Function at 0x1401e3d90
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov r13, rcx
xor r12d, r12d
mov dword [rbp + 0xd8], r12d
lea rsi, [0x14034d1a0]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x14030fff8]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x1403100c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1401e4541
lea ecx, [rax + 0x18]
call fcn.1402bcb4c
mov rbx, rax
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x1401e3e51
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.root_subscription
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1401e3e54
mov ecx, 0x8007000e
call fcn.1402dbab0
int3
mov rbx, r12
mov qword [rbp + 0x20], rbx
test rbx, rbx
jne 0x1401e3e68
mov ecx, 0x8007000e
call fcn.1402dbab0
nop
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x1401e3ecb
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401e3eb1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401e3ec3
call fcn.1402bcebc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.14021ae20
test edi, edi
jne 0x1401e4541
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0xa]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x1401e4541
lea r8, str.ActiveScriptEventConsumer
lea rdx, str.SELECT__FROM
lea rcx, [rbp]
call fcn.140201750
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x70]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x68]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x70]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x70]
call fcn.140203bb0
nop
cmp dword [rbp + 8], edi
jle 0x1401e3f61
mov rcx, qword [rbp]
call fcn.1402bd0e0
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x28]
call fcn.14011ef30
mov rdi, rax
mov ecx, 0x18
call fcn.1402bcb4c
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1401e3fa3
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x1403561d4]
call fcn.1402dbac0
mov qword [rbx], rax
jmp 0x1401e3fa6
mov rbx, r12
mov qword [rbp + 0x18], rbx
test rbx, rbx
jne 0x1401e3fba
mov ecx, 0x8007000e
call fcn.1402dbab0
nop
mov rax, qword [rdi]
test rax, rax
je 0x1401e3fc7
mov r8, qword [rax]
jmp 0x1401e3fca
mov r8, r12
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x1401e4022
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401e4007
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401e4019
call fcn.1402bcebc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.14021ae20
nop
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x1401e4061
lock dec dword [rbx + 0x10]
jne 0x1401e4061
test rbx, rbx
je 0x1401e4061
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401e4047
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401e4059
call fcn.1402bcebc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.14021ae20
test edi, edi
jne 0x1401e4541
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x48]
lea r8d, [rdi + 1]
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
jne 0x1401e4541
mov r14d, dword [rbp + 0xd8]
nop dword [rax]
cmp dword [rbp + 0xe0], 0
jbe 0x1401e4541
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + 0x20]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x40]
xor r8d, r8d
lea rdx, str.ScriptText
call qword [rax + 0x20]
test eax, eax
jne 0x1401e4516
mov qword [rsp + 0x68], 0
lea edx, [rax + 4]
lea rcx, [rsp + 0x60]
call fcn.1402028a0
mov eax, dword [rsp + 0x68]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.WMI:
mov rcx, qword [rsp + 0x60]
call fcn.1402c06dc
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.140203bb0
nop
lea rdx, str.root_subscription
lea rcx, [rsp + 0x60]
call fcn.140200ef0
lea rdx, [0x14034c088]
lea rcx, [rsp + 0x60]
call fcn.140200ef0
lea rdx, str.ActiveScriptEventConsumer
lea rcx, [rsp + 0x60]
call fcn.140200ef0
lea rdx, [0x14034c088]
lea rcx, [rsp + 0x60]
call fcn.140200ef0
mov rdx, qword [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140200ef0
mov r9, qword [rbp + 0x30]
lea r8, str.ActiveScriptEventConsumer
lea rdx, str._ls.Name__ls_
lea rcx, [rbp - 0x40]
call fcn.140202d40
nop
mov ecx, 0x88
call fcn.1402bcb4c
mov r15, rax
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x1401e4379
mov rdi, qword [rbp + 0x48]
test rdi, rdi
jne 0x1401e41dd
mov ebx, r12d
mov qword [rsp + 0x58], rdi
jmp 0x1401e41f8
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401e41e1
mov qword [rsp + 0x58], 0
test ebx, ebx
jne 0x1401e41ff
mov qword [rsp + 0x50], rsi
jmp 0x1401e4224
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rsp + 0x58]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x50]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140203bb0
nop
or r14d, 1
mov dword [rbp + 0xd8], r14d
mov qword [rsp + 0x78], 0
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1402028a0
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.root_subscription
mov rcx, qword [rsp + 0x70]
call fcn.1402c06dc
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.140203bb0
nop
or r14d, 2
mov dword [rbp + 0xd8], r14d
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1400da430
nop
lea rax, vtable.HitmanPro35::RepairWMI.0
mov qword [r15], rax
mov qword [r15 + 0x58], rsi
mov qword [r15 + 0x60], 0
mov qword [r15 + 0x68], rsi
mov qword [r15 + 0x70], 0
lea rax, [0x14034d1a0]
mov qword [r15 + 0x78], rax
mov qword [r15 + 0x80], 0
mov edx, dword [rsp + 0x7c]
lea rcx, [r15 + 0x58]
call fcn.1402028a0
movsxd r9, dword [rsp + 0x7c]
mov eax, dword [r15 + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x70]
mov rcx, qword [r15 + 0x58]
call fcn.1402c06dc
mov edx, dword [rsp + 0x7c]
lea rcx, [r15 + 0x58]
call fcn.140203bb0
mov edx, dword [rbp - 0x34]
lea rcx, [r15 + 0x68]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x34]
mov eax, dword [r15 + 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x68]
call fcn.1402c06dc
mov edx, dword [rbp - 0x34]
lea rcx, [r15 + 0x68]
call fcn.140203bb0
mov edx, dword [rsp + 0x5c]
lea rcx, [r15 + 0x78]
call fcn.1402028a0
movsxd r9, dword [rsp + 0x5c]
mov eax, dword [r15 + 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x50]
mov rcx, qword [r15 + 0x78]
call fcn.1402c06dc
mov edx, dword [rsp + 0x5c]
lea rcx, [r15 + 0x78]
call fcn.140203bb0
nop
jmp 0x1401e437c
mov r15, r12
test r14b, 2
je 0x1401e4398
and r14d, 0xfffffffd
cmp dword [rsp + 0x78], 0
jle 0x1401e4398
mov rcx, qword [rsp + 0x70]
call fcn.1402bd0e0
nop
test r14b, 1
je 0x1401e43b3
and r14d, 0xfffffffe
cmp dword [rsp + 0x58], 0
jle 0x1401e43b3
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
mov rdx, r15
mov rcx, qword [r13 + 8]
call fcn.1400fab10
lea rdx, [r15 + 8]
mov rcx, qword [r13 + 8]
call fcn.1401138e0
movzx edi, al
test al, al
sete r12b
movzx edx, r12b
mov rcx, r15
call fcn.1400d8ef0
mov rcx, r15
call fcn.1400daa90
mov rsi, rax
mov rcx, rax
call fcn.1400e4d00
mov dword [rbp + 0xe8], 7
movzx ecx, byte [0x140431249]
mov byte [rsp + 0x20], cl
lea r9, [rbp + 0xe8]
lea rdx, [rbp + 0x58]
lea rcx, [rsi + 0x18]
call fcn.1400e4f60
mov dword [rbp - 0x58], 8
movzx edx, byte [0x140431249]
mov byte [rsp + 0x20], dl
lea r9, [rbp - 0x58]
lea rdx, [rbp + 0x68]
lea rcx, [rsi + 0x18]
call fcn.1400e4f60
mov dword [rbp - 0x60], 0xc
movzx eax, byte [0x140431249]
mov byte [rsp + 0x20], al
lea r9, [rbp - 0x60]
lea rdx, [rbp + 0x78]
lea rcx, [rsi + 0x18]
call fcn.1400e4f60
xor edx, edx
test dil, dil
setne dl
add edx, 7
mov rcx, rsi
call fcn.1400e4c20
cmp byte [rsi + 0xa], 1
je 0x1401e44ab
mov byte [rsi + 0xa], 1
cmp byte [rsi + 8], 0
je 0x1401e44ab
mov rax, qword [rsi]
mov rdx, qword [0x140430c10]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 1
lea rcx, [rdx + 0x390]
lea r8, [rbp - 0x20]
call fcn.14011b550
cmp byte [rsi + 9], r12b
je 0x1401e44e0
mov byte [rsi + 9], r12b
cmp byte [rsi + 8], 0
je 0x1401e44e0
mov rax, qword [rsi]
mov rdx, qword [0x140430c10]
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 2
lea rcx, [rdx + 0x390]
lea r8, [rbp - 0x10]
call fcn.14011b550
mov dl, 1
mov rcx, rsi
call fcn.1400e4c90
nop
cmp dword [rbp - 0x38], 0
jle 0x1401e44fb
mov rcx, qword [rbp - 0x40]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x68], 0
jle 0x1401e450c
mov rcx, qword [rsp + 0x60]
call fcn.1402bd0e0
lea rsi, [0x14034d1a0]
xor r12d, r12d
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x48]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
je 0x1401e40a0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1401e4550
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1401e455f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1401e456f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
cmp dword [rbp - 0x68], 0
jle 0x1401e457e
mov rcx, qword [rbp - 0x70]
call fcn.1402bd0e0
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret