Function at 0x1400df690
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x20], rdx
mov rsi, rcx
mov eax, dword [0x141dda408]
or eax, dword [0x141dda40c]
add eax, 0x86ef8e61
mov ecx, 0xaca34537
imul rcx, rax
shr rcx, 0x3f
add ecx, 0x4af28971
cmp ecx, 0x99fb4f91
ja 0x1400df768
mov eax, dword [0x141dda410]
add eax, dword [0x141dda414]
or eax, 0x33639f35
imul rcx, rax, 0x4aa80da9
shr rcx, 0x3b
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rax, rsp
cmp ecx, 0xf2d69bf8
jne 0x1400df7bb
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
jmp 0x1400df6e4
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x38], rdx
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov qword [rbp - 0x18], rsp
mov qword [rcx], 0
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [0x141dbaf74]
lea r9, [0x141dbaf58]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
mov edi, eax
nop dword [rax]
mov eax, dword [0x141dda418]
xor edx, edx
div dword [0x141dda41c]
imul eax, eax, 0xb682cdb8
cmp eax, 0x6e1e0f5e
je 0x1400df830
test edi, edi
js 0x1400dfb1a
mov rdi, qword [rbp - 0x20]
nop word [rax + rax]
mov eax, dword [0x141dda420]
imul eax, dword [0x141dda424]
add eax, 0xd5d9b44c
imul rax, rax, 0x1f2a457b
shr rax, 0x3c
cmp eax, 0x11b41302
ja 0x1400df860
mov rcx, qword [r13]
nop dword [rax + rax]
mov eax, dword [0x141dda428]
and eax, dword [0x141dda42c]
cmp eax, 0x56558614
je 0x1400df890
test rcx, rcx
je 0x1400dfb46
mov qword [rbp - 0x18], rcx
mov eax, dword [0x141dda458]
and eax, dword [0x141dda45c]
imul eax, eax, 0xaf9070a1
cmp eax, 0xeee89b60
mov r12, qword [rbp - 0x40]
jne 0x1400df8e7
sub rsp, 0x20
mov rcx, rdi
mov rdx, r12
call fcn.1400de090
add rsp, 0x20
mov qword [rbx], 0
mov r13, rdi
nop word [rax + rax]
mov eax, dword [0x141dda460]
xor edx, edx
div dword [0x141dda464]
xor eax, 0x10190883
and eax, 0x10193983
imul edi, eax, 0xefab2f12
sub rsp, 0x20
mov rcx, r13
mov rdx, r12
call fcn.1400de090
add rsp, 0x20
mov qword [rbx], 0
add byte [rax], al
add byte [rax], al
cmp edi, 0xd1c784bc
jb 0x1400df8f0
mov r15, rax
mov qword [rbp - 0x20], rsi
mov rsi, qword [rbp - 0x18]
mov rax, qword [rsi]
mov ecx, dword [0x141dda468]
sub ecx, dword [0x141dda46c]
mov rdi, qword [rax + 0x18]
xor ecx, 0x71839845
imul eax, ecx, 0x88a2e524
cmp eax, 0xa9aed9e
jne 0x1400df999
sub rsp, 0x50
mov qword [rsp + 0x40], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call rdi
mov rsi, qword [rbp - 0x18]
add rsp, 0x50
xorps xmm6, xmm6
nop dword [rax]
mov r13d, dword [0x141dda470]
sub r13d, dword [0x141dda474]
or r13d, 0x3804cc0
xor r13d, 0xc3021880
or r13d, 0x383d031a
sub rsp, 0x50
mov qword [rsp + 0x40], rbx
movups xmmword [rsp + 0x30], xmm6
xor bh, al
and al, 0x28
add byte [rax], 0
add byte [rax - 0x39], cl
and al, 0x20
add byte [rax], al
add byte [rax], al
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call rdi
add rsp, 0x50
cmp r13d, 0x3461aac8
jb 0x1400df9a0
mov r12d, eax
mov eax, dword [0x141dda478]
or eax, dword [0x141dda47c]
add eax, 0x9a7b98d2
or eax, 0x508fffef
and eax, 0x5dafffff
cmp eax, 0xa65b0f3b
ja 0x1400dfa00
test r12d, r12d
mov r13, rsi
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
js 0x1400dfb79
mov r14, qword [rbx]
nop dword [rax]
mov eax, dword [0x141dda480]
or eax, dword [0x141dda484]
xor eax, 0x8096879b
imul rax, rax, 0x4bcb6421
shr rax, 0x3e
cmp eax, 0x65aeead7
je 0x1400dfa40
test r14, r14
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x38]
je 0x1400dfced
test r15, r15
je 0x1400dfaed
mov eax, dword [0x141dda4c8]
add eax, dword [0x141dda4cc]
and eax, 0xcc4d23dd
add eax, 0xd9a21838
or eax, 0x262960f7
cmp eax, 0x60bee60
jae 0x1400dfaac
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.oleaut32.dll_SysFreeString]
add rsp, 0x20
mov rdi, qword [sym.imp.oleaut32.dll_SysFreeString]
nop word cs:[rax + rax]
mov ebx, dword [0x141dda4d0]
or ebx, dword [0x141dda4d4]
add ebx, 0x25f934fe
or ebx, 0xf6d7f1e7
sub rsp, 0x20
mov rcx, r15
call rdi
add rsp, 0x20
cmp ebx, 0x9588ef29
jb 0x1400dfac0
mov eax, dword [0x141dda4d8]
xor edx, edx
div dword [0x141dda4dc]
or eax, 0x88101a08
xor eax, 0x404a0008
or eax, 0x2584e1d1
cmp eax, 0x70da74b1
jae 0x1400dffa2
invalid
lea eax, [rax + rax]
invalid
jmp 0x1400e0005
mov eax, dword [0x141dda438]
imul eax, dword [0x141dda43c]
add eax, 0x31d6e98d
xor eax, 0x3ec26c05
add eax, 0xd6f31033
cmp eax, 0xae0f91cb
jae 0x1400dfed2
jmp 0x1400dff0d
mov eax, 0xb603d9ad
nop dword [rax + rax]
mov ecx, dword [0x141dda430]
sub ecx, dword [0x141dda434]
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x775584de
cmp ecx, 0xf73572a7
jae 0x1400dfb50
xor edi, edi
jmp 0x1400dfe39
mov eax, dword [0x141dda488]
xor eax, dword [0x141dda48c]
test eax, 0xc06901cf
xchg edx, eax
nop
xchg edx, eax
invalid
or eax, 0xae372d54
and eax, 0xffbfbf5c
cmp eax, 0x168fc34
jne 0x1400dfbb6
mov qword [r14], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
mov rdi, qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov rsi, qword [rbp - 0x20]
nop word cs:[rax + rax]
mov eax, dword [0x141dda490]
or eax, dword [0x141dda494]
xor eax, 0xea6f3ad5
cmp ch, byte [rdi - 0x16]
imul ebx, eax, 0x8757f001
mov qword [r14], 0
sub rsp, 0x20
and byte [rcx], dh
leave
mov rdx, r14
call rdi
add rsp, 0x20
cmp ebx, 0xdcc29787
ja 0x1400dfbd0
mov r14, qword [r14]
nop dword [rax + rax]
mov eax, dword [0x141dda498]
xor eax, dword [0x141dda49c]
imul eax, eax, 0xae5ecda5
add eax, 0x4dfab467
and eax, 0xbdb0097
cmp eax, 0x203a4df
jb 0x1400dfc10
test r14, r14
je 0x1400dfce3
mov rax, qword [r14]
mov rdi, qword [rax + 0x10]
mov eax, dword [0x141dda4a0]
xor edx, edx
div dword [0x141dda4a4]
and eax, 0x80eb9371
imul eax, eax, 0x952571ba
add eax, 0x43509ec6
cmp eax, 0x241c867c
jae case.0x14007ade5.870
sub rsp, 0x20
mov rcx, r14
call rdi
xlatb
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dda4a8]
xor eax, dword [0x141dda4ac]
imul rax, rax, 0x559b5793
shr rax, 0x3e
or eax, 0xeef185f8
imul ebx, eax, 0xf2eb25e0
sub rsp, 0x20
mov rcx, r14
call rdi
add rsp, 0x20
cmp ebx, 0x7865b6e3
ja case.0x14007ade5.870
nop word [rax + rax]
mov eax, dword [0x141dda4b0]
xor eax, dword [0x141dda4b4]
or eax, 0x89fd12c
imul eax, eax, 0xf159daf
shr byte [rdi + 0xd0f159d], 0x11
retf
cdq
pop rbp
cmp eax, 0xdb0b808c
je 0x1400dfcc0
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
jmp 0x1400dfcf7
xor eax, eax
nop
test al, al
jne 0x1400dfcf0
xor r12d, r12d
mov eax, dword [0x141dda518]
xor eax, dword [0x141dda51c]
mov ecx, 0xa4513ead
imul rcx, rax
shr rcx, 0x3d
or ecx, 0xe0ac5a1e
cmp ecx, 0xbd470006
jae 0x1400dfd40
movzx eax, byte [rdx + 2]
mov byte [rsi + 3], al
movzx eax, word [rdx]
mov word [rsi + 1], ax
movups xmm0, xmmword [r8]
adc byte [rax], al
movups xmmword [rsi + 0x10], xmm0
nop word cs:[rax + rax]
movzx eax, word [rdx]
mov word [rsi + 1], ax
mov eax, dword [0x141dda520]
add eax, dword [0x141dda524]
movzx ecx, byte [rdx + 2]
mov byte [rsi + 3], cl
or eax, 0x67e9ad50
shr eax, 1
imul rax, rax, 0x41b57e51
shr rax, 0x3d
movups xmm0, xmmword [r8]
movups xmmword [rsi + 0x10], xmm0
cmp eax, 0x41c6bfaa
je 0x1400dfd40
test r15, r15
je 0x1400dfdc8
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.oleaut32.dll_SysFreeString]
add rsp, 0x20
mov eax, 0xece052e3
nop word cs:[rax + rax]
mov ecx, dword [0x141dda528]
or ecx, dword [0x141dda52c]
imul ecx, ecx, 0x676350b3
or ecx, 0x762d104
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xfd8ac543
je 0x1400dfda0
mov eax, dword [0x141dda530]
imul eax, dword [str.t_Sw]
or eax, 0x2040020
and eax, 0x305c021
cmp eax, 0xda289b5d
jbe 0x1400dfdf0
mov byte [rsi], 0
nop dword [rax]
mov eax, dword [0x141dda538]
imul eax, dword [0x141dda53c]
imul rax, rax, 0x6d294cc5
shr rax, 0x3b
xor eax, 0x12050022
or eax, 0xa1e871c9
mov byte [rsi], 0
cmp eax, 0x5dddaa3c
jb 0x1400dfdf0
mov dword [rsi + 4], r12d
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400dfe30
jmp 0x1400e00f6
mov r13, qword [rbp - 0x18]
mov eax, dword [0x141dda4b8]
xor eax, dword [0x141dda4bc]
imul rcx, rax, 0x148149b9
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0x3ab1b0
cmp eax, 0xc48ef544
jbe 0x1400dfe8a
movzx eax, byte [r12 + 2]
mov byte [rsi + 3], al
movzx eax, word [r12]
mov word [rsi + 1], ax
movups xmm0, xmmword [r13]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
mov dword [rsi + 4], edi
mov eax, 0x855f7e67
nop
movzx ecx, word [r12]
mov word [rsi + 1], cx
mov ecx, dword [0x141dda4c0]
sub ecx, dword [0x141dda4c4]
movzx edx, byte [r12 + 2]
mov byte [rsi + 3], dl
imul rcx, rax
shr rcx, 0x3e
movups xmm0, xmmword [r13]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
mov dword [rsi + 4], edi
cmp ecx, 0xf07ec783
je 0x1400dfe90
jmp 0x1400e0110
mov ebx, dword [0x141dda440]
imul ebx, dword [0x141dda444]
and ebx, 0xd525566d
add ebx, 0x195e2265
mov qword [r15], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
cmp ebx, 0xa7a5a4d2
jbe 0x1400dff29
mov qword [r15], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
jmp 0x1400dfed2
mov rbx, qword [r15]
test rbx, rbx
je 0x1400dfe39
mov eax, dword [0x141dda448]
imul eax, dword [0x141dda44c]
mov r14, qword [rbx]
xor eax, 0x56e5d9db
add eax, 0xdc5c9548
cmp eax, 0x91ed08f9
ja 0x1400dff6b
sub rsp, 0x20
mov rcx, rbx
call qword [r14 + 0x10]
add rsp, 0x20
xor eax, eax
test al, al
je 0x1400dff7c
sub rsp, 0x20
mov rcx, rbx
call qword [r14 + 0x10]
add rsp, 0x20
jmp 0x1400dff56
mov r13, qword [rbp - 0x18]
mov eax, dword [0x141dda450]
sub eax, dword [0x141dda454]
or eax, 0xa144a11b
and eax, 0xa546a11b
cmp eax, 0xe6a8b274
jae 0x1400dff80
jmp 0x1400dfe3d
mov edi, dword [0x141dda4e0]
xor edi, dword [0x141dda4e4]
and edi, 0x23e7b91f
add edi, 0xc3672abb
xor edi, 0x2a651236
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
add rsp, 0x40
cmp edi, 0x6cc843a9
jae 0x1400e0047
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
add rsp, 0x40
jmp 0x1400dffa2
mov r15d, eax
nop word [rax + rax]
mov eax, dword [0x141dda4e8]
xor eax, dword [0x141dda4ec]
add eax, 0x81707fed
cmp eax, 0x6942ce5f
jb 0x1400e0050
mov eax, 0x886c69c1
nop dword [rax]
mov ecx, dword [0x141dda4f0]
mov edx, dword [0x141dda4f4]
add ecx, edx
add ecx, 0x7e63a41a
or ecx, 0x9a99714
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xa8d21be9
je 0x1400e0070
test r15d, r15d
js 0x1400e0143
mov eax, dword [0x141dda540]
sub eax, dword [0x141dda544]
or eax, 0x49b03d67
add eax, 0xefdbaf3
and eax, 0xa2e0a092
cmp eax, 0x5475c960
jbe 0x1400e00d0
mov qword [rsi + 8], r14
mov byte [rsi], 0x12
nop dword [rax]
mov eax, dword [0x141dda548]
xor edx, edx
div dword [0x141dda54c]
and eax, 0x768132b5
add eax, 0xa85e378b
mov qword [rsi + 8], r14
mov byte [rsi], 0x12
cmp eax, 0x30ce738
jb 0x1400e00d0
mov rax, qword [r13]
sub rsp, 0x20
mov rcx, r13
call qword [rax + 0x10]
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x141dda570]
or eax, dword [0x141dda574]
imul eax, eax, 0x2ea7fbe8
add eax, 0x273c75df
cmp eax, 0x31b00b17
jb 0x1400e0110
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141dda4f8]
and eax, dword [0x141dda4fc]
or eax, 0x4ee1fbb9
add eax, 0x350291e1
xor eax, 0xe1c35bc6
cmp eax, 0xb78109d5
ja 0x1400e01a0
mov edi, dword [0x141dda500]
or edi, dword [0x141dda504]
and edi, 0x8000825
add edi, 0x65f02f1
mov qword [r12], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
cmp edi, 0xc8a6d835
jbe 0x1400e01bd
mov qword [r12], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
jmp 0x1400e0165
mov rbx, qword [r12]
test rbx, rbx
je 0x1400e0240
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov eax, dword [0x141dda508]
xor edx, edx
div dword [0x141dda50c]
add eax, 0xbe9f743d
mov ecx, 0xa82a8fd5
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xb9c500f8
ja 0x1400e0231
mov eax, dword [0x141dda510]
xor edx, edx
div dword [0x141dda514]
mov r12d, eax
or r12d, 0x9f249c2d
add r12d, 0xe00ab405
xor r12d, 0x41048cc9
sub rsp, 0x20
mov rcx, rbx
call rdi
add rsp, 0x20
cmp r12d, 0x4484f796
jb 0x1400e0240
sub rsp, 0x20
mov rcx, rbx
call rdi
add rsp, 0x20
jmp 0x1400e01f5
mov eax, dword [0x141dda550]
xor eax, dword [0x141dda554]
shr eax, 1
mov ecx, 0xb5dd9637
imul rcx, rax
shr rcx, 0x39
add ecx, 0xa6b63182
cmp ecx, 0xe84b3ca2
jbe 0x1400e0270
mov byte [rsi], 0
mov dword [rsi + 4], r15d
mov eax, dword [0x141dda558]
imul eax, dword [0x141dda55c]
or eax, 0xa18d0b6c
mov byte [rsi], 0
mov dword [rsi + 4], r15d
cmp eax, 0x34e7686b
je 0x1400e0270
mov rax, qword [r14]
mov rsi, qword [rax + 0x10]
mov eax, dword [str.__Ra_t]
or eax, dword [0x141dda564]
and eax, 0xbb281dd4
cmp eax, 0xbfc3db74
je 0x1400e02e4
mov eax, dword [0x141dda568]
or eax, dword [0x141dda56c]
add eax, 0xcfa80af5
and eax, 0x8321f20b
imul edi, eax, 0x56ef66f5
sub rsp, 0x20
mov rcx, r14
call rsi
add rsp, 0x20
cmp edi, 0x32d7f03d
ja 0x1400dfe20
sub rsp, 0x20
mov rcx, r14
call rsi
add rsp, 0x20
jmp 0x1400e02af