Function at 0x140006100
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push rbp
push rsi
push r13
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14013c660]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov r13, rdx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x14000613a
xor eax, eax
jmp 0x140006741
mov qword [rsp + 0x130], r12
xor r9d, r9d
xor r12d, r12d
xor r8d, r8d
mov qword [rsp + 0x40], r12
xor ecx, ecx
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
lea edx, [r12 - 1]
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x140006969
lea rax, [rbp - 0x60]
mov qword [rbp - 0x60], r12
lea r9, [0x1400c69c8]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x1400c6a98]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140006969
mov rax, qword [rbp - 0x60]
movsd xmm0, qword [str.ewvng]
mov qword [rbp - 0x58], r12
mov qword [rsp + 0x170], rbx
mov rcx, qword [rax]
movzx eax, byte [0x1400c28d2]
movsd qword [rsp + 0x50], xmm0
xor al, 0x41
xor byte [rsp + 0x51], 0x38
xor byte [rsp + 0x52], 0x39
xor byte [rsp + 0x53], 0x3a
xor byte [rsp + 0x54], 0x3b
xor byte [rsp + 0x55], 0x3c
xor byte [rsp + 0x56], 0x3d
xor byte [rsp + 0x57], 0x3e
mov qword [rsp + 0x138], rdi
mov rdi, qword [rcx + 0x18]
movzx ecx, word [0x1400c28d0]
mov word [rsp + 0x58], cx
xor cl, 0x3f
xor byte [rsp + 0x59], 0x40
mov byte [rsp + 0x58], cl
lea ecx, [r12 + 0x18]
mov byte [rsp + 0x50], 0x52
mov byte [rsp + 0x5a], al
call fcn.140050bb0
mov rbx, rax
test rax, rax
je 0x140006976
mov qword [rax], r12
lea rcx, [rsp + 0x50]
mov qword [rax + 0x10], 1
mov qword [rax + 8], r12
call fcn.14004fb60
lea rcx, [rbp - 0x58]
mov qword [rbx], rax
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov rcx, qword [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], r12
mov rdx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1400062c5
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400062a6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400062b8
call fcn.140050bfc
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140050bec
test edi, edi
jns 0x1400062e0
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x140006729
mov rax, qword [rbp - 0x58]
mov r8d, r12d
movups xmm0, xmmword [0x1400c28d8]
mov edi, dword [0x14013c640]
mov qword [rbp - 0x48], r12
mov rcx, qword [rax]
mov eax, dword [0x1400c28f8]
mov dword [rbp - 0x78], eax
mov eax, 5
mov qword [rsp + 0x120], r15
mov r15, qword [rcx + 0xa0]
movups xmm1, xmmword [0x1400c28e8]
lea ecx, [rax + 0x1a]
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm1
cmp edi, 2
jl 0x1400064b6
movdqa xmm0, xmmword [0x1400c3d20]
movdqa xmm5, xmmword [0x1400c3cd0]
movdqa xmm4, xmmword [0x1400c3d50]
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm7
movdqa xmm7, xmmword [0x1400c3cf0]
movaps xmmword [rsp + 0xf0], xmm8
movdqa xmmword [rbp - 0x70], xmm0
mov edx, dword [rbp - 0x70]
movd xmm8, ecx
lea rcx, [rsp + 0x6c]
movd xmm6, eax
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400c3d10]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400c3d10]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x20
jl 0x140006390
movaps xmm8, xmmword [rsp + 0xf0]
movaps xmm7, xmmword [rsp + 0x100]
movaps xmm6, xmmword [rsp + 0x110]
cmp r8d, 0x24
jge 0x1400064f5
movsxd rax, r8d
lea r9, [rsp + 0x68]
add r9, rax
mov eax, 0xa0a0a0a1
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 0x24
jl 0x1400064c1
mov ecx, 0x18
mov qword [rsp + 0x128], r14
call fcn.140050bb0
mov rbx, rax
test rax, rax
je 0x14000698d
mov qword [rax], r12
lea rcx, [rsp + 0x68]
mov qword [rax + 0x10], 1
mov qword [rax + 8], r12
call fcn.14004fb60
cmp byte [0x1400c28d7], r12b
mov r14, rax
mov qword [rbx], rax
mov eax, dword [str._iu:du]
mov dword [rsp + 0x60], eax
je 0x140006624
cmp edi, 2
jl 0x1400065e4
movdqa xmm3, xmmword [0x1400c3cd0]
mov ecx, 5
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400c3d50]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400c3d50]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
movd xmm0, ecx
psrad xmm2, xmm0
mov ecx, 0x1f
movdqa xmm1, xmm2
movd xmm0, ecx
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1400c3cf0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400c3d10]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400c3d20]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x60], xmm2
jmp 0x140006624
lea r9, [rsp + 0x60]
mov r8d, r12d
nop dword [rax]
mov eax, 0xa0a0a0a1
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x1400065f0
mov ecx, 0x18
call fcn.140050bb0
mov rdi, rax
test rax, rax
je 0x14000698d
mov qword [rax], r12
lea rcx, [rsp + 0x60]
mov qword [rax + 0x10], 1
mov qword [rax + 8], r12
call fcn.14004fb60
lea rcx, [rbp - 0x48]
mov qword [rdi], rax
mov qword [rsp + 0x28], rcx
mov r9d, 0x30
mov rcx, qword [rbp - 0x58]
mov r8, r14
mov rdx, rax
mov qword [rsp + 0x20], r12
call r15
mov r14d, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1400066b9
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000669a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400066ac
call fcn.140050bfc
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140050bec
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400066f8
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400066d9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400066eb
call fcn.140050bfc
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140050bec
test r14d, r14d
jns 0x140006759
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov r14, qword [rsp + 0x128]
mov r15, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x170]
mov r12, qword [rsp + 0x130]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400511a0
add rsp, 0x140
pop r13
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x48]
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x28], r12d
test rcx, rcx
je 0x14000693b
nop
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp - 0x28], 0
je 0x14000693b
mov rcx, qword [rbp - 0x50]
lea r9, [rbp - 0x40]
mov qword [rsp + 0x28], r12
lea rdx, str.Caption
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x1400068ce
mov r15, qword [rbp - 0x38]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x1400067d0
mov r14, qword [rsi + 0x18]
cmp rbx, r14
ja 0x14000680f
mov rdi, rsi
cmp r14, 8
jb 0x1400067f0
mov rdi, qword [rsi]
mov qword [rsi + 0x10], rbx
mov rdx, r15
add rbx, rbx
mov rcx, rdi
mov r8, rbx
call fcn.1400531e0
mov word [rbx + rdi], r12w
jmp 0x1400068c4
movabs rdx, 0x7ffffffffffffffe
cmp rbx, rdx
ja 0x140006987
mov rdi, rbx
or rdi, 7
cmp rdi, rdx
jbe 0x140006833
mov rdi, rdx
jmp 0x140006854
mov rcx, r14
mov rax, rdx
shr rcx, 1
sub rax, rcx
cmp r14, rax
jbe 0x140006849
mov rdi, rdx
jmp 0x140006854
lea rax, [rcx + r14]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.140006b10
mov qword [rsi + 0x10], rbx
mov rdx, r15
add rbx, rbx
mov qword [rsi + 0x18], rdi
mov r8, rbx
mov rcx, rax
mov r12, rax
call fcn.1400531e0
xor eax, eax
mov word [rbx + r12], ax
cmp r14, 8
jb 0x1400068be
mov rcx, qword [rsi]
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x1400068b9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006981
mov rcx, r8
call fcn.140050bec
mov qword [rsi], r12
xor r12d, r12d
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
lea r9, [rbp - 0x40]
mov qword [rsp + 0x28], r12
lea rdx, str.AdapterRAM
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140006924
mov rcx, qword [rbp - 0x38]
mov rax, r13
shr rcx, 0x14
mov qword [r13 + 0x10], 1
cmp qword [r13 + 0x18], 8
jb 0x140006912
mov rax, qword [r13]
mov word [rax], cx
lea rcx, [rbp - 0x40]
mov word [rax + 2], r12w
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x140006770
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x140006719
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x140006739
mov ecx, 0x8007000e
call fcn.14004f8e0
int3
call fcn.140062028
int3
call fcn.1400052b0
int3
mov ecx, 0x8007000e
call fcn.14004f8e0
int3