Function at 0x1400d7600
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
movaps xmmword [rsp + 0x140], xmm6
mov rax, qword [0x1401e56c8]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r15, r8
mov r13, rdx
mov rsi, rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], r8
xor r12d, r12d
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rbx, [r12 - 1]
test eax, eax
jns 0x1400d76c5
mov eax, dword [str.z_z8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x1401c3f60]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x35
xor byte [rsp + 0x52], 0x36
xor byte [rsp + 0x53], 0x37
xor al, 0x38
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400d76a7
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010900
jmp 0x1400d804d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x1400d775e
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.z_z8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x1401c3f60]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x35
xor byte [rsp + 0x52], 0x36
xor byte [rsp + 0x53], 0x37
xor al, 0x38
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400d7740
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010900
jmp 0x1400d804d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x140195bb0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140195bc0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400d77ee
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.z_z8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x1401c3f60]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x35
xor byte [rsp + 0x52], 0x36
xor byte [rsp + 0x53], 0x37
xor al, 0x38
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400d77d0
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010900
jmp 0x1400d804d
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x18]
movups xmm0, xmmword [0x1401c3ff0]
movups xmmword [rsp + 0x60], xmm0
mov ecx, dword [0x1401c4000]
mov dword [rsp + 0x70], ecx
movzx eax, word [0x1401c4004]
mov edx, 0x52
mov word [rsp + 0x60], dx
xor word [rsp + 0x62], 0x35
xor word [rsp + 0x64], 0x36
xor word [rsp + 0x66], 0x37
xor word [rsp + 0x68], 0x38
xor word [rsp + 0x6a], 0x39
xor word [rsp + 0x6c], 0x3a
xor word [rsp + 0x6e], 0x3b
xor cx, 0x3c
mov word [rsp + 0x70], cx
xor word [rsp + 0x72], 0x3d
xor ax, 0x3e
mov word [rsp + 0x74], ax
lea ecx, [rdx - 0x3a]
call fcn.14015be00
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400d78a7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1400d8096
jmp 0x1400d78aa
mov rdi, r12
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x1400d80b7
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x50]
call r14
mov r14d, eax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1400d7924
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400d7905
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400d7917
call fcn.14015c094
mov qword [rdi + 8], r12
mov edx, Ordinal_27
mov rcx, rdi
call fcn.14015c094
test r14d, r14d
jns 0x1400d7995
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.z_z8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x1401c3f60]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x35
xor byte [rsp + 0x52], 0x36
xor byte [rsp + 0x53], 0x37
xor al, 0x38
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400d7977
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010900
jmp 0x1400d804d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x1400d7a3e
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.z_z8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x1401c3f60]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x35
xor byte [rsp + 0x52], 0x36
xor byte [rsp + 0x53], 0x37
xor al, 0x38
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400d7a20
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010900
jmp 0x1400d804d
mov qword [rbp - 0x48], r12
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0xa0]
mov qword [rsp + 0x78], rax
mov r14, r13
cmp qword [r13 + 0x18], 0x10
jb 0x1400d7a63
mov r14, qword [r13]
mov ecx, Ordinal_27
call fcn.14015be00
mov rdi, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x1400d7a9d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
mov rcx, r14
call fcn.14015cfe0
mov qword [rdi], rax
jmp 0x1400d7aa0
mov rdi, r12
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x1400d80c2
mov r12, qword [rdi]
mov eax, dword [str.cdz7f]
mov dword [rsp + 0x58], eax
cmp byte [0x1401c3fef], 0
je 0x1400d7ba0
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400d7b62
movdqa xmm3, xmmword [0x1401c4b30]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1401c4e30]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1401c4e30]
shufps xmm2, xmm0, 0xdd
mov ecx, 4
movd xmm0, ecx
psrad xmm2, xmm0
mov ecx, Ordinal_35
movd xmm0, ecx
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1401c4b90]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4da0]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x58], xmm2
jmp 0x1400d7ba0
lea r9, [rsp + 0x58]
xor r8d, r8d
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400d7b70
mov ecx, Ordinal_27
call fcn.14015be00
mov r14, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400d7bde
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rax
