Function at 0x1401df950
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov r13, rcx
xor r12d, r12d
mov dword [rbp + 0xd8], r12d
lea rsi, [0x140346ce0]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x140309fd8]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x14030a0a8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1401e0101
lea ecx, [rax + 0x18]
call fcn.1402b6dbc
mov rbx, rax
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x1401dfa11
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.root_subscription
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1401dfa14
mov ecx, 0x8007000e
call fcn.1402d5d80
int3
mov rbx, r12
mov qword [rbp + 0x20], rbx
test rbx, rbx
jne 0x1401dfa28
mov ecx, 0x8007000e
call fcn.1402d5d80
nop
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x1401dfa8b
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401dfa71
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dfa83
call fcn.1402b712c
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402150f0
test edi, edi
jne 0x1401e0101
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0xa]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x1401e0101
lea r8, str.ActiveScriptEventConsumer
lea rdx, str.SELECT__FROM
lea rcx, [rbp]
call fcn.1401fb9f0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x70]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x68]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x70]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x70]
call fcn.1401fde50
nop
cmp dword [rbp + 8], edi
jle 0x1401dfb21
mov rcx, qword [rbp]
call fcn.1402b7350
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x28]
call fcn.14011c2c0
mov rdi, rax
mov ecx, 0x18
call fcn.1402b6dbc
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1401dfb63
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x140350304]
call fcn.1402d5d90
mov qword [rbx], rax
jmp 0x1401dfb66
mov rbx, r12
mov qword [rbp + 0x18], rbx
test rbx, rbx
jne 0x1401dfb7a
mov ecx, 0x8007000e
call fcn.1402d5d80
nop
mov rax, qword [rdi]
test rax, rax
je 0x1401dfb87
mov r8, qword [rax]
jmp 0x1401dfb8a
mov r8, r12
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x1401dfbe2
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401dfbc7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dfbd9
call fcn.1402b712c
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402150f0
nop
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x1401dfc21
lock dec dword [rbx + 0x10]
jne 0x1401dfc21
test rbx, rbx
je 0x1401dfc21
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401dfc07
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dfc19
call fcn.1402b712c
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402150f0
test edi, edi
jne 0x1401e0101
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x48]
lea r8d, [rdi + 1]
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
jne 0x1401e0101
mov r14d, dword [rbp + 0xd8]
nop dword [rax]
cmp dword [rbp + 0xe0], 0
jbe 0x1401e0101
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + 0x20]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x40]
xor r8d, r8d
lea rdx, str.ScriptText
call qword [rax + 0x20]
test eax, eax
jne 0x1401e00d6
mov qword [rsp + 0x68], 0
lea edx, [rax + 4]
lea rcx, [rsp + 0x60]
call fcn.1401fcb40
mov eax, dword [rsp + 0x68]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.WMI:
mov rcx, qword [rsp + 0x60]
call fcn.1402ba94c
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.1401fde50
nop
lea rdx, str.root_subscription
lea rcx, [rsp + 0x60]
call fcn.1401fb190
lea rdx, [0x140345f98]
lea rcx, [rsp + 0x60]
call fcn.1401fb190
lea rdx, str.ActiveScriptEventConsumer
lea rcx, [rsp + 0x60]
call fcn.1401fb190
lea rdx, [0x140345f98]
lea rcx, [rsp + 0x60]
call fcn.1401fb190
mov rdx, qword [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1401fb190
mov r9, qword [rbp + 0x30]
lea r8, str.ActiveScriptEventConsumer
lea rdx, str._ls.Name__ls_
lea rcx, [rbp - 0x40]
call fcn.1401fcfe0
nop
mov ecx, 0x88
call fcn.1402b6dbc
mov r15, rax
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x1401dff39
mov rdi, qword [rbp + 0x48]
test rdi, rdi
jne 0x1401dfd9d
mov ebx, r12d
mov qword [rsp + 0x58], rdi
jmp 0x1401dfdb8
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401dfda1
mov qword [rsp + 0x58], 0
test ebx, ebx
jne 0x1401dfdbf
mov qword [rsp + 0x50], rsi
jmp 0x1401dfde4
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rsp + 0x58]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x50]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1401fde50
nop
or r14d, 1
mov dword [rbp + 0xd8], r14d
mov qword [rsp + 0x78], 0
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401fcb40
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.root_subscription
mov rcx, qword [rsp + 0x70]
call fcn.1402ba94c
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401fde50
nop
or r14d, 2
mov dword [rbp + 0xd8], r14d
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1400d8f40
nop
lea rax, vtable.HitmanPro35::RepairWMI.0
mov qword [r15], rax
mov qword [r15 + 0x58], rsi
mov qword [r15 + 0x60], 0
mov qword [r15 + 0x68], rsi
mov qword [r15 + 0x70], 0
lea rax, [0x140346ce0]
mov qword [r15 + 0x78], rax
mov qword [r15 + 0x80], 0
mov edx, dword [rsp + 0x7c]
lea rcx, [r15 + 0x58]
call fcn.1401fcb40
movsxd r9, dword [rsp + 0x7c]
mov eax, dword [r15 + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x70]
mov rcx, qword [r15 + 0x58]
call fcn.1402ba94c
mov edx, dword [rsp + 0x7c]
lea rcx, [r15 + 0x58]
call fcn.1401fde50
mov edx, dword [rbp - 0x34]
lea rcx, [r15 + 0x68]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x34]
mov eax, dword [r15 + 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x68]
call fcn.1402ba94c
mov edx, dword [rbp - 0x34]
lea rcx, [r15 + 0x68]
call fcn.1401fde50
mov edx, dword [rsp + 0x5c]
lea rcx, [r15 + 0x78]
call fcn.1401fcb40
movsxd r9, dword [rsp + 0x5c]
mov eax, dword [r15 + 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x50]
mov rcx, qword [r15 + 0x78]
call fcn.1402ba94c
mov edx, dword [rsp + 0x5c]
lea rcx, [r15 + 0x78]
call fcn.1401fde50
nop
jmp 0x1401dff3c
mov r15, r12
test r14b, 2
je 0x1401dff58
and r14d, 0xfffffffd
cmp dword [rsp + 0x78], 0
jle 0x1401dff58
mov rcx, qword [rsp + 0x70]
call fcn.1402b7350
nop
test r14b, 1
je 0x1401dff73
and r14d, 0xfffffffe
cmp dword [rsp + 0x58], 0
jle 0x1401dff73
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
mov rdx, r15
mov rcx, qword [r13 + 8]
call fcn.1400f8580
lea rdx, [r15 + 8]
mov rcx, qword [r13 + 8]
call fcn.140110c70
movzx edi, al
test al, al
sete r12b
movzx edx, r12b
mov rcx, r15
call fcn.1400d7a00
mov rcx, r15
call fcn.1400d95a0
mov rsi, rax
mov rcx, rax
call fcn.1400e3810
mov dword [rbp + 0xe8], 7
movzx ecx, byte [0x140429189]
mov byte [rsp + 0x20], cl
lea r9, [rbp + 0xe8]
lea rdx, [rbp + 0x58]
lea rcx, [rsi + 0x18]
call fcn.1400e3a70
mov dword [rbp - 0x58], 8
movzx edx, byte [0x140429189]
mov byte [rsp + 0x20], dl
lea r9, [rbp - 0x58]
lea rdx, [rbp + 0x68]
lea rcx, [rsi + 0x18]
call fcn.1400e3a70
mov dword [rbp - 0x60], 0xc
movzx eax, byte [0x140429189]
mov byte [rsp + 0x20], al
lea r9, [rbp - 0x60]
lea rdx, [rbp + 0x78]
lea rcx, [rsi + 0x18]
call fcn.1400e3a70
xor edx, edx
test dil, dil
setne dl
add edx, 7
mov rcx, rsi
call fcn.1400e3730
cmp byte [rsi + 0xa], 1
je 0x1401e006b
mov byte [rsi + 0xa], 1
cmp byte [rsi + 8], 0
je 0x1401e006b
mov rax, qword [rsi]
mov rdx, qword [0x140428b78]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 1
lea rcx, [rdx + 0x388]
lea r8, [rbp - 0x20]
call fcn.1401188e0
cmp byte [rsi + 9], r12b
je 0x1401e00a0
mov byte [rsi + 9], r12b
cmp byte [rsi + 8], 0
je 0x1401e00a0
mov rax, qword [rsi]
mov rdx, qword [0x140428b78]
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 2
lea rcx, [rdx + 0x388]
lea r8, [rbp - 0x10]
call fcn.1401188e0
mov dl, 1
mov rcx, rsi
call fcn.1400e37a0
nop
cmp dword [rbp - 0x38], 0
jle 0x1401e00bb
mov rcx, qword [rbp - 0x40]
call fcn.1402b7350
nop
cmp dword [rsp + 0x68], 0
jle 0x1401e00cc
mov rcx, qword [rsp + 0x60]
call fcn.1402b7350
lea rsi, [0x140346ce0]
xor r12d, r12d
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x48]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
je 0x1401dfc60
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1401e0110
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1401e011f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1401e012f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
cmp dword [rbp - 0x68], 0
jle 0x1401e013e
mov rcx, qword [rbp - 0x70]
call fcn.1402b7350
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret