Function at 0x1400e0eb0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, r8
mov r15, rdx
mov qword [rsp + 0x60], rcx
mov eax, dword [0x141ddc7e8]
xor edx, edx
div dword [0x141ddc7ec]
xor eax, 0x6e64de61
add eax, 0x66fad436
and eax, 0x617cd01b
lea r12, [rsp + 0x48]
cmp eax, 0xc291e108
jne 0x1400e0f1e
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], r12
lea rcx, [0x141dbbf74]
lea r9, [0x141dbbf58]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rbx, [0x141dbbf74]
lea rsi, [0x141dbbf58]
mov rbp, qword [sym.imp.ole32.dll_CoCreateInstance]
nop word cs:[rax + rax]
mov eax, dword [0x141ddc7f0]
or eax, dword [0x141ddc7f4]
imul r13d, eax, 0x9352aa10
add r13d, 0x15086dd0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], r12
mov rcx, rbx
xor edx, edx
mov r8d, 1
add byte [rax], al
add byte [rcx - 0x77], cl
int1
call rbp
cmp r13d, 0x68f519ad
jb 0x1400e0f40
mov edi, eax
test eax, eax
js 0x1400e102a
nop dword [rax + rax]
mov eax, dword [0x141ddc7f8]
or eax, dword [0x141ddc7fc]
or eax, 0x10abf93c
imul eax, eax, 0x83769901
or eax, 0xee7de85a
cmp eax, 0xebf82821
je 0x1400e0f90
mov rdi, qword [rsp + 0x48]
test rdi, rdi
mov rsi, qword [rsp + 0x60]
je 0x1400e1000
mov eax, dword [0x141ddc810]
sub eax, dword [0x141ddc814]
mov ecx, 0xc0ea38f5
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xbf232cbc
imul eax, ecx, 0xb88765a4
cmp eax, 0x3e6ccf85
ja 0x1400e1115
jmp 0x1400e10f8
mov eax, dword [0x141ddc800]
xor edx, edx
div dword [0x141ddc804]
imul rax, rax, 0x79da8267
shr rax, 0x3e
imul eax, eax, 0x70d006f2
cmp eax, 0xf8fad7f1
je 0x1400e1000
xor edi, edi
jmp 0x1400e106d
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400e1068
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, dword [0x141ddc808]
and eax, dword [0x141ddc80c]
and eax, 0xa53c9b51
cmp eax, 0xcedc1f70
je 0x1400e1050
mov rsi, qword [rsp + 0x60]
mov eax, dword [0x141ddc870]
sub eax, dword [0x141ddc874]
and eax, 0x8a2c0100
or eax, 0x44128cfa
xor eax, 0x3714033c
cmp eax, 0x5ce39ec1
jae 0x1400e10b0
movzx eax, byte [rsp + 0x4a]
mov byte [rsi + 3], al
movzx eax, word [rsp + 0x48]
mov word [rsi + 1], ax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
mov dword [rsi + 4], edi
nop
movzx eax, byte [rsp + 0x4a]
mov byte [rsi + 3], al
movzx eax, word [rsp + 0x48]
mov word [rsi + 1], ax
mov eax, dword [0x141ddc878]
and eax, dword [0x141ddc87c]
and eax, 0x56115fdd
imul eax, eax, 0xdc2f09a
and eax, 0x7dba05fc
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
mov dword [rsi + 4], edi
cmp eax, 0xa2ea4d08
je 0x1400e10b0
jmp 0x1400e1874
mov rcx, r15
mov rdx, r14
call fcn.1400df440
mov rbx, rax
mov qword [rsp + 0x48], 0
xor eax, eax
test al, al
je 0x1400e112b
mov rcx, r15
mov rdx, r14
call fcn.1400df440
mov qword [rsp + 0x48], 0
jmp 0x1400e10f8
mov rax, qword [rdi]
