Function at 0x140134470
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x10], rcx
mov eax, dword [0x14022a3e8]
mov ecx, dword [0x14022a3ec]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
add eax, 0xc65cd501
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x7680c25
and ecx, 0xf897f3da
imul ecx, edx
mov edx, eax
and edx, 0xf897f3da
or eax, 0xf897f3da
imul eax, edx
add eax, ecx
cmp eax, 0xe3ef83f4
jne 0x140134530
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x14022a3f0]
xor edx, edx
div dword [0x14022a3f4]
mov ecx, eax
add ecx, 0xbe8a18fa
mov eax, ecx
or eax, 0x54e2b53a
mov edx, ecx
not edx
and edx, 0x29044844
mov r8d, eax
and r8d, 0xc2bb93b1
imul r8d, edx
and eax, 0x3d446c4e
or ecx, 0x7de6fd7e
imul ecx, eax
add ecx, r8d
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r15, rsp
cmp ecx, 0x1c49554f
jb 0x140134530
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x18], rdx
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov qword [rbp - 0x28], rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov qword [rbp - 0x20], rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov qword [rbp - 8], rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov qword [rbp], rsp
mov eax, dword [0x14022a3f8]
mov ecx, dword [0x14022a3fc]
mov edx, eax
xor edx, ecx
not edx
or eax, ecx
and eax, edx
add eax, 0x7ab16998
imul rax, rax, 0x498a86c7
shr rax, 0x3e
cmp eax, 0xa076c640
jbe 0x14013467c
mov qword [r12], 0
sub rsp, 0x30
mov qword [rsp + 0x20], r12
lea rcx, [0x140207914]
lea r9, [0x1402078f8]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
lea r14, [0x1402078f8]
mov rbx, qword [sym.imp.ole32.dll_CoCreateInstance]
nop word [rax + rax]
mov eax, dword [0x14022a400]
xor edx, edx
div dword [0x14022a404]
mov esi, eax
mov qword [r12], 0
sub rsp, 0x30
mov qword [rsp + 0x20], r12
lea rcx, [0x140207914]
xor edx, edx
mov r8d, 1
mov r9, r14
call rbx
add rsp, 0x30
cmp esi, 0x886b94db
je 0x140134690
mov edi, eax
test eax, eax
js 0x140134844
nop dword [rax + rax]
mov eax, dword [0x14022a408]
mov ecx, dword [0x14022a40c]
not eax
not ecx
or ecx, eax
not ecx
or ecx, 0x9cdd5ff0
imul eax, ecx, 0x79df20eb
xor eax, 0x900f4b64
cmp eax, 0x8a6303f4
je 0x1401346e0
mov rdi, qword [r12]
mov r13, qword [rbp - 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x14022a410]
imul eax, dword [0x14022a414]
or eax, 0x44ec7b6b
mov ecx, eax
xor ecx, 0x16d2c43e
and ecx, eax
mov eax, ecx
and eax, 0xfb178c94
xor eax, 0x2513110b
and ecx, 0x213b2240
or ecx, eax
cmp ecx, 0x1c90115c
jb 0x140134720
test rdi, rdi
je 0x1401347c0
sub rsp, 0x20
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
call fcn.140151280
add rsp, 0x20
mov r14, rax
mov qword [r15], 0
mov rax, qword [rdi]
mov rsi, qword [rax + 0x18]
mov eax, dword [0x14022a448]
xor edx, edx
div dword [0x14022a44c]
add eax, 0xc3c56e37
or eax, 0x8f0db531
imul eax, eax, 0x260b74c4
cmp eax, 0x84af6b09
jne 0x1401349bf
jmp 0x1401349fb
mov eax, dword [0x14022a418]
mov ecx, dword [0x14022a41c]
mov edx, eax
and edx, ecx
or eax, ecx
add eax, edx
imul rcx, rax, 0xa3ef119
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0x899a9c21
add eax, 0x8a068702
cmp eax, 0x7f89f86d
jb 0x1401347c0
nop word [rax + rax]
mov eax, dword [0x14022a420]
mov ecx, dword [0x14022a424]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
add eax, 0x81232823
or eax, 0x12e777c7
cmp eax, 0x9bd5be40
jbe 0x140134800
xor edi, edi
jmp 0x140134957
mov eax, dword [0x14022a428]
and eax, dword [0x14022a42c]
cmp eax, 0x95867309
je 0x140134879
mov qword [r13], 0
sub rsp, 0x20
xor esi, esi
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
test sil, sil
je 0x140134896
mov qword [r13], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
jmp 0x140134857
mov rbx, qword [r13]
nop word [rax + rax]
mov eax, dword [0x14022a430]
and eax, dword [0x14022a434]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x87f81b3
and ecx, 0xf7807e4c
imul ecx, edx
mov edx, eax
and edx, 0xf7807e4c
or eax, 0xf7807e4c
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0x372a9be5
xor eax, 0x570de913
and ecx, 0x1fd88d09
add ecx, ecx
sub ecx, eax
cmp ecx, 0x398aa957
jb 0x1401348a0
test rbx, rbx
mov r13, qword [rbp - 0x10]
je 0x140134957
nop dword [rax + rax]
mov eax, dword [0x14022a438]
xor edx, edx
div dword [0x14022a43c]
add eax, 0x8d1628a8
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x6feed96a
and ecx, 0x90112695
imul ecx, edx
mov edx, eax
and edx, 0x90112695
or eax, 0x90112695
imul eax, edx
add eax, ecx
not eax
or eax, 0x1778a784
cmp eax, 0xf3a7bf8f
je 0x140134900
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
xor eax, eax
test al, al
je 0x140134985
jmp 0x1401349b0
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp]
movzx eax, byte [rcx + 2]
mov byte [r13 + 3], al
movzx eax, word [rcx]
mov word [r13 + 1], ax
movups xmm0, xmmword [rdx]
movups xmmword [r13 + 0x10], xmm0
mov byte [r13], 0
mov dword [r13 + 4], edi
jmp 0x1401355fb
mov r14d, dword [0x14022a440]
sub r14d, dword [0x14022a444]
or r14d, 0x8df12848
sub rsp, 0x20
mov rcx, rbx
call rsi
add rsp, 0x20
cmp r14d, 0xfbfd641e
jne 0x140134957
sub rsp, 0x20
mov rcx, rbx
call rsi
add rsp, 0x20
jmp 0x140134985
sub rsp, 0x50
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
xor r12d, r12d
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call rsi
add rsp, 0x50
test r12b, r12b
je 0x140134a31
sub rsp, 0x50
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call rsi
add rsp, 0x50
jmp 0x1401349bf
mov ebx, eax
nop word cs:[rax + rax]
mov eax, dword [0x14022a450]
add eax, dword [0x14022a454]
xor eax, 0x61feee16
cmp eax, 0xc33426ad
je 0x140134a40
test ebx, ebx
mov r12, qword [rbp - 0x40]
js 0x140134cce
mov rbx, qword [r15]
mov eax, 0xa2598587
nop dword [rax]
mov ecx, dword [0x14022a458]
and ecx, dword [0x14022a45c]
mov edx, ecx
xor edx, 0x263ae97e
xor ecx, 0x99c41201
and ecx, 0xbbfedb51
mov r8d, edx
and r8d, 0x440124ae
imul r8d, ecx
mov ecx, edx
and ecx, 0xbbfedb51
or edx, 0xbbfedb51
imul edx, ecx
add edx, r8d
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0x119ba68a
je 0x140134a70
test rbx, rbx
je 0x140134c40
nop dword [rax + rax]
mov eax, dword [0x14022a498]
xor edx, edx
div dword [0x14022a49c]
imul eax, eax, 0xbf5d846e
mov ecx, eax
not ecx
or ecx, 0xdbba4a2
or eax, 0x290cf254
and eax, ecx
and eax, 0x2dbff6f6
cmp eax, 0x21d78e4c
ja 0x140134ad0
test r14, r14
je 0x140134c02
mov eax, dword [0x14022a4a0]
sub eax, dword [0x14022a4a4]
add eax, 0x77c3e93c
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x2b36f8e4
and ecx, 0xd4c9071b
imul ecx, edx
mov edx, eax
and edx, 0xd4c9071b
or eax, 0xd4c9071b
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x49ac1def
and ecx, 0xb653e210
imul ecx, edx
mov edx, eax
and edx, 0xb653e210
or eax, 0xb653e210
imul eax, edx
add eax, ecx
cmp eax, 0x504aa8b
jne 0x140134b81
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.oleaut32.dll_SysFreeString]
add rsp, 0x20
mov rsi, qword [sym.imp.oleaut32.dll_SysFreeString]
nop dword [rax + rax]
mov eax, dword [0x14022a4a8]
add eax, dword [0x14022a4ac]
mov r15d, eax
and r15d, 0x1eca1e18
and eax, 0x1c0a0000
add eax, eax
sub r15d, eax
add r15d, 0x5d2fc164
and r15d, 0x25e65478
sub rsp, 0x20
mov rcx, r14
call rsi
add rsp, 0x20
cmp r15d, 0x245610d4
ja 0x140134b90
nop word cs:[rax + rax]
mov eax, dword [0x14022a4b0]
mov ecx, dword [0x14022a4b4]
not eax
not ecx
and ecx, eax
not ecx
and ecx, 0x91538539
cmp ecx, 0xc2e09c18
je 0x140134be0
mov eax, dword [0x14022a4bc]
add eax, dword [0x14022a4b8]
and eax, 0x420682ee
mov ecx, 0x89911679
imul rcx, rax
shr rcx, 0x3d
mov eax, ecx
xor eax, 0xb4f434e7
add eax, ecx
cmp eax, 0xcc8f6c04
jne 0x14013506e
jmp 0x1401350b2
mov eax, dword [0x14022a460]
or eax, dword [0x14022a464]
add eax, 0xb7f9550d
mov ecx, eax
not ecx
and ecx, 0x658014a6
and eax, 0x9a7feb59
sub eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xab615d98
and ecx, 0x549ea267
imul ecx, edx
mov edx, eax
and edx, 0x549ea267
or eax, 0x549ea267
imul eax, edx
add eax, ecx
cmp eax, 0x2fa1a146
ja 0x140134c40
mov eax, dword [0x14022a468]
mov ecx, dword [0x14022a46c]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
mov ecx, eax
not ecx
or ecx, 0x1b80008
or eax, 0x4042055
and eax, ecx
or eax, 0xfa43dfa2
add eax, 0x941c96dd
cmp eax, 0x5c155085
jb 0x140134c90
xor ebx, ebx
jmp 0x140134e46
mov eax, dword [0x14022a470]
xor edx, edx
div dword [0x14022a474]
add eax, 0x57e9b3dd
cmp eax, 0x7fa6c222
jbe 0x140134d10
mov qword [r12], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x14022a478]
or eax, dword [0x14022a47c]
mov esi, eax
not esi
or eax, 0x2de64c7
or esi, 0x85e7499d
and esi, eax
and esi, 0x87ff6ddf
mov qword [r12], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r12
call fcn.14014ee70
add rsp, 0x20
cmp esi, 0x7ab0a28b
je 0x140134d10
mov r15, qword [r12]
mov eax, 0x944f0eed
nop
mov ecx, dword [0x14022a480]
and ecx, dword [0x14022a484]
xor ecx, 0x9929bf8c
imul rcx, rax
shr rcx, 0x3e
mov edx, ecx
and edx, 1
add edx, edx
sub ecx, edx
cmp ecx, 0xb6b19a12
je 0x140134d60
test r15, r15
je 0x140134e46
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140134da0
mov rax, qword [r15]
mov rsi, qword [rax + 0x10]
mov eax, dword [0x14022a488]
mov ecx, dword [0x14022a48c]
mov edx, eax
not edx
mov r8d, ecx
not r8d
mov r9d, edx
and r9d, 0xfb2f44c7
and eax, 0x4d0bb38
or eax, r9d
or edx, r8d
and r8d, 0xfb2f44c7
and ecx, 0x4d0bb38
or ecx, r8d
xor ecx, eax
not edx
or edx, ecx
xor edx, 0x258410fd
add edx, 0x4f8563b
cmp edx, 0xf71e298a
jbe 0x140134e10
sub rsp, 0x20
mov rcx, r15
call rsi
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x14022a490]
xor edx, edx
div dword [0x14022a494]
imul r12, rax, 0x4f8dff57
shr r12, 0x3d
or r12d, 0x7c9d6d78
sub rsp, 0x20
mov rcx, r15
call rsi
add rsp, 0x20
cmp r12d, 0x6015a017
je 0x140134e10
mov eax, dword [0x14022a4e0]
xor edx, edx
div dword [0x14022a4e4]
mov ecx, eax
not ecx
and ecx, 0xcfd0e1a3
mov edx, eax
and edx, 0x302f1e5c
imul edx, ecx
mov ecx, eax
and ecx, 0xcfd0e1a3
or eax, 0xcfd0e1a3
imul eax, ecx
add eax, edx
mov ecx, eax
not ecx
or ecx, 0x5c78c0bf
lea edx, [rcx + rax]
inc edx
add eax, ecx
not edx
or edx, 0xd23a5ec1
add eax, edx
inc eax
cmp eax, 0x496fbc5b
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
je 0x140134edc
movzx eax, byte [rcx + 2]
mov byte [r13 + 3], al
movzx eax, word [rcx]
mov word [r13 + 1], ax
mov eax, dword [0x14022a4e8]
sub eax, dword [0x14022a4ec]
add eax, 0xfe733ad9
and eax, 0x10426011
movups xmm0, xmmword [rdx]
movups xmmword [r13 + 0x10], xmm0
cmp eax, 0xab9b6465
jbe 0x140134ef6
movzx eax, byte [rcx + 2]
mov byte [r13 + 3], al
movzx eax, word [rcx]
mov word [r13 + 1], ax
movups xmm0, xmmword [rdx]
movups xmmword [r13 + 0x10], xmm0
jmp 0x140134ea7
test r14, r14
je 0x140134f0c
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.oleaut32.dll_SysFreeString]
add rsp, 0x20
mov eax, dword [0x14022a4f0]
and eax, dword [0x14022a4f4]
mov ecx, eax
not ecx
or ecx, 0xd49092c4
add eax, ecx
inc eax
imul rax, rax, 0xdda8233
shr rax, 0x39
mov ecx, eax
and ecx, 3
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x576b4ebb
cmp eax, 0xabd32c4d
ja 0x140134f80
mov eax, dword [0x14022a4f8]
mov ecx, dword [0x14022a4fc]
mov edx, eax
xor edx, ecx
not edx
or eax, ecx
and eax, edx
mov ecx, eax
not ecx
and ecx, 0xe55ac584
and eax, 0x1aa53a7b
sub eax, ecx
add eax, 0xee0fe811
mov byte [r13], 0
cmp eax, 0xaf5e94e8
jbe 0x140134f87
mov byte [r13], 0
jmp 0x140134f48
mov eax, dword [0x14022a500]
xor edx, edx
div dword [0x14022a504]
nop word cs:[rax + rax]
mov eax, dword [0x14022a508]
mov ecx, dword [0x14022a50c]
mov edx, eax
and edx, ecx
add edx, edx
add eax, ecx
sub eax, edx
mov ecx, eax
not ecx
and ecx, 0xb16a006d
and eax, 0x4e95ff92
sub eax, ecx
mov ecx, eax
not ecx
or ecx, 0x4640aea7
lea edx, [rax + rcx]
inc edx
add eax, ecx
mov ecx, edx
and ecx, 0xd150257
xor edx, 0xf2eafda8
add eax, edx
inc eax
sub eax, ecx
cmp eax, 0x8954efe3
jb 0x140134fa0
mov eax, dword [0x14022a510]
xor edx, edx
div dword [0x14022a514]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x33252e22
and ecx, 0xccdad1dd
imul ecx, edx
mov edx, eax
and edx, 0xccdad1dd
or eax, 0xccdad1dd
imul eax, edx
add eax, ecx
add eax, 0x390ca10f
mov ecx, eax
and ecx, 0x6983439
add ecx, ecx
sub eax, ecx
cmp eax, 0xa3b45c8e
je 0x140135068
mov eax, dword [0x14022a518]
xor edx, edx
div dword [0x14022a51c]
imul eax, eax, 0x80c934fa
add eax, 0x91f91e10
mov dword [r13 + 4], ebx
cmp eax, 0x5940b160
jbe 0x140135503
mov dword [r13 + 4], ebx
jmp 0x140135040
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor esi, esi
mov rcx, rbx
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
add rsp, 0x40
test sil, sil
je 0x1401350f3
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call fcn.1401512d0
add rsp, 0x40
jmp 0x14013506e
mov r14d, eax
test eax, eax