Function at 0x1401e1b60
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov r13, rcx
xor r12d, r12d
mov dword [rbp + 0xd8], r12d
lea rsi, [0x140348ca0]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x14030bf98]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x14030c068]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1401e2311
lea ecx, [rax + 0x18]
call fcn.1402b968c
mov rbx, rax
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x1401e1c21
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.root_subscription
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1401e1c24
mov ecx, 0x8007000e
call fcn.1402d8460
int3
mov rbx, r12
mov qword [rbp + 0x20], rbx
test rbx, rbx
jne 0x1401e1c38
mov ecx, 0x8007000e
call fcn.1402d8460
nop
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x1401e1c9b
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401e1c81
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401e1c93
call fcn.1402b99fc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402177e0
test edi, edi
jne 0x1401e2311
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0xa]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x1401e2311
lea r8, str.ActiveScriptEventConsumer
lea rdx, str.SELECT__FROM
lea rcx, [rbp]
call fcn.1401fe110
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x70]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x68]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x70]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x70]
call fcn.140200570
nop
cmp dword [rbp + 8], edi
jle 0x1401e1d31
mov rcx, qword [rbp]
call fcn.1402b9c20
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x28]
call fcn.14011d540
mov rdi, rax
mov ecx, 0x18
call fcn.1402b968c
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1401e1d73
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x140352314]
call fcn.1402d8470
mov qword [rbx], rax
jmp 0x1401e1d76
mov rbx, r12
mov qword [rbp + 0x18], rbx
test rbx, rbx
jne 0x1401e1d8a
mov ecx, 0x8007000e
call fcn.1402d8460
nop
mov rax, qword [rdi]
test rax, rax
je 0x1401e1d97
mov r8, qword [rax]
jmp 0x1401e1d9a
mov r8, r12
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x1401e1df2
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401e1dd7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401e1de9
call fcn.1402b99fc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402177e0
nop
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x1401e1e31
lock dec dword [rbx + 0x10]
jne 0x1401e1e31
test rbx, rbx
je 0x1401e1e31
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401e1e17
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401e1e29
call fcn.1402b99fc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402177e0
test edi, edi
jne 0x1401e2311
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x48]
lea r8d, [rdi + 1]
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
jne 0x1401e2311
mov r14d, dword [rbp + 0xd8]
nop dword [rax]
cmp dword [rbp + 0xe0], 0
jbe 0x1401e2311
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + 0x20]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x40]
xor r8d, r8d
lea rdx, str.ScriptText
call qword [rax + 0x20]
test eax, eax
jne 0x1401e22e6
mov qword [rsp + 0x68], 0
lea edx, [rax + 4]
lea rcx, [rsp + 0x60]
call fcn.1401ff260
mov eax, dword [rsp + 0x68]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.WMI:
mov rcx, qword [rsp + 0x60]
call fcn.1402bd21c
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.140200570
nop
lea rdx, str.root_subscription
lea rcx, [rsp + 0x60]
call fcn.1401fd8b0
lea rdx, [0x140347f58]
lea rcx, [rsp + 0x60]
call fcn.1401fd8b0
lea rdx, str.ActiveScriptEventConsumer
lea rcx, [rsp + 0x60]
call fcn.1401fd8b0
lea rdx, [0x140347f58]
lea rcx, [rsp + 0x60]
call fcn.1401fd8b0
mov rdx, qword [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1401fd8b0
mov r9, qword [rbp + 0x30]
lea r8, str.ActiveScriptEventConsumer
lea rdx, str._ls.Name__ls_
lea rcx, [rbp - 0x40]
call fcn.1401ff700
nop
mov ecx, 0x88
call fcn.1402b968c
mov r15, rax
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x1401e2149
mov rdi, qword [rbp + 0x48]
test rdi, rdi
jne 0x1401e1fad
mov ebx, r12d
mov qword [rsp + 0x58], rdi
jmp 0x1401e1fc8
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401e1fb1
mov qword [rsp + 0x58], 0
