Function at 0x1400c5440
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
lea rbp, [rax - 0x38]
sub rsp, 0x120
movaps xmmword [rax - 0x38], xmm6
lea r9, [0x140122628]
movaps xmmword [rax - 0x48], xmm7
xor edx, edx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
movaps xmmword [rax - 0x58], xmm8
lea rcx, [0x140122618]
movaps xmmword [rax - 0x68], xmm9
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov r9d, eax
test eax, eax
jns 0x1400c5687
movups xmm0, xmmword [0x14011f020]
xor ebx, ebx
cmp dword [0x1402557d0], 2
movups xmm1, xmmword [0x14011f030]
movzx eax, word [0x14011f074]
mov ecx, dword [0x14011f070]
movups xmmword [rsp + 0x66], xmm0
mov dword [rbp - 0x4a], ecx
movups xmm0, xmmword [0x14011f040]
movups xmmword [rbp - 0x7a], xmm0
mov word [rbp - 0x46], ax
movups xmm0, xmmword [0x14011f060]
movups xmmword [rsp + 0x76], xmm1
movups xmm1, xmmword [0x14011f050]
movups xmmword [rbp - 0x5a], xmm0
movups xmmword [rbp - 0x6a], xmm1
jl 0x1400c5626
movdqa xmm5, xmmword [0x140118390]
lea rcx, [rsp + 0x66]
movdqa xmm4, xmmword [0x1401183f0]
mov eax, 5
movdqa xmm7, xmmword [0x1401183b0]
movdqa xmm9, xmmword [0x1401183c0]
movd xmm6, eax
mov eax, 0x1f
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add ebx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp ebx, 0x28
jl 0x1400c5530
cmp ebx, 0x2b
jge 0x1400c5673
movsxd rax, ebx
lea r8, [rsp + 0x66]
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 2]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, bx
inc ebx
sub ax, cx
add ax, 0x31
xor word [r8 - 2], ax
cmp ebx, 0x2b
jl 0x1400c5640
mov edx, r9d
lea rcx, [rsp + 0x66]
call fcn.1400ad210
xor al, al
jmp 0x1400c59eb
movups xmm0, xmmword [0x14011f078]
mov qword [rsp + 0x148], rdi
mov ecx, 0x52
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x110], r15
mov r15, qword [rsi]
mov rax, qword [r15]
movups xmmword [rsp + 0x50], xmm0
xor word [rsp + 0x52], 0x32
xor word [rsp + 0x54], 0x33
mov r12, qword [rax + 0x18]
mov eax, dword [0x14011f088]
xor word [rsp + 0x56], 0x34
xor word [rsp + 0x58], 0x35
xor word [rsp + 0x5a], 0x36
xor word [rsp + 0x5c], 0x37
xor word [rsp + 0x5e], 0x38
mov dword [rsp + 0x60], eax
movzx eax, word [0x14011f08c]
xor word [rsp + 0x60], 0x39
xor ax, 0x3b
xor word [rsp + 0x62], 0x3a
mov word [rsp + 0x50], cx
mov ecx, 0x18
mov word [rsp + 0x64], ax
call fcn.1400e8b94
mov rdi, rax
test rax, rax
je 0x1400c5c35
xor ebx, ebx
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x50]
mov qword [rax + 8], rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1400c5c35
mov qword [rsp + 0x118], r14
xor r9d, r9d
lea r14, [rsi + 8]
xor r8d, r8d
mov qword [rsp + 0x40], r14
mov rdx, rax
mov qword [rsp + 0x38], rbx
mov rcx, r15
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call r12
test eax, eax
mov r15d, eax
mov ecx, 0xffffffff
sets r12b
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1400c57c4
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400c57a5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400c57b7
call fcn.1400e8bd0
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.1400e8bd0
test r12b, r12b
je 0x1400c5a0e
cmp dword [0x1402557d0], 2
movups xmm0, xmmword [str.r_FXQ]
movups xmm1, xmmword [0x14011f0a0]
mov eax, dword [0x14011f0e8]
movups xmmword [rsp + 0x66], xmm0
mov dword [rbp - 0x42], eax
movups xmm0, xmmword [0x14011f0b0]
movzx eax, word [0x14011f0ec]
movups xmmword [rsp + 0x76], xmm1
mov word [rbp - 0x3e], ax
movups xmm1, xmmword [0x14011f0c0]
movups xmmword [rbp - 0x7a], xmm0
movups xmm0, xmmword [0x14011f0d0]
movups xmmword [rbp - 0x6a], xmm1
movsd xmm1, qword [0x14011f0e0]
movups xmmword [rbp - 0x5a], xmm0
movsd qword [rbp - 0x4a], xmm1
jl 0x1400c5966
movdqa xmm5, xmmword [0x140118390]
lea rcx, [rsp + 0x66]
movdqa xmm4, xmmword [0x1401183f0]
mov eax, 5
movdqa xmm7, xmmword [0x1401183b0]
movdqa xmm9, xmmword [0x1401183c0]
movd xmm6, eax
mov eax, 0x1f
movd xmm8, eax
nop dword [rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add ebx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp ebx, 0x28
jl 0x1400c5870
cmp ebx, 0x2f
jge 0x1400c59b3
movsxd rax, ebx
lea r8, [rsp + 0x66]
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 2]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, bx
inc ebx
sub ax, cx
add ax, 0x31
xor word [r8 - 2], ax
cmp ebx, 0x2f
jl 0x1400c5980
mov edx, r15d
lea rcx, [rsp + 0x66]
call fcn.1400ad210
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor al, al
mov r14, qword [rsp + 0x118]
mov r12, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x148]
mov r15, qword [rsp + 0x110]
lea r11, [rsp + 0x120]
movaps xmm6, xmmword [r11 - 0x20]
movaps xmm7, xmmword [r11 - 0x30]
movaps xmm8, xmmword [r11 - 0x40]
movaps xmm9, xmmword [r11 - 0x50]
mov rsp, r11
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [r14]
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov r9d, eax
test eax, eax
jns 0x1400c5c2e
cmp dword [0x1402557d0], 2
movups xmm0, xmmword [0x14011f0f0]
movups xmm1, xmmword [0x14011f100]
mov ecx, dword [0x14011f130]
movups xmmword [rsp + 0x66], xmm0
mov dword [rbp - 0x5a], ecx
movups xmm0, xmmword [0x14011f110]
movups xmmword [rsp + 0x76], xmm1
movups xmm1, xmmword [0x14011f120]
movups xmmword [rbp - 0x7a], xmm0
movups xmmword [rbp - 0x6a], xmm1
jl 0x1400c5bc6
movdqa xmm5, xmmword [0x140118390]
lea rcx, [rsp + 0x66]
movdqa xmm4, xmmword [0x1401183f0]
mov eax, 5
movdqa xmm7, xmmword [0x1401183b0]
movdqa xmm9, xmmword [0x1401183c0]
movd xmm6, eax
mov eax, 0x1f
movd xmm8, eax
nop dword [rax]
nop word [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add ebx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp ebx, 0x20
jl 0x1400c5ad0
cmp ebx, 0x22
jge 0x1400c5c13
movsxd rax, ebx
lea r8, [rsp + 0x66]
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 2]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, bx
inc ebx
sub ax, cx
add ax, 0x31
xor word [r8 - 2], ax
cmp ebx, 0x22
jl 0x1400c5be0
mov edx, r9d
lea rcx, [rsp + 0x66]
call fcn.1400ad210
mov rcx, qword [r14]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1400c59c0
mov al, 1
jmp 0x1400c59cb
mov ecx, 0x8007000e
call fcn.1400e9b90
int3