [rax + rbx]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + rbx], xmm1
add rax, 0x10
cmp rax, 0x20
jb 0x1400d1970
cmp rax, 0x21
jae 0x1400d199f
xor byte [rax + rbx], 0x2e
inc rax
cmp rax, 0x21
jb 0x1400d1992
mov ecx, 0x18
call fcn.14036fce4
mov rdi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400d19d1
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rbx
call fcn.140370e80
mov qword [rdi], rax
jmp 0x1400d19d4
mov rdi, r15
mov qword [rsp + 0x80], rdi
test rdi, rdi
je 0x1400d1ecd
mov ecx, 0x18
call fcn.14036fce4
mov rbx, rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x1400d1a1b
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x140501714]
call fcn.140370e80
mov qword [rbx], rax
jmp 0x1400d1a1e
mov rbx, r15
mov qword [rsp + 0x98], rbx
test rbx, rbx
je 0x1400d1ed8
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r15
mov r9d, 0x30
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov ebx, eax
lea rcx, [rsp + 0x98]
call fcn.1400ce3e0
nop
lea rcx, [rsp + 0x80]
call fcn.1400ce3e0
test ebx, ebx
jns 0x1400d1a9c
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400d1d97
mov rcx, qword [rsi + 0x148]
add rcx, 0x398
xor r8d, r8d
lea rdx, [0x14045aac0]
call fcn.140005ff0
nop dword [rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400d1d62
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rsp + 0x50], 0
je 0x1400d1d62
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xd0]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + 0x20]
mov rdi, qword [rsp + 0xd8]
mov ecx, 0x18
call fcn.14036fce4
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400d1b64
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400d1b67
test rdi, rdi
jne 0x1400d1ee3
jmp 0x1400d1b67
mov rbx, r15
mov qword [rsp + 0xb0], rbx
test rbx, rbx
je 0x1400d1eee
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400d1b8d
mov rcx, qword [rbx]
call fcn.140370d60
mov qword [rbx + 8], rax
mov qword [rsp + 0x118], r15
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400d1bb0
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.140005ff0
nop
mov rax, qword [rsi + 0x148]
lea r8, [0x14045aac0]
cmp qword [rax + 0x3a8], 0
cmova r8, r13
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [r8 + r9], 0
jne 0x1400d1bf0
lea rcx, [rsp + 0x108]
call fcn.140041e60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x180], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r14d, 2
mov rcx, qword [rsi + 0x148]
add rcx, 0x398
lea rdx, [rsp + 0x170]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, r8
movq r8, xmm1
call fcn.1400223b0
nop
mov rdx, qword [rsp + 0x188]
cmp rdx, 0x10
jb 0x1400d1cb1
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d1cab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1ef9
call fcn.14036fd20
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x1400d1cf4
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d1cef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1eff
call fcn.14036fd20
mov qword [rsp + 0x118], r15
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400d1d4f
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400d1d30
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400d1d42
call fcn.14036fd20
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14036fd20
lea rcx, [rsp + 0xd0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1400d1ac0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
xor eax, eax
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.14036fcc0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8007000e
call fcn.140370d50
nop
mov ecx, 0x8007000e
call fcn.140370d50
lea rcx, [0x1407f3428]
call fcn.14036fedc
cmp dword [0x1407f3428], 0xffffffff
jne 0x1400d14d5
movaps xmmword [0x1407f3400], xmm6
movaps xmmword [0x1407f3410], xmm7
mov eax, dword [rsp + 0x148]
mov dword [0x1407f3420], eax
movzx eax, word [rsp + 0x14c]
mov word [0x1407f3424], ax
mov byte [0x1407f3426], 0x2e
lea rcx, [0x1403c65f0]
call fcn.140370224
lea rcx, [0x1407f3428]
call fcn.14036fe7c
jmp 0x1400d14d5
mov ecx, 0x8007000e
call fcn.140370d50
nop
mov ecx, 0x8007000e
call fcn.140370d50
nop
mov ecx, 0x8007000e
call fcn.140370d50
nop
mov ecx, 0x8007000e
call fcn.140370d50
nop
call fcn.1403933ec
nop
call fcn.1403933ec
nop
lea rcx, [0x1407f3430]
call fcn.14036fedc
cmp dword [0x1407f3430], 0xffffffff
jne 0x1400d194e
movaps xmmword [0x1407f33a0], xmm6
movaps xmmword [0x1407f33b0], xmm7
mov byte [0x1407f33c0], 0x2e
lea rcx, [0x1403c65d0]
call fcn.140370224
lea rcx, [0x1407f3430]
call fcn.14036fe7c
jmp 0x1400d194e
mov ecx, 0x8007000e
call fcn.140370d50
nop
mov ecx, 0x8007000e
call fcn.140370d50
nop
mov ecx, 0x8007000e
call fcn.140370d50
nop
mov ecx, 0x8007000e
call fcn.140370d50
nop
call fcn.1403933ec
nop
call fcn.1403933ec
int3