test ebx, ebx
jne 0x1401e1fcf
mov qword [rsp + 0x50], rsi
jmp 0x1401e1ff4
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rsp + 0x58]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x50]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140200570
nop
or r14d, 1
mov dword [rbp + 0xd8], r14d
mov qword [rsp + 0x78], 0
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401ff260
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.root_subscription
mov rcx, qword [rsp + 0x70]
call fcn.1402bd21c
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.140200570
nop
or r14d, 2
mov dword [rbp + 0xd8], r14d
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1400d8fb0
nop
lea rax, vtable.HitmanPro35::RepairWMI.0
mov qword [r15], rax
mov qword [r15 + 0x58], rsi
mov qword [r15 + 0x60], 0
mov qword [r15 + 0x68], rsi
mov qword [r15 + 0x70], 0
lea rax, [0x140348ca0]
mov qword [r15 + 0x78], rax
mov qword [r15 + 0x80], 0
mov edx, dword [rsp + 0x7c]
lea rcx, [r15 + 0x58]
call fcn.1401ff260
movsxd r9, dword [rsp + 0x7c]
mov eax, dword [r15 + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x70]
mov rcx, qword [r15 + 0x58]
call fcn.1402bd21c
mov edx, dword [rsp + 0x7c]
lea rcx, [r15 + 0x58]
call fcn.140200570
mov edx, dword [rbp - 0x34]
lea rcx, [r15 + 0x68]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x34]
mov eax, dword [r15 + 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x68]
call fcn.1402bd21c
mov edx, dword [rbp - 0x34]
lea rcx, [r15 + 0x68]
call fcn.140200570
mov edx, dword [rsp + 0x5c]
lea rcx, [r15 + 0x78]
call fcn.1401ff260
movsxd r9, dword [rsp + 0x5c]
mov eax, dword [r15 + 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x50]
mov rcx, qword [r15 + 0x78]
call fcn.1402bd21c
mov edx, dword [rsp + 0x5c]
lea rcx, [r15 + 0x78]
call fcn.140200570
nop
jmp 0x1401e214c
mov r15, r12
test r14b, 2
je 0x1401e2168
and r14d, 0xfffffffd
cmp dword [rsp + 0x78], 0
jle 0x1401e2168
mov rcx, qword [rsp + 0x70]
call fcn.1402b9c20
nop
test r14b, 1
je 0x1401e2183
and r14d, 0xfffffffe
cmp dword [rsp + 0x58], 0
jle 0x1401e2183
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
mov rdx, r15
mov rcx, qword [r13 + 8]
call fcn.1400f9530
lea rdx, [r15 + 8]
mov rcx, qword [r13 + 8]
call fcn.140111ef0
movzx edi, al
test al, al
sete r12b
movzx edx, r12b
mov rcx, r15
call fcn.1400d7a70
mov rcx, r15
call fcn.1400d9610
mov rsi, rax
mov rcx, rax
call fcn.1400e3880
mov dword [rbp + 0xe8], 7
movzx ecx, byte [0x14042c169]
mov byte [rsp + 0x20], cl
lea r9, [rbp + 0xe8]
lea rdx, [rbp + 0x58]
lea rcx, [rsi + 0x18]
call fcn.1400e3ae0
mov dword [rbp - 0x58], 8
movzx edx, byte [0x14042c169]
mov byte [rsp + 0x20], dl
lea r9, [rbp - 0x58]
lea rdx, [rbp + 0x68]
lea rcx, [rsi + 0x18]
call fcn.1400e3ae0
mov dword [rbp - 0x60], 0xc
movzx eax, byte [0x14042c169]
mov byte [rsp + 0x20], al
lea r9, [rbp - 0x60]
lea rdx, [rbp + 0x78]
lea rcx, [rsi + 0x18]
call fcn.1400e3ae0
xor edx, edx
test dil, dil
setne dl
add edx, 7
mov rcx, rsi
call fcn.1400e37a0
cmp byte [rsi + 0xa], 1
je 0x1401e227b
mov byte [rsi + 0xa], 1
cmp byte [rsi + 8], 0
je 0x1401e227b
mov rax, qword [rsi]
mov rdx, qword [0x14042bb58]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 1
lea rcx, [rdx + 0x388]
lea r8, [rbp - 0x20]
call fcn.140119b60
cmp byte [rsi + 9], r12b
je 0x1401e22b0
mov byte [rsi + 9], r12b
cmp byte [rsi + 8], 0
je 0x1401e22b0
mov rax, qword [rsi]
mov rdx, qword [0x14042bb58]
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 2
lea rcx, [rdx + 0x388]
lea r8, [rbp - 0x10]
call fcn.140119b60
mov dl, 1
mov rcx, rsi
call fcn.1400e3810
nop
cmp dword [rbp - 0x38], 0
jle 0x1401e22cb
mov rcx, qword [rbp - 0x40]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x68], 0
jle 0x1401e22dc
mov rcx, qword [rsp + 0x60]
call fcn.1402b9c20
lea rsi, [0x140348ca0]
xor r12d, r12d
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x48]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
je 0x1401e1e70
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1401e2320
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1401e232f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1401e233f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
cmp dword [rbp - 0x68], 0
jle 0x1401e234e
mov rcx, qword [rbp - 0x70]
call fcn.1402b9c20
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret