Function at 0x140001020
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edi, edi
mov dword [rbp - 0x11], 0x7b60607d
mov qword [rbp - 1], rdi
mov ebx, edi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], rdi
mov byte [rbp - 9], dil
mov dword [rbp - 0xd], 0x46425853
mov r14d, ebx
inc ebx
cmp byte [rbp + rbx - 0x11], dil
jne 0x140001071
lea ecx, [rbx*2 + 2]
call fcn.140001850
mov rsi, rax
mov edx, edi
test ebx, ebx
je 0x1400010d5
lea r9, [rbp - 0x11]
nop word [rax + rax]
movzx ecx, byte [r9]
lea r8d, [rdx + rdx]
xor cl, 0xf
lea eax, [r8 + 1]
mov byte [r8 + rsi], cl
mov byte [rax + rsi], dil
cmp edx, r14d
jne 0x1400010cc
lea eax, [r8 + 2]
mov byte [rax + rsi], dil
lea eax, [r8 + 3]
mov byte [rax + rsi], dil
inc edx
inc r9
cmp edx, ebx
jb 0x1400010a0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400014f7
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov dword [rsp + 0x28], 3
lea edx, [r9 - 1]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x1400014f1
xor edx, edx
lea rax, [rbp + 7]
lea r9, [0x1400178e0]
mov qword [rsp + 0x20], rax
lea rcx, [0x140010390]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400014f1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x1400011a7
mov rcx, qword [rbp + 7]
lea rax, [rbp - 1]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rbx
mov r10, qword [rcx]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x18]
mov rcx, rbx
test eax, eax
jns 0x1400011a1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 7]
jmp 0x1400014eb
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 1]
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x1400011eb
mov rcx, qword [rbp - 1]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 7]
jmp 0x1400014eb
mov dword [rbp + 0x1f], 0x4a434a5c
mov ebx, edi
mov dword [rbp + 0x23], 0x252f5b4c
mov dword [rbp + 0x27], 0x405d492f
mov dword [rbp + 0x2b], 0x5c422f42
mov dword [rbp + 0x2f], 0x667f6c4e
mov dword [rbp + 0x33], 0x6a675b50
mov dword [rbp + 0x37], 0x636e627d
mov dword [rbp + 0x3b], 0x6a616055
mov dword [rbp + 0x3f], 0x7f626a5b
mov dword [rbp + 0x43], 0x7b6e7d6a
mov dword [rbp + 0x47], 0x6a7d7a
nop word [rax + rax]
mov r14d, ebx
inc ebx
cmp byte [rbp + rbx + 0x1f], dil
jne 0x140001240
lea ecx, [rbx*2 + 2]
call fcn.140001850
mov rsi, rax
mov r8d, edi
test ebx, ebx
je 0x1400012a7
lea r9, [rbp + 0x1f]
nop word [rax + rax]
movzx edx, byte [r9]
lea r10d, [r8 + r8]
xor dl, 0xf
lea eax, [r10 + 1]
mov byte [r10 + rsi], dl
mov byte [rax + rsi], dil
cmp r8d, r14d
jne 0x14000129c
lea eax, [r10 + 2]
mov byte [rax + rsi], dil
lea eax, [r10 + 3]
mov byte [rax + rsi], dil
inc r8d
inc r9
cmp r8d, ebx
jb 0x140001270
mov dword [rbp + 0x17], 0x435e58
mov ebx, edi
mov r14d, ebx
inc ebx
cmp byte [rbp + rbx + 0x17], dil
jne 0x1400012b0
lea ecx, [rbx*2 + 2]
call fcn.140001850
mov r11, rax
mov r8d, edi
test ebx, ebx
je 0x140001317
lea r9, [rbp + 0x17]
nop word [rax + rax]
movzx edx, byte [r9]
lea r10d, [r8 + r8]
xor dl, 0xf
lea eax, [r10 + 1]
mov byte [r10 + r11], dl
mov byte [rax + r11], dil
cmp r8d, r14d
jne 0x14000130c
lea eax, [r10 + 2]
mov byte [rax + r11], dil
lea eax, [r10 + 3]
mov byte [rax + r11], dil
inc r8d
inc r9
cmp r8d, ebx
jb 0x1400012e0
mov rcx, r11
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, rsi
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, 1
mov rbx, rax
test r14, r14
je 0x14000138d
test rax, rax
je 0x140001384
mov rcx, qword [rbp - 1]
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
lea r9d, [rsi + 0x2f]
mov r8, rbx
mov qword [rsp + 0x20], rdi
mov rdx, r14
mov r10, qword [rcx]
call qword [r10 + 0xa0]
test eax, eax
jns 0x140001384
mov rcx, qword [rbp - 1]
mov esi, edi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 7]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x14000139b
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
je 0x1400014f7
mov rcx, qword [rbp + 0xf]
mov qword [rbp - 0x11], rdi
mov dword [rbp + 0x17], edi
test rcx, rcx
je 0x1400014d3
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x17]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x11]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0x17], edi
je 0x1400014ce
mov dword [rbp - 0x29], 0x7d7d7a4c
mov ebx, edi
mov dword [rbp - 0x25], 0x5b7b616a
mov dword [rbp - 0x21], 0x6a7f626a
mov dword [rbp - 0x1d], 0x7a7b6e7d
mov word [rbp - 0x19], 0x6a7d
mov byte [rbp - 0x17], dil
nop dword [rax]
mov esi, ebx
inc ebx
cmp byte [rbp + rbx - 0x29], dil
jne 0x140001410
lea ecx, [rbx*2 + 2]
call fcn.140001850
mov r11, rax
mov r8d, edi
test ebx, ebx
je 0x140001477
lea r9, [rbp - 0x29]
nop word [rax + rax]
movzx edx, byte [r9]
lea r10d, [r8 + r8]
xor dl, 0xf
lea eax, [r10 + 1]
mov byte [r10 + r11], dl
mov byte [rax + r11], dil
cmp r8d, esi
jne 0x14000146c
lea eax, [r10 + 2]
mov byte [rax + r11], dil
lea eax, [r10 + 3]
mov byte [rax + r11], dil
inc r8d
inc r9
cmp r8d, ebx
jb 0x140001440
mov rcx, qword [rbp - 0x11]
lea r9, [rbp + 0x1f]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov rdx, r11
mov qword [rsp + 0x20], rdi
mov rax, qword [rcx]
call qword [rax + 0x20]
lea rcx, [rbp + 0x1f]
test eax, eax
jns 0x1400014bc
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
jne 0x1400013c0
jmp 0x1400014d3
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400014d3
mov edi, 1
mov rcx, qword [rbp - 1]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 7]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xf]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140001830
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret