Function at 0x14009dc10
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
movaps xmmword [rsp + 0x140], xmm6
mov rax, qword [0x1401ae6f8]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r15, r8
mov r13, rdx
mov rsi, rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], r8
xor r12d, r12d
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rbx, [r12 - 1]
test eax, eax
jns 0x14009dcd5
mov eax, dword [0x14018fde8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14018fdec]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x3a
xor byte [rsp + 0x52], 0x3b
xor byte [rsp + 0x53], 0x3c
xor al, 0x3d
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009dcb7
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016190
jmp 0x14009e65d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14009dd6e
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x14018fde8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14018fdec]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x3a
xor byte [rsp + 0x52], 0x3b
xor byte [rsp + 0x53], 0x3c
xor al, 0x3d
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009dd50
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016190
jmp 0x14009e65d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x14015c9c0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14015c9d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14009ddfe
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x14018fde8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14018fdec]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x3a
xor byte [rsp + 0x52], 0x3b
xor byte [rsp + 0x53], 0x3c
xor al, 0x3d
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009dde0
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016190
jmp 0x14009e65d
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x18]
movups xmm0, xmmword [str.kuthav_r]
movups xmmword [rsp + 0x60], xmm0
mov ecx, dword [0x14018ff68]
mov dword [rsp + 0x70], ecx
movzx eax, word [0x14018ff6c]
mov edx, 0x52
mov word [rsp + 0x60], dx
xor word [rsp + 0x62], 0x3a
xor word [rsp + 0x64], 0x3b
xor word [rsp + 0x66], 0x3c
xor word [rsp + 0x68], 0x3d
xor word [rsp + 0x6a], 0x3e
xor word [rsp + 0x6c], 0x3f
xor word [rsp + 0x6e], 0x40
xor cx, 0x41
mov word [rsp + 0x70], cx
xor word [rsp + 0x72], 0x42
xor ax, 0x43
mov word [rsp + 0x74], ax
lea ecx, [rdx - 0x3a]
call fcn.140127a24
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14009deb7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14009e6a6
jmp 0x14009deba
mov rdi, r12
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x14009e6c7
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x50]
call r14
mov r14d, eax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14009df34
mov rcx, qword [rdi]
test rcx, rcx
je 0x14009df15
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14009df27
call fcn.140127cb0
mov qword [rdi + 8], r12
mov edx, Ordinal_26
mov rcx, rdi
call fcn.140127cb0
test r14d, r14d
jns 0x14009dfa5
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x14018fde8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14018fdec]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x3a
xor byte [rsp + 0x52], 0x3b
xor byte [rsp + 0x53], 0x3c
xor al, 0x3d
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009df87
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016190
jmp 0x14009e65d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14009e04e
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x14018fde8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14018fdec]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x3a
xor byte [rsp + 0x52], 0x3b
xor byte [rsp + 0x53], 0x3c
xor al, 0x3d
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x50]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009e030
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016190
jmp 0x14009e65d
mov qword [rbp - 0x48], r12
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0xa0]
mov qword [rsp + 0x78], rax
mov r14, r13
cmp qword [r13 + 0x18], 0x10
jb 0x14009e073
mov r14, qword [r13]
mov ecx, Ordinal_26
call fcn.140127a24
mov rdi, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x14009e0ad
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
mov rcx, r14
call fcn.1401275f0
mov qword [rdi], rax
jmp 0x14009e0b0
mov rdi, r12
mov qword [rbp - 0x78], rdi
test rdi, rdi
je 0x14009e6d2
mov r12, qword [rdi]
mov eax, dword [str.nkw_]
mov dword [rsp + 0x58], eax
cmp byte [reloc.WLDAP32.dll_Ordinal_60], 0
je 0x14009e1b3
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14009e176
movdqa xmm3, xmmword [0x1401906d0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140190a10]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140190a10]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
mov ecx, 5
movd xmm0, ecx
psrad xmm2, xmm0
mov ecx, Ordinal_33
movd xmm0, ecx
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1401907c0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401908d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140190950]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x58], xmm2
jmp 0x14009e1b3
lea r9, [rsp + 0x58]
xor r8d, r8d
nop
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
sub al, cl
add al, 0x39
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x14009e180
mov ecx, Ordinal_26
call fcn.140127a24
