Function at 0x14009f1c0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
movaps xmmword [rsp + 0x140], xmm6
mov rax, qword [0x1401b06f8]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r15, r8
mov r13, rdx
mov rsi, rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], r8
xor r12d, r12d
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rbx, [r12 - 1]
test eax, eax
jns 0x14009f285
mov eax, dword [0x140188bc0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140188bc4]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x32
xor byte [rsp + 0x52], 0x33
xor byte [rsp + 0x53], 0x34
xor al, 0x35
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009f267
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016340
jmp 0x14009fc0d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14009f31e
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x140188bc0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140188bc4]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x32
xor byte [rsp + 0x52], 0x33
xor byte [rsp + 0x53], 0x34
xor al, 0x35
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009f300
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016340
jmp 0x14009fc0d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x14015e9c0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14015e9d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14009f3ae
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x140188bc0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140188bc4]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x32
xor byte [rsp + 0x52], 0x33
xor byte [rsp + 0x53], 0x34
xor al, 0x35
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009f390
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016340
jmp 0x14009fc0d
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x18]
movups xmm0, xmmword [str.c_iuuo_b_]
movups xmmword [rsp + 0x60], xmm0
mov ecx, dword [0x140191f50]
mov dword [rsp + 0x70], ecx
movzx eax, word [0x140191f54]
mov edx, 0x52
mov word [rsp + 0x60], dx
xor word [rsp + 0x62], 0x32
xor word [rsp + 0x64], 0x33
xor word [rsp + 0x66], 0x34
xor word [rsp + 0x68], 0x35
xor word [rsp + 0x6a], 0x36
xor word [rsp + 0x6c], 0x37
xor word [rsp + 0x6e], 0x38
xor cx, 0x39
mov word [rsp + 0x70], cx
xor word [rsp + 0x72], 0x3a
xor ax, 0x3b
mov word [rsp + 0x74], ax
lea ecx, [rdx - 0x3a]
call fcn.1401293a4
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14009f467
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14009fc56
jmp 0x14009f46a
mov rdi, r12
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x14009fc77
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x50]
call r14
mov r14d, eax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14009f4e4
mov rcx, qword [rdi]
test rcx, rcx
je 0x14009f4c5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14009f4d7
call fcn.140129630
mov qword [rdi + 8], r12
mov edx, Ordinal_26
mov rcx, rdi
call fcn.140129630
test r14d, r14d
jns 0x14009f555
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x140188bc0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140188bc4]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x32
xor byte [rsp + 0x52], 0x33
xor byte [rsp + 0x53], 0x34
xor al, 0x35
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009f537
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016340
jmp 0x14009fc0d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14009f5fe
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x140188bc0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140188bc4]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x32
xor byte [rsp + 0x52], 0x33
xor byte [rsp + 0x53], 0x34
xor al, 0x35
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009f5e0
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016340
jmp 0x14009fc0d
mov qword [rbp - 0x48], r12
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0xa0]
mov qword [rsp + 0x78], rax
mov r14, r13
cmp qword [r13 + 0x18], 0x10
jb 0x14009f623
mov r14, qword [r13]
mov ecx, Ordinal_26
call fcn.1401293a4
mov rdi, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x14009f65d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
mov rcx, r14
call fcn.140128f70
mov qword [rdi], rax
jmp 0x14009f660
mov rdi, r12
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x14009fc82
mov r12, qword [rdi]
mov eax, dword [0x140192238]
mov dword [rsp + 0x58], eax
cmp byte [0x14019223b], 0
je 0x14009f75f
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14009f722
movdqa xmm3, xmmword [0x140192830]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140192a10]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140192a10]
shufps xmm2, xmm0, 0xdd
mov ecx, 1
movd xmm0, ecx
psrad xmm2, xmm0
mov ecx, Ordinal_33
movd xmm0, ecx
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1401928b0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140192a00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140192a30]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x58], xmm2
jmp 0x14009f75f
lea r9, [rsp + 0x58]
xor r8d, r8d
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x14009f730
mov ecx, Ordinal_26
call fcn.1401293a4
mov r14, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14009f79d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rax
mov qword [r14 + 8], rax
mov dword [r14 + 0x10], 1
lea rcx, [rsp + 0x58]
call fcn.140128f70
mov qword [r14], rax
jmp 0x14009f7a0
xor r14d, r14d
mov qword [rbp - 0x70], r14
test r14, r14
je 0x14009fc8d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, Ordinal_50
mov r8, r12
mov rdx, qword [r14]
mov rcx, qword [rbp - 0x58]
call qword [rsp + 0x78]
mov r12d, eax
mov ecx, ebx
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x14009f81c
mov rcx, qword [r14]
test rcx, rcx
je 0x14009f7f8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14009f80e
call fcn.140129630
mov qword [r14 + 8], 0
mov edx, Ordinal_26
mov rcx, r14
call fcn.140129630
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14009f860
mov rcx, qword [rdi]
test rcx, rcx
je 0x14009f83d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14009f853
call fcn.140129630
mov qword [rdi + 8], 0
mov edx, Ordinal_26
mov rcx, rdi
call fcn.140129630
test r12d, r12d
jns 0x14009f8de
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x140188bc0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140188bc4]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x32
xor byte [rsp + 0x52], 0x33
xor byte [rsp + 0x53], 0x34
xor al, 0x35
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
lea rax, [rsp + 0x50]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009f8c0
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016340
jmp 0x14009fc0d
xor r8d, r8d
mov qword [rbp - 0x40], r8
mov dword [rbp - 0x10], r8d
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movdqa xmm6, xmmword [0x1401927f0]
movdqu xmmword [rbp + 0x28], xmm6
mov byte [rbp + 0x18], r8b
cmp qword [r15 + 0x18], 0x10
jb 0x14009f914
mov r12, qword [r15]
mov r14, r12
add r12, qword [r15 + 0x10]
jmp 0x14009f91e
mov r12, qword [r15 + 0x10]
add r12, r15
mov r14, r15
movups xmmword [rbp - 8], xmm0
mov edi, 7
mov qword [rbp + 0x10], rdi
cmp r14, r12
jne 0x14009f941
xor r12d, r12d
mov qword [rbp + 8], r12
mov word [rbp - 8], r12w
jmp 0x14009fa54
mov rax, r12
sub rax, r14
mov rdx, r8
mov qword [rbp + 8], rdx
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x14009fc98
cmp rax, 8
jb 0x14009fa10
mov rdi, rax
or rdi, 7
cmp rdi, rcx
jbe 0x14009f97c
mov rdi, rcx
jmp 0x14009f989
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
mov rax, rdi
add rax, 1
cmovb rax, rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x14009fc50
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x14009f9ea
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14009fc50
mov rcx, rax
call fcn.1401293a4
mov rcx, rax
test rax, rax
je 0x14009f9e3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rbp + 8]
jmp 0x14009f9fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14009f9fa
call fcn.1401293a4
mov rdx, qword [rbp + 8]
jmp 0x14009f9fd
mov rax, r8
mov qword [rbp - 8], rax
mov qword [rbp + 0x10], rdi
nop word [rax + rax]
lea rcx, [rbp - 8]
cmp rdi, 8
cmovae rcx, qword [rbp - 8]
movsx eax, byte [r14]
mov word [rcx + rdx*2], ax
mov rdx, qword [rbp + 8]
inc rdx
mov qword [rbp + 8], rdx
inc r14
cmp r14, r12
je 0x14009fa3e
mov rdi, qword [rbp + 0x10]
jmp 0x14009fa10
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rax, qword [rbp - 8]
xor r12d, r12d
mov word [rax + rdx*2], r12w
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14009fbb9
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
mov r8d, 1
mov edx, ebx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 0x10], 0
je 0x14009fbb4
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x28]
xor r8d, r8d
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x14009fb9d
mov r14, qword [rbp - 0x20]
mov ecx, Ordinal_26
call fcn.1401293a4
mov rdi, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14009fb13
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x14009fb16
test r14, r14
jne 0x14009fc61
jmp 0x14009fb16
mov rdi, r12
mov qword [rbp - 0x60], rdi
test rdi, rdi
je 0x14009fc6c
mov rax, qword [rdi + 8]
test rax, rax
jne 0x14009fb38
mov rcx, qword [rdi]
call fcn.140128e50
mov qword [rdi + 8], rax
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009fb40
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140016110
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14009fb93
mov rcx, qword [rdi]
test rcx, rcx
je 0x14009fb74
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14009fb86
call fcn.140129630
mov qword [rdi + 8], r12
mov edx, Ordinal_26
mov rcx, rdi
call fcn.140129630
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x14009fa70
movdqu xmm6, xmmword [rbp + 0x28]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm6
movdqa xmm0, xmmword [0x1401927f0]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
lea rcx, [rbp - 8]
call fcn.1400a3650
nop
lea rcx, [rbp + 0x18]
call fcn.14000d220
nop
mov rcx, r13
call fcn.14000d220
nop
mov rcx, r15
call fcn.14000d220
mov rax, rsi
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.1401292a0
mov rbx, qword [rsp + 0x1a8]
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000c0a0
nop
mov ecx, 0x8007000e
call fcn.140128e40
nop
mov ecx, 0x8007000e
call fcn.140128e40
nop
mov ecx, 0x8007000e
call fcn.140128e40
nop
mov ecx, 0x8007000e
call fcn.140128e40
int3
mov ecx, 0x8007000e
call fcn.140128e40
nop
mov ecx, 0x8007000e
call fcn.140128e40
nop
call fcn.14000d7a0
int3