Function at 0x1400de450
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rbx, r8
mov r15, rdx
mov qword [rbp - 0x10], rcx
mov eax, dword [0x141dd8618]
add eax, dword [0x141dd861c]
iretd
add dword [0x191f946ff], esi
add eax, 0x6e0a811b
or eax, 0xb0238b7d
cmp eax, 0x1430f408
jae 0x1400de4e0
mov eax, 0x10
call fcn.1400eeec0
or al, byte [rcx]
add byte [rax + 0x29], cl
invalid
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400eeec0
add byte [rax + 0x29], cl
invalid
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov qword [rcx], 0
nop dword [rax]
mov ecx, dword [0x141dd8620]
imul ecx, dword [0x141dd8624]
xor ecx, 0x1bedd923
add ecx, 0x423ca5a4
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
add al, ch
lea ecx, [rcx]
add dword [rax], eax
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400eeec0
add dword [rax], eax
sub rsp, rax
mov rsi, rsp
mov qword [rdi], 0
add byte [rax], al
add byte [rcx - 0x72583b07], al
invalid
ja 0x1400de4e0
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
lea rcx, [0x141db8d54]
lea r9, [0x141db8d38]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
add rsp, 0x30
test eax, eax
js 0x1400de754
nop dword [rax]
mov eax, dword [0x141dd8628]
sub eax, dword [0x141dd862c]
xor eax, 0x8088
or eax, 0xd7ac4e41
xor eax, 0x84b289b9
cmp eax, 0x895bc235
ja 0x1400de590
mov rdi, qword [rdi]
test rdi, rdi
test edi, edi
je 0x1400de700
mov eax, dword [0x141dd8650]
sub eax, dword [0x141dd8654]
and eax, 0xf644ca0b
imul eax, eax, 0x1fcb4f29
add eax, 0x50ad7e1
cmp eax, 0x743c5c37
jae 0x1400de600
sub rsp, 0x20
mov rcx, r15
mov rdx, rbx
call fcn.1400dca20
add rsp, 0x20
mov qword [rbp - 0x18], 0
add byte [rax], al
add byte [rax], al
nop dword [rax]
mov eax, dword [0x141dd8658]
and eax, dword [0x141dd865c]
xor eax, 0x1c443bba
imul esi, eax, 0xbac362aa
stosb byte [rdi], al
invalid
ret
mov edx, 0x20ec8348
mov rcx, r15
mov rdx, rbx
call fcn.1400dca20
add rsp, 0x20
mov qword [rbp - 0x18], 0
cmp esi, 0xc2884cca
je 0x1400de600
mov r14, rax
mov rax, qword [rdi]
sub rsp, 0x50
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
and byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
stc
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
leave
call qword [rax + 0x18]
add rsp, 0x50
test eax, eax
js 0x1400de84c
nop word cs:[rax + rax]
mov eax, dword [0x141dd8660]
imul eax, dword [0x141dd8664]
xor eax, 0x480c18
and eax, 0x726a2c78
cmp eax, 0x820a014b
je 0x1400de690
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x1400de730
test r14, r14
je 0x1400de6cd
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.oleaut32.dll_SysFreeString]
add al, byte [rax]
add rsp, 0x20
mov eax, dword [0x141dd8698]
sub eax, dword [0x141dd869c]
or eax, 0xbf623433
and eax, 0xbf6e34bf
cmp eax, 0xa374888a
je 0x1400de68b
mov r13, qword [rbp - 0x10]
jb 0x1400de8e1
jmp 0x1400de87d
mov eax, dword [0x141dd8630]
xor eax, dword [0x141dd8634]
add eax, 0xaec07bd
and eax, 0xe12c18a0
cmp eax, 0xadd595ba
jae 0x1400de700
xor ecx, ecx
mov r13, qword [rbp - 0x10]
jmp 0x1400de824
add byte [rax], al
invalid
mov eax, dword [0x141dd8668]
and eax, dword [0x141dd866c]
add eax, 0x30ce8aef
xor eax, 0xb2f4160b
mov dl, 0x3d
mov al, 0x79
pop rdx
invalid
jb 0x1400de730
xor ebx, ebx
jmp 0x1400dea08
mov dword [rbp - 8], eax
mov qword [rbp], 0
sub rsp, 0x20
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
mov rbx, qword [rbp]
test rbx, rbx
mov r13, qword [rbp - 0x10]
je 0x1400de821
nop word cs:[rax + rax]
mov eax, dword [0x141dd8638]
or eax, dword [0x141dd863c]
iretd
add dword [0x12db86e47], edi
je 0x1400de790
mov rdi, qword [rbx]
nop word cs:[rax + rax]
mov eax, dword [0x141dd8640]
sub eax, dword [0x141dd8644]
iretd
add dword [rax + 0x69], ecx
rcl byte [rdi - 0x7c], 0xc
or byte [rax - 0x3f], cl
call 0x102371d05
xchg edi, eax
idiv byte [0x1060baa80]
jb 0x1400de7b0
xor eax, eax
test al, al
je 0x1400de7e7
sub rsp, 0x20
mov rcx, rbx
call qword [rdi + 0x10]
add rsp, 0x20
mov r15d, 0xea2fa709
nop dword [rax]
mov r12d, dword [0x141dd8648]
xor r12d, dword [0x141dd864c]
sahf
iretd
add dword [rbp + 0xf], ecx
scasd eax, dword [rdi]
out 0x49, eax
shr esp, 0x3a
and r12d, 3
sub rsp, 0x20
mov rcx, rbx
call qword [rdi + 0x10]
add rsp, 0x20
cmp r12d, 0x97cfb7e6
je 0x1400de7f0
mov ecx, dword [rbp - 8]
movzx eax, byte [r14 + 2]
mov byte [r13 + 3], al
movzx eax, word [r14]
mov word [r13 + 1], ax
movups xmm0, xmmword [rsi]
movups xmmword [r13 + 0x10], xmm0
mov byte [r13], 0
mov dword [r13 + 4], ecx
add al, 0xe9
invalid
add al, byte [rax]
invalid
mov ebx, eax
mov qword [rbp - 8], rdi
mov eax, dword [0x141dd8670]
or eax, dword [0x141dd8674]
add eax, 0x1cf9e16
xor eax, 0x91400020
or eax, 0x40260316
and eax, 0xf1660376
cmp eax, 0x67a2a6a7
je 0x1400dec1f
jmp case.0x140097632.261
mov eax, dword [0x141dd86a0]
add eax, dword [0x141dd86a4]
mov esi, 0xcae35005
imul rsi, rax
imul esi, eax
shr rsi, 0x3e
or esi, 0xb7ff6ffe
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
leave
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
add rsp, 0x40
cmp esi, 0x605ada08
jae 0x1400de923
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
add rsp, 0x40
jmp 0x1400de87d
mov r14d, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dd86a8]
sub eax, dword [0x141dd86ac]
imul eax, eax, 0x4c677242
or eax, 0xedffdb3b
cmp ebx, ebx
invalid
in eax, dx
cmp eax, 0x20b247ef
jb 0x1400de930
test r14d, r14d
js 0x1400de982
mov qword [r13 + 8], rbx
mov eax, dword [0x141dd86f0]
or eax, dword [0x141dd86f4]
mov byte [r13], 0x12
add eax, 0x866090ef
and eax, 0x2a948621
cmp eax, 0xde3ee256
fimul word [rdi]
invalid
cdq
add eax, dword [rax]
invalid
jmp 0x1400decdb
mov qword [rbp], 0
sub rsp, 0x20
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141dd86b0]
imul eax, dword [0x141dd86b4]
or eax, 0x10d71a3a
and eax, 0x1ad71a3b
cmp eax, 0x109e46c
jb 0x1400de9a0
mov r15, qword [rbp]
test r15, r15
je 0x1400ded76
mov rsi, qword [r15]
mov eax, dword [0x141dd86b8]
xor edx, edx
div dword [0x141dd86bc]
imul rax, rax, 0x76d9a5f5
shr rax, 0x3d
imul eax, eax, 0x7100be95
imul rax, rax, 0x79c3a727
shr rax, 0x3d
cmp eax, 0x80fed3c1
rcl ebx, 0xfe
or byte [rdi], 0x84
invalid
add eax, dword [rax]
invalid
jmp 0x1400ded29
movzx eax, byte [r12 + 2]
mov rcx, qword [rbp - 0x10]
mov byte [rcx + 3], al
movzx eax, word [r12]
mov word [rcx + 1], ax
movups xmm0, xmmword [r13]
adc byte [rbp], al
mov r12, rcx
movups xmmword [rcx + 0x10], xmm0
test r14, r14
je 0x1400deac9
mov eax, dword [0x141dd86c8]
sub eax, dword [0x141dd86cc]
imul eax, eax, 0x90727804
add eax, 0x35bb05d8
cmp eax, 0xf13c2136
jbe 0x1400dea62
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.oleaut32.dll_SysFreeString]
add rsp, 0x20
mov rsi, qword [sym.imp.oleaut32.dll_SysFreeString]
nop dword [rax]
mov eax, dword [0x141dd86d0]
xor eax, dword [0x141dd86d4]
add eax, 0x1cf9c58
or eax, 0xa23b3c28
imul r15d, eax, 0x7e7c4af4
xor r15d, 0x30382cf4
sub rsp, 0x20
mov rcx, r14
call rsi
add rsp, 0x20
cmp r15d, 0x78718088
ja 0x1400dea70
nop word cs:[rax + rax]
mov eax, dword [0x141dd86d8]
xor eax, dword [0x141dd86dc]
imul eax, eax, 0x27b81260
cmp eax, 0x1ad33299
jb 0x1400deab0
mov eax, dword [0x141dd86e0]
xor eax, dword [0x141dd86e4]
mov byte [r12], 0
or eax, 0xecbac77d
imul eax, eax, 0xa34761ce
cmp eax, 0xaffcbeed
je 0x1400deb0f
mov eax, dword [0x141dd86e8]
xor eax, dword [0x141dd86ec]
imul eax, eax, 0x6c44fa7b
add eax, 0xe9b5894d
mov dword [r12 + 4], ebx
cmp eax, 0x2d98d58b
jae case.0x140078bf8.882
mov dword [r12 + 4], ebx
jmp 0x1400deaec
mov eax, dword [0x141dd8720]
sub eax, dword [0x141dd8724]
wait
iretd
add dword [0x141bd5f68], eax
cmp eax, 0x3450f6c2
jb 0x1400deb20
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141dd8728]
sub eax, dword [0x141dd872c]
xor eax, 0x3eec9e34
sahf
in al, dx
imul rax, rax, 0xaf3096d
shr rax, 0x3a
cmp eax, 0x2bd3f071
je case.0x140078bf8.882
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov eax, dword [0x141dd8730]
and eax, dword [0x141dd8734]
add eax, 0xa00877c8
cmp eax, 0xeba347c5
ja 0x1400debcf
mov eax, dword [0x141dd8738]
imul eax, dword [0x141dd873c]
imul rax, rax, 0x169680e5
shr rax, 0x3c
imul ebx, eax, 0xc93d3866
and ebx, 0x6f463c08
sub rsp, 0x20
mov rcx, rdi
call rsi
add rsp, 0x20
cmp ebx, 0x1a10e3f2
jbe 0x1400deb20
sub rsp, 0x20
mov rcx, rdi
call rsi
add rsp, 0x20
jmp 0x1400deb92
invalid
mov eax, dword [0x141dd8678]
sub eax, dword [0x141dd867c]
add eax, 0x96646d36
mov esi, 0xa6ed00dd
imul rsi, rax
shr rsi, 0x3f
mov qword [rbp], 0
mov dword [rbp], 0
sub rsp, 0x20
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
cmp esi, 0x38d2503a
cmp byte [rbp + 0x1d], dh
mov qword [rbp], 0
sub rsp, 0x20
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
jmp case.0x140097632.261
mov rdi, qword [rbp]
mov eax, dword [0x141dd8680]
xor eax, dword [0x141dd8684]
xor eax, 0x108a306
and eax, 0x5dc8f716
xor eax, 0x5ef2638c
cmp eax, 0xd0d3d11a
ja 0x1400dec40
test rdi, rdi
je 0x1400decd2
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov eax, dword [0x141dd8688]
or eax, dword [0x141dd868c]
imul eax, eax, 0x1bccbdc5
cmp eax, 0xa10473fc
jne 0x1400deca0
sub rsp, 0x20
mov rcx, rdi
call rsi
add rsp, 0x20
nop word cs:[rax + rax]
mov r15d, dword [0x141dd8690]
add r15d, dword [0x141dd8694]
xor r15d, 0x842300b0
or r15d, 0x73dc650f
sub rsp, 0x20
mov rcx, rdi
call rsi
add rsp, 0x20
cmp r15d, 0x3e68417a
je 0x1400deca0
mov rdi, qword [rbp - 8]
jmp 0x1400dea08
mov esi, dword [0x141dd86f8]
or esi, dword [0x141dd86fc]
and esi, 0x59aa89
add esi, 0x8f74a24e
and esi, 0x833ea5c
mov rax, qword [rdi]
sub rsp, 0x20
mov rcx, rdi
call qword [rax + 0x10]
add rsp, 0x20
cmp esi, 0x68e49dcc
jne 0x1400deb20
test dword [rdx], ecx
invalid
invalid
invalid
mov rax, qword [rdi]
sub rsp, 0x20
mov rcx, rdi
call qword [rax + 0x10]
add rsp, 0x20
jmp 0x1400decdb
mov eax, dword [0x141dd86c0]
xor eax, dword [0x141dd86c4]
mov ecx, 0x99590fb1
pop rcx
cdq
imul rcx, rax
shr rcx, 0x3e
xor ecx, 0x90b2bd87
imul r12d, ecx, 0x689e67a1
sub rsp, 0x20
mov rcx, r15
call qword [rsi + 0x10]
add rsp, 0x20
cmp r12d, 0x98b07be5
jne 0x1400ded76
sub rsp, 0x20
mov rcx, r15
call qword [rsi + 0x10]
add rsp, 0x20
jmp 0x1400ded29
mov eax, dword [0x141dd8700]
xor edx, edx
div dword [0x141dd8704]
imul eax, eax, 0xec07c51e
and eax, 0xb955f6da
add eax, 0xc5977f5b
cmp eax, 0xed58e5e
jb 0x1400dedd7
mov eax, dword [0x141dd8708]
or eax, dword [0x141dd870c]
cdq
iretd
add dword [rcx - 0x40], ebp
xchg ebp, eax
or dword [0x10877364b], esp
ret
hlt
jp 0x1400dedc7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
imul eax, eax, 0xdc706be
mov byte [r13], 0
mov dword [r13 + 4], r14d
cmp eax, 0xcf2bdeb5
jbe 0x1400dede2
mov byte [r13], 0
mov dword [r13 + 4], r14d
jmp 0x1400ded9b
mov eax, dword [0x141dd8710]
imul eax, dword [0x141dd8714]
imul rax, rax, 0x6b6c3247
shr rax, 0x3e
or eax, 0xbf7572b6
cmp eax, 0x2fbf176e
je 0x1400dee42
mov eax, dword [0x141dd8718]
xor edx, edx
div dword [0x141dd871c]
or eax, 0x53d0b64f
imul esi, eax, 0x4d978408
and esi, 0x58babea0
mov rax, qword [rbx]
sub rsp, 0x20
mov rcx, rbx
call qword [rax + 0x10]
push rax
invalid
add rsp, 0x20
cmp esi, 0x9ccc24c
jne case.0x140078bf8.882
mov rax, qword [rbx]
sub rsp, 0x20
mov rcx, rbx
call qword [rax + 0x10]
add rsp, 0x20
add esp, 0x20
jmp 0x1400dee06