mov qword [rsp + 0x40], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
mov ebp, eax
nop dword [rax]
mov eax, dword [0x141ddc818]
xor eax, dword [0x141ddc81c]
and eax, 0x60804062
add eax, 0x70ec030e
cmp eax, 0xffd4b25b
ja 0x1400e1160
test ebp, ebp
js 0x1400e1254
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400e1190
mov r14, qword [rsp + 0x48]
nop dword [rax]
mov eax, dword [0x141ddc820]
sub eax, dword [0x141ddc824]
imul eax, eax, 0x559aa595
and eax, 0x32208ca6
add eax, 0xb540549e
cmp eax, 0xe7d2802b
ja 0x1400e11a0
test r14, r14
je 0x1400e1230
nop dword [rax + rax]
mov eax, dword [0x141ddc880]
sub eax, dword [0x141ddc884]
cmp eax, 0x47d9e791
je 0x1400e11d0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400e11f0
test rbx, rbx
je 0x1400e12c0
mov eax, dword [0x141ddc888]
and eax, dword [0x141ddc88c]
imul rax, rax, 0x1ace7aaf
shr rax, 0x3a
imul eax, eax, 0x682e791e
cmp eax, 0x449ecb8
jb 0x1400e12b5
jmp 0x1400e127d
mov eax, dword [0x141ddc828]
xor eax, dword [0x141ddc82c]
or eax, 0x25745e0b
add eax, 0x660b0b2b
cmp eax, 0x24b52d5a
jbe 0x1400e1230
xor ebp, ebp
jmp 0x1400e1507
mov eax, dword [0x141ddc830]
xor edx, edx
div dword [0x141ddc834]
xor eax, 0xe1d5224c
imul eax, eax, 0x61470bbe
cmp eax, 0x3026e73a
je 0x1400e1635
jmp 0x1400e15f5
mov eax, dword [0x141ddc890]
imul eax, dword [0x141ddc894]
imul r15, rax, 0x5be176a5
shr r15, 0x3c
add r15d, 0x69cb676e
and r15d, 0x48cb2224
mov rcx, rbx
call qword [sym.imp.oleaut32.dll_SysFreeString]
cmp r15d, 0x8ad1d717
jne 0x1400e12c0
mov rcx, rbx
call qword [sym.imp.oleaut32.dll_SysFreeString]
jmp 0x1400e127d
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
nop word [rax + rax]
mov eax, dword [0x141ddc898]
or eax, dword [0x141ddc89c]
or eax, 0x87482712
imul eax, eax, 0xd2d6c328
sar byte [0x149fcb732], cl
je 0x1400e1300
test ebx, ebx
js 0x1400e1377
xor eax, eax
test al, al
je 0x1400e1330
mov qword [rsi + 8], r14
nop dword [rax]
mov eax, dword [0x141ddc8f0]
add eax, dword [0x141ddc8f4]
or eax, 0x2ef05d0a
add eax, 0x61220254
and eax, 0x2137708e
mov qword [rsi + 8], r14
cmp eax, 0x11d781fb
je 0x1400e1330
mov eax, dword [0x141ddc8f8]
add eax, dword [0x141ddc8fc]
xor eax, 0xead851ca
cmp eax, 0xcc44fc7f
ja 0x1400e1799
jmp 0x1400e176e
mov eax, dword [0x141ddc8a0]
and eax, dword [str.DGU]
add eax, 0x2b7b7522
xor eax, 0xbb25445d
mov ecx, 0xa6b3532b
imul rcx, rax
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x18
cmp eax, 0xb7938a12
jbe 0x1400e13b3
mov qword [rsp + 0x50], 0
xor eax, eax
nop word cs:[rax + rax]
mov qword [rsp + 0x50], 0
test al, al
jne 0x1400e13c0
mov eax, dword [0x141ddc8a8]
add eax, dword [0x141ddc8ac]
mov ah, 0xcf
add dword [rcx - 0x40], ebp
push rax
in al, 0x52
std
and eax, 0x29970880
imul eax, eax, 0x11d3a069
cmp eax, 0xb3f02f83
jbe 0x1400e13fe
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
lea r15, [rsp + 0x50]
