Function at 0x14006b850
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x130
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14013e0a0]
xor rax, rsp
mov qword [rbp + 0x10], rax
xorps xmm6, xmm6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14006bd71
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x14006bd6b
mov qword [rbp - 0x28], r15
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9, [0x1401079b8]
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [0x1401079c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14006bd6b
mov qword [rbp - 0x30], r15
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov dword [rsp + 0x58], 0x3eda3ec6
mov dword [rsp + 0x5c], 0x3ec33ed9
mov dword [rsp + 0x60], 0x3eda3ec4
mov dword [rsp + 0x64], 0x3ed63ed3
mov dword [rsp + 0x68], 0x3eaf3eca
mov word [rsp + 0x6c], r15w
mov byte [rsp + 0x6e], 1
mov ecx, r15d
mov r12d, 0x3e94
nop dword [rax]
lea eax, [r12 + rcx]
xor word [rsp + rcx*2 + 0x58], ax
inc rcx
cmp rcx, 0xa
jb 0x14006b950
mov byte [rsp + 0x6e], r15b
mov ecx, 0x18
call fcn.1400a09c8
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14006b9ae
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14006bdb1
jmp 0x14006b9b1
mov rbx, r15
mov qword [rbp - 0x48], rbx
test rbx, rbx
je 0x14006bdbc
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x28]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14006ba2b
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006ba0c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14006ba1e
call fcn.1400a09c0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400a09c0
test edi, edi
js 0x14006ba6b
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14006ba83
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
movaps xmm0, xmm6
jmp 0x14006bd74
mov qword [rbp - 0x20], r15
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
movdqa xmm0, xmmword [0x14011ec50]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0xf89496ca
mov dword [rbp - 0x7c], 0xc8c5dbf8
mov dword [rbp - 0x78], 0xc0dddec9
mov word [rbp - 0x74], 0xc2
mov byte [rbp - 0x72], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx - 0x6c]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 0x1d
jb 0x14006bad0
mov byte [rbp - 0x72], 0
mov ecx, 0x18
call fcn.1400a09c8
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14006bb20
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, [rsp + 0x70]
call fcn.1400a0670
mov qword [rbx], rax
jmp 0x14006bb23
mov rbx, r15
mov qword [rbp - 0x40], rbx
test rbx, rbx
je 0x14006bdc7
mov rsi, qword [rbx]
mov dword [rsp + 0x50], 0xc2dcdb
mov byte [rsp + 0x54], 1
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x74]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 3
jb 0x14006bb50
mov byte [rsp + 0x54], 0
mov ecx, 0x18
call fcn.1400a09c8
mov rdi, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14006bba1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r15
mov dword [rdi + 0x10], 1
lea rcx, [rsp + 0x50]
call fcn.1400a0670
mov qword [rdi], rax
jmp 0x14006bba4
mov rdi, r15
mov qword [rbp - 0x38], rdi
test rdi, rdi
je 0x14006bda6
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x30]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14006bc14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14006bbf4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14006bc06
call fcn.1400a09c0
mov qword [rdi + 8], r15
mov edx, 0x18
mov rcx, rdi
call fcn.1400a09c0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14006bc53
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006bc34
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14006bc46
call fcn.1400a09c0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400a09c0
test esi, esi
js 0x14006ba61
mov qword [rbp - 0x18], r15
mov dword [rbp - 0x10], r15d
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14006bd3a
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x18]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp - 0x10], 0
je 0x14006bd3a
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
mov r10, qword [rax + 0x20]
mov dword [rbp - 0x70], 0x3ef43ed9
mov dword [rbp - 0x6c], 0x3ed43eee
mov dword [rbp - 0x68], 0x3ef63ef4
mov dword [rbp - 0x64], 0x3ef03ef9
mov dword [rbp - 0x60], 0x3eed3ecf
mov dword [rbp - 0x5c], 0x3efa3efb
mov dword [rbp - 0x58], 0x3ec4
mov byte [rbp - 0x54], 1
mov rdx, r15
nop dword [rax]
lea eax, [r12 + rdx]
xor word [rbp + rdx*2 - 0x70], ax
inc rdx
cmp rdx, 0xd
jb 0x14006bce0
mov byte [rbp - 0x54], 0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 8]
xor r8d, r8d
lea rdx, [rbp - 0x70]
call r10
mov eax, dword [rbp]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
jne 0x14006bc70
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mulsd xmm6, qword [0x14011e628]
movaps xmm0, xmm6
jmp 0x14006bd74
call qword [sym.imp.ole32.dll_CoUninitialize]
xorps xmm0, xmm0
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400a09a0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400a0660
nop
mov ecx, 0x8007000e
call fcn.1400a0660
nop
mov ecx, 0x8007000e
call fcn.1400a0660
int3
mov ecx, 0x8007000e
call fcn.1400a0660
int3