mov r14, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14009e1f1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rax
mov qword [r14 + 8], rax
mov dword [r14 + 0x10], 1
lea rcx, [rsp + 0x58]
call fcn.1401275f0
mov qword [r14], rax
jmp 0x14009e1f4
xor r14d, r14d
mov qword [rbp - 0x70], r14
test r14, r14
je 0x14009e6dd
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, Ordinal_50
mov r8, r12
mov rdx, qword [r14]
mov rcx, qword [rbp - 0x58]
call qword [rsp + 0x78]
mov r12d, eax
mov ecx, ebx
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x14009e270
mov rcx, qword [r14]
test rcx, rcx
je 0x14009e24c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14009e262
call fcn.140127cb0
mov qword [r14 + 8], 0
mov edx, Ordinal_26
mov rcx, r14
call fcn.140127cb0
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14009e2b4
mov rcx, qword [rdi]
test rcx, rcx
je 0x14009e291
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14009e2a7
call fcn.140127cb0
mov qword [rdi + 8], 0
mov edx, Ordinal_26
mov rcx, rdi
call fcn.140127cb0
test r12d, r12d
jns 0x14009e331
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x14018fde8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14018fdec]
mov byte [rsp + 0x50], Ordinal_79
xor byte [rsp + 0x51], 0x3a
xor byte [rsp + 0x52], 0x3b
xor byte [rsp + 0x53], 0x3c
xor al, 0x3d
mov byte [rsp + 0x54], al
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
lea rax, [rsp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009e313
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016190
jmp 0x14009e65d
xor r8d, r8d
mov qword [rbp - 0x40], r8
mov dword [rbp - 0x10], r8d
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movdqa xmm6, xmmword [0x140190690]
movdqu xmmword [rbp + 0x28], xmm6
mov byte [rbp + 0x18], r8b
cmp qword [r15 + 0x18], 0x10
jb 0x14009e367
mov r12, qword [r15]
mov r14, r12
add r12, qword [r15 + 0x10]
jmp 0x14009e371
mov r12, qword [r15 + 0x10]
add r12, r15
mov r14, r15
movups xmmword [rbp - 8], xmm0
mov edi, 7
mov qword [rbp + 0x10], rdi
cmp r14, r12
jne 0x14009e394
xor r12d, r12d
mov qword [rbp + 8], r12
mov word [rbp - 8], r12w
jmp 0x14009e4a4
mov rax, r12
sub rax, r14
mov rdx, r8
mov qword [rbp + 8], rdx
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x14009e6e8
cmp rax, 8
jb 0x14009e460
mov rdi, rax
or rdi, 7
cmp rdi, rcx
jbe 0x14009e3cf
mov rdi, rcx
jmp 0x14009e3dc
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
mov rax, rdi
add rax, 1
cmovb rax, rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x14009e6a0
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x14009e43d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14009e6a0
mov rcx, rax
call fcn.140127a24
mov rcx, rax
test rax, rax
je 0x14009e436
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rbp + 8]
jmp 0x14009e450
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14009e44d
call fcn.140127a24
mov rdx, qword [rbp + 8]
jmp 0x14009e450
mov rax, r8
mov qword [rbp - 8], rax
mov qword [rbp + 0x10], rdi
nop dword [rax + rax]
lea rcx, [rbp - 8]
cmp rdi, 8
cmovae rcx, qword [rbp - 8]
movsx eax, byte [r14]
mov word [rcx + rdx*2], ax
mov rdx, qword [rbp + 8]
inc rdx
mov qword [rbp + 8], rdx
inc r14
cmp r14, r12
je 0x14009e48e
mov rdi, qword [rbp + 0x10]
jmp 0x14009e460
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rax, qword [rbp - 8]
xor r12d, r12d
mov word [rax + rdx*2], r12w
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14009e609
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
mov r8d, 1
mov edx, ebx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 0x10], 0
je 0x14009e604
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x28]
xor r8d, r8d
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x14009e5ed
mov r14, qword [rbp - 0x20]
mov ecx, Ordinal_26
call fcn.140127a24
mov rdi, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14009e563
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x14009e566
test r14, r14
jne 0x14009e6b1
jmp 0x14009e566
mov rdi, r12
mov qword [rbp - 0x60], rdi
test rdi, rdi
je 0x14009e6bc
mov rax, qword [rdi + 8]
test rax, rax
jne 0x14009e588
mov rcx, qword [rdi]
call fcn.1401274d0
mov qword [rdi + 8], rax
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009e590
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140015f60
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14009e5e3
mov rcx, qword [rdi]
test rcx, rcx
je 0x14009e5c4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14009e5d6
call fcn.140127cb0
mov qword [rdi + 8], r12
mov edx, Ordinal_26
mov rcx, rdi
call fcn.140127cb0
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x14009e4c0
movdqu xmm6, xmmword [rbp + 0x28]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm6
movdqa xmm0, xmmword [0x140190690]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
lea rcx, [rbp - 8]
call fcn.1400a21a0
nop
lea rcx, [rbp + 0x18]
call fcn.14000d000
nop
mov rcx, r13
call fcn.14000d000
nop
mov rcx, r15
call fcn.14000d000
mov rax, rsi
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140127920
mov rbx, qword [rsp + 0x1a8]
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000c0a0
nop
mov ecx, 0x8007000e
call fcn.1401274c0
nop
mov ecx, 0x8007000e
call fcn.1401274c0
nop
mov ecx, 0x8007000e
call fcn.1401274c0
nop
mov ecx, 0x8007000e
call fcn.1401274c0
int3
mov ecx, 0x8007000e
call fcn.1401274c0
nop
mov ecx, 0x8007000e
call fcn.1401274c0
nop
call fcn.14000d580
int3