mov r12, qword [sym.imp.oleaut32.dll_GetErrorInfo]
nop word [rax + rax]
mov ebp, dword [0x141ddc8b0]
imul ebp, dword [0x141ddc8b4]
and ebp, 0x5dcb84d8
add ebp, 0x566ad4a5
and ebp, 0x65780045
xor ecx, ecx
mov rdx, r15
call r12
cmp ebp, 0xc60c2307
ja 0x1400e1410
mov r15, qword [rsp + 0x50]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400e1450
test r15, r15
je 0x1400e14db
nop dword [rax]
mov eax, dword [0x141ddc8b8]
sub eax, dword [0x141ddc8bc]
add eax, 0xf2825cca
xor eax, 0x112e1044
and eax, 0x912e977c
cmp eax, 0x83929e36
je 0x1400e1460
mov rax, qword [r15]
mov r12, qword [rax + 0x10]
invalid
adc byte [rbx - 0x304bcefb], cl
add dword [rbx], esp
add eax, 0x1cfb42f
shr eax, 2
imul rax, rax, 0x2ae4a00b
shr rax, 0x3b
add eax, 0x889237eb
cmp eax, 0x326f0ad3
jae 0x1400e14c0
mov rcx, r15
call r12
nop word cs:[rax + rax]
mov ebp, dword [0x141ddc8c8]
imul ebp, dword [str.N_J_]
mov rcx, r15
call r12
cmp ebp, 0x260b94ac
je 0x1400e14c0
mov eax, dword [0x141ddc918]
add eax, dword [0x141ddc91c]
imul eax, eax, 0x8cfe2bcf
add eax, 0xc930cb04
and eax, 0x90fe17f9
cmp eax, 0x986bae25
je 0x1400e17d5
jmp 0x1400e17cc
mov eax, dword [0x141ddc8d0]
xor eax, dword [0x141ddc8d4]
imul eax, eax, 0x441fc4ad
add eax, 0x6eba5c57
cmp eax, 0xb546c6dd
jbe 0x1400e1540
movzx eax, byte [rsp + 0x4a]
mov byte [rsi + 3], al
movzx eax, word [rsp + 0x48]
mov word [rsi + 1], ax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm0
nop
movzx eax, byte [rsp + 0x4a]
mov byte [rsi + 3], al
movzx eax, word [rsp + 0x48]
mov word [rsi + 1], ax
mov eax, dword [0x141ddc8d8]
imul eax, dword [0x141ddc8dc]
and eax, 0x7290ce6
add eax, 0x86357fbe
or eax, 0xe7da1e82
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm0
cmp eax, 0xffb692f8
ja 0x1400e1540
test rbx, rbx
je 0x1400e158b
mov rcx, rbx
call qword [sym.imp.oleaut32.dll_SysFreeString]
mov byte [rsi], 0
mov eax, dword [0x141ddc8e0]
xor eax, dword [0x141ddc8e4]
imul eax, eax, 0xe48d133f
imul rax, rax, 0x4440d5fb
shr rax, 0x3e
add eax, 0x8daa018f
cmp eax, 0x988d34b
jb 0x1400e15f0
mov eax, dword [0x141ddc8e8]
and eax, dword [0x141ddc8ec]
imul eax, eax, 0xc2af8f67
add eax, 0x2a094413
imul rcx, rax, 0x1b64e9d9
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
mov dword [rsi + 4], ebp
outsb dx, byte [rsi]
add al, 0x3d
ret
invalid
invalid
or eax, 0x252820f
add byte [rax], al
mov dword [rsi + 4], ebp
jmp 0x1400e15b7
mov eax, dword [0x141ddc838]
xor edx, edx
div dword [0x141ddc83c]
and eax, 0xc809e56a
imul r14d, eax, 0x8f83ec9d
in al, dx
or dword [rdi + 0x26c68141], 0xffffffeb
test eax, 0x44c748bc
and al, 0x50
add byte [rax], al
add byte [rax], al
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
cmp r14d, 0xc0c1554
jae 0x1400e164d
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
jmp 0x1400e15f5
mov r14, qword [rsp + 0x50]
mov eax, dword [0x141ddc840]
or eax, dword [0x141ddc844]
imul eax, eax, 0xadc4bfbf
mov ecx, 0xacaca26f
outsd dx, dword [rsi]
movabs byte [0xc148c8af0f48acac], al
jmp 0xcccf7fb3
sbb byte [rsi + riz*4 + 0x1d55ac3d], bh
invalid
nop dword [rax]
mov eax, dword [0x141ddc848]
xor edx, edx
div dword [0x141ddc84c]
xor eax, 0xe55e18e1
add eax, 0x497282ab
imul rax, rax, 0x45d2b73f
shr rax, 0x39
cmp eax, 0xd36dc9a2
ja 0x1400e1680
test r14, r14
je 0x1400e1507
nop word cs:[rax + rax]
mov eax, dword [0x141ddc850]
imul eax, dword [0x141ddc854]
imul eax, eax, 0x2d0978cb
or eax, 0x65042ea
and eax, 0x4e5ef2eb
cmp eax, 0xe7c24a8e
ja 0x1400e16c0
mov rax, qword [r14]
mov r15, qword [rax + 0x10]
mov eax, dword [0x141ddc858]
imul eax, dword [0x141ddc85c]
xor eax, 0x1000020
or eax, 0x262226d4
and eax, 0x67222ff4
cmp eax, 0x3fa40cb1
jne 0x1400e1714
mov rcx, r14
call r15
mov r12d, 0xae991ee7
nop word [rax + rax]
mov r13d, dword [0x141ddc860]
or r13d, dword [0x141ddc864]
shr r13d, 1
imul r13, r12
shr r13, 0x3d
or r13d, 0xb39e113c
mov rcx, r14
call r15
cmp r13d, 0x6b0d9adb
jb 0x1400e1720
nop
mov eax, dword [0x141ddc868]
xor eax, dword [0x141ddc86c]
imul eax, eax, 0xe999153a
cmp eax, 0xf3efc1b2
je 0x1400e1750
jmp 0x1400e1507
mov eax, dword [0x141ddc900]
xor edx, edx
div dword [0x141ddc904]
mov ecx, 0xb828b9b1
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0x7147f108
mov byte [rsi], 0x12
cmp eax, 0x2eb7079
jbe 0x1400e179e
mov byte [rsi], 0x12
jmp 0x1400e176e
invalid
mov eax, dword [0x141ddc908]
xor edx, edx
div dword [0x141ddc90c]
imul eax, eax, 0x1ec767bb
xor eax, 0xcd126856
add eax, 0xb672e814
cmp eax, 0xa7eff964
ja 0x1400e18b6
invalid
jmp 0x1400e1885
mov byte [rsi], 0
xor eax, eax
test al, al
je 0x1400e17da
mov byte [rsi], 0
jmp 0x1400e17cc
mov eax, dword [0x141ddc920]
or eax, dword [0x141ddc924]
or eax, 0xc218c575
imul eax, eax, 0x2e77e164
add eax, 0xc7bcfdd
cmp eax, 0x1cde8980
jae 0x1400e1810
mov dword [rsi + 4], ebx
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
nop dword [rax]
mov ebp, dword [0x141ddc928]
xor ebp, dword [0x141ddc92c]
and ebp, 0xe10a10de
add ebp, 0x23d0cd4d
xor ebp, 0xd5ae7cd4
mov dword [rsi + 4], ebx
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
cmp ebp, 0x36bf309c
jbe 0x1400e1810
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop dword [rax + rax]
add byte [rax], r8b
mov eax, dword [0x141ddc930]
add eax, dword [0x141ddc934]
imul eax, eax, 0x45cb3a1f
rcr byte [rdi], 0x3a
retf
xor eax, 0xaa106fda
imul eax, eax, 0xd15bb2da
cmp eax, 0x5269da61
je 0x1400e1850
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x141ddc910]
imul eax, dword [0x141ddc914]
mov ecx, 0xe5669031
imul rcx, rax
shr rcx, 0x3d
imul esi, ecx, 0x72b660f8
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
cmp esi, 0x619373c5
ja 0x1400e1874
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
jmp 0x1400e1885