mov qword [r14 + 8], rax
mov dword [r14 + 0x10], 1
lea rcx, [rsp + 0x58]
call fcn.14015cfe0
mov qword [r14], rax
jmp 0x1400d7be1
xor r14d, r14d
mov qword [rbp - 0x70], r14
test r14, r14
je 0x1400d80cd
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, Ordinal_50
mov r8, r12
mov rdx, qword [r14]
mov rcx, qword [rbp - 0x58]
call qword [rsp + 0x78]
mov r12d, eax
mov ecx, ebx
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x1400d7c5d
mov rcx, qword [r14]
test rcx, rcx
je 0x1400d7c39
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400d7c4f
call fcn.14015c094
mov qword [r14 + 8], 0
mov edx, Ordinal_27
mov rcx, r14
call fcn.14015c094
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400d7ca1
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400d7c7e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400d7c94
call fcn.14015c094
mov qword [rdi + 8], 0
mov edx, Ordinal_27
mov rcx, rdi
call fcn.14015c094
test r12d, r12d
jns 0x1400d7d1e
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [str.z_z8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x1401c3f60]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x35
xor byte [rsp + 0x52], 0x36
xor byte [rsp + 0x53], 0x37
xor al, 0x38
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400d7d00
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010900
jmp 0x1400d804d
xor r8d, r8d
mov qword [rbp - 0x40], r8
mov dword [rbp - 0x10], r8d
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movdqa xmm6, xmmword [0x1401c4af0]
movdqu xmmword [rbp + 0x28], xmm6
mov byte [rbp + 0x18], r8b
cmp qword [r15 + 0x18], 0x10
jb 0x1400d7d54
mov r12, qword [r15]
mov r14, r12
add r12, qword [r15 + 0x10]
jmp 0x1400d7d5e
mov r12, qword [r15 + 0x10]
add r12, r15
mov r14, r15
movups xmmword [rbp - 8], xmm0
mov edi, 7
mov qword [rbp + 0x10], rdi
cmp r14, r12
jne 0x1400d7d81
xor r12d, r12d
mov qword [rbp + 8], r12
mov word [rbp - 8], r12w
jmp 0x1400d7e94
mov rax, r12
sub rax, r14
mov rdx, r8
mov qword [rbp + 8], rdx
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x1400d80d8
cmp rax, 8
jb 0x1400d7e50
mov rdi, rax
or rdi, 7
cmp rdi, rcx
jbe 0x1400d7dbc
mov rdi, rcx
jmp 0x1400d7dc9
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
mov rax, rdi
add rax, 1
cmovb rax, rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x1400d8090
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x1400d7e2a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d8090
mov rcx, rax
call fcn.14015be00
mov rcx, rax
test rax, rax
je 0x1400d7e23
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rbp + 8]
jmp 0x1400d7e3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400d7e3a
call fcn.14015be00
mov rdx, qword [rbp + 8]
jmp 0x1400d7e3d
mov rax, r8
mov qword [rbp - 8], rax
mov qword [rbp + 0x10], rdi
nop word [rax + rax]
lea rcx, [rbp - 8]
cmp rdi, 8
cmovae rcx, qword [rbp - 8]
movsx eax, byte [r14]
mov word [rcx + rdx*2], ax
mov rdx, qword [rbp + 8]
inc rdx
mov qword [rbp + 8], rdx
inc r14
cmp r14, r12
je 0x1400d7e7e
mov rdi, qword [rbp + 0x10]
jmp 0x1400d7e50
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rax, qword [rbp - 8]
xor r12d, r12d
mov word [rax + rdx*2], r12w
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400d7ff9
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
mov r8d, 1
mov edx, ebx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 0x10], 0
je 0x1400d7ff4
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x28]
xor r8d, r8d
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x1400d7fdd
mov r14, qword [rbp - 0x20]
mov ecx, Ordinal_27
call fcn.14015be00
mov rdi, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1400d7f53
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x1400d7f56
test r14, r14
jne 0x1400d80a1
jmp 0x1400d7f56
mov rdi, r12
mov qword [rbp - 0x60], rdi
test rdi, rdi
je 0x1400d80ac
mov rax, qword [rdi + 8]
test rax, rax
jne 0x1400d7f78
mov rcx, qword [rdi]
call fcn.14015cec0
mov qword [rdi + 8], rax
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400d7f80
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.14001dc30
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400d7fd3
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400d7fb4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400d7fc6
call fcn.14015c094
mov qword [rdi + 8], r12
mov edx, Ordinal_27
mov rcx, rdi
call fcn.14015c094
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x1400d7eb0
movdqu xmm6, xmmword [rbp + 0x28]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm6
movdqa xmm0, xmmword [0x1401c4af0]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
lea rcx, [rbp - 8]
call fcn.1400d9140
nop
lea rcx, [rbp + 0x18]
call fcn.140010730
nop
mov rcx, r13
call fcn.140010730
nop
mov rcx, r15
call fcn.140010730
mov rax, rsi
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.14015bde0
mov rbx, qword [rsp + 0x1a8]
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000e990
nop
mov ecx, 0x8007000e
call fcn.14015ceb0
nop
mov ecx, 0x8007000e
call fcn.14015ceb0
nop
mov ecx, 0x8007000e
call fcn.14015ceb0
nop
mov ecx, 0x8007000e
call fcn.14015ceb0
int3
mov ecx, 0x8007000e
call fcn.14015ceb0
nop
mov ecx, 0x8007000e
call fcn.14015ceb0
nop
call fcn.14000ea30
int3