Function at 0x1401ce140
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov r13, rcx
xor r12d, r12d
mov dword [rbp + 0xd8], r12d
lea rsi, [0x140323de0]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x1402e8a28]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x1402e8af8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1401ce8f1
lea ecx, [rax + 0x18]
call fcn.14029806c
mov rbx, rax
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x1401ce201
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.root_subscription
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1401ce204
mov ecx, 0x8007000e
call fcn.1402b6260
int3
mov rbx, r12
mov qword [rbp + 0x20], rbx
test rbx, rbx
jne 0x1401ce218
mov ecx, 0x8007000e
call fcn.1402b6260
nop
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x1401ce27b
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401ce261
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401ce273
call fcn.1402983dc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402012c0
test edi, edi
jne 0x1401ce8f1
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0xa]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x1401ce8f1
lea r8, str.ActiveScriptEventConsumer
lea rdx, str.SELECT__FROM
lea rcx, [rbp]
call fcn.1401e7ee0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x70]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x68]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x70]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x70]
call fcn.1401ea290
nop
cmp dword [rbp + 8], edi
jle 0x1401ce311
mov rcx, qword [rbp]
call fcn.140298600
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x28]
call fcn.14011ce10
mov rdi, rax
mov ecx, 0x18
call fcn.14029806c
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1401ce353
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x14032d074]
call fcn.1402b6270
mov qword [rbx], rax
jmp 0x1401ce356
mov rbx, r12
mov qword [rbp + 0x18], rbx
test rbx, rbx
jne 0x1401ce36a
mov ecx, 0x8007000e
call fcn.1402b6260
nop
mov rax, qword [rdi]
test rax, rax
je 0x1401ce377
mov r8, qword [rax]
jmp 0x1401ce37a
mov r8, r12
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x1401ce3d2
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401ce3b7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401ce3c9
call fcn.1402983dc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402012c0
nop
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x1401ce411
lock dec dword [rbx + 0x10]
jne 0x1401ce411
test rbx, rbx
je 0x1401ce411
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401ce3f7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401ce409
call fcn.1402983dc
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.1402012c0
test edi, edi
jne 0x1401ce8f1
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x48]
lea r8d, [rdi + 1]
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
jne 0x1401ce8f1
mov r14d, dword [rbp + 0xd8]
nop dword [rax]
cmp dword [rbp + 0xe0], 0
jbe 0x1401ce8f1
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + 0x20]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x40]
xor r8d, r8d
lea rdx, str.ScriptText
call qword [rax + 0x20]
test eax, eax
jne 0x1401ce8c6
mov qword [rsp + 0x68], 0
lea edx, [rax + 4]
lea rcx, [rsp + 0x60]
call fcn.1401e9030
mov eax, dword [rsp + 0x68]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.WMI:
mov rcx, qword [rsp + 0x60]
call fcn.14029b4d8
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.1401ea290
nop
lea rdx, str.root_subscription
lea rcx, [rsp + 0x60]
call fcn.1401e7680
lea rdx, [0x1403232c8]
lea rcx, [rsp + 0x60]
call fcn.1401e7680
lea rdx, str.ActiveScriptEventConsumer
lea rcx, [rsp + 0x60]
call fcn.1401e7680
lea rdx, [0x1403232c8]
lea rcx, [rsp + 0x60]
call fcn.1401e7680
mov rdx, qword [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1401e7680
mov r9, qword [rbp + 0x30]
lea r8, str.ActiveScriptEventConsumer
lea rdx, str._ls.Name__ls_
lea rcx, [rbp - 0x40]
call fcn.1401e94c0
nop
mov ecx, 0x88
call fcn.14029806c
mov r15, rax
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x1401ce729
mov rdi, qword [rbp + 0x48]
test rdi, rdi
jne 0x1401ce58d
mov ebx, r12d
mov qword [rsp + 0x58], rdi
jmp 0x1401ce5a8
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401ce591
mov qword [rsp + 0x58], 0
test ebx, ebx
jne 0x1401ce5af
mov qword [rsp + 0x50], rsi
jmp 0x1401ce5d4
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsp + 0x58]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x50]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1401ea290
nop
or r14d, 1
mov dword [rbp + 0xd8], r14d
mov qword [rsp + 0x78], 0
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401e9030
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.root_subscription
mov rcx, qword [rsp + 0x70]
call fcn.14029b4d8
mov edx, 0x11
lea rcx, [rsp + 0x70]
call fcn.1401ea290
nop
or r14d, 2
mov dword [rbp + 0xd8], r14d
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1400d5b80
nop
lea rax, vtable.HitmanPro35::RepairWMI.0
mov qword [r15], rax
mov qword [r15 + 0x58], rsi
mov qword [r15 + 0x60], 0
mov qword [r15 + 0x68], rsi
mov qword [r15 + 0x70], 0
lea rax, [0x140323de0]
mov qword [r15 + 0x78], rax
mov qword [r15 + 0x80], 0
mov edx, dword [rsp + 0x7c]
lea rcx, [r15 + 0x58]
call fcn.1401e9030
movsxd r9, dword [rsp + 0x7c]
mov eax, dword [r15 + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x70]
mov rcx, qword [r15 + 0x58]
call fcn.14029b4d8
mov edx, dword [rsp + 0x7c]
lea rcx, [r15 + 0x58]
call fcn.1401ea290
mov edx, dword [rbp - 0x34]
lea rcx, [r15 + 0x68]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x34]
mov eax, dword [r15 + 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x68]
call fcn.14029b4d8
mov edx, dword [rbp - 0x34]
lea rcx, [r15 + 0x68]
call fcn.1401ea290
mov edx, dword [rsp + 0x5c]
lea rcx, [r15 + 0x78]
call fcn.1401e9030
movsxd r9, dword [rsp + 0x5c]
mov eax, dword [r15 + 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x50]
mov rcx, qword [r15 + 0x78]
call fcn.14029b4d8
mov edx, dword [rsp + 0x5c]
lea rcx, [r15 + 0x78]
call fcn.1401ea290
nop
jmp 0x1401ce72c
mov r15, r12
test r14b, 2
je 0x1401ce748
and r14d, 0xfffffffd
cmp dword [rsp + 0x78], 0
jle 0x1401ce748
mov rcx, qword [rsp + 0x70]
call fcn.140298600
nop
test r14b, 1
je 0x1401ce763
and r14d, 0xfffffffe
cmp dword [rsp + 0x58], 0
jle 0x1401ce763
mov rcx, qword [rsp + 0x50]
call fcn.140298600
mov rdx, r15
mov rcx, qword [r13 + 8]
call fcn.1400fa0f0
lea rdx, [r15 + 8]
mov rcx, qword [r13 + 8]
call fcn.1401119b0
movzx edi, al
test al, al
sete r12b
movzx edx, r12b
mov rcx, r15
call fcn.1400d4640
mov rcx, r15
call fcn.1400d61e0
mov rsi, rax
mov rcx, rax
call fcn.1400e0450
mov dword [rbp + 0xe8], 7
movzx ecx, byte [0x1403fdd76]
mov byte [rsp + 0x20], cl
lea r9, [rbp + 0xe8]
lea rdx, [rbp + 0x58]
lea rcx, [rsi + 0x18]
call fcn.1400e06b0
mov dword [rbp - 0x58], 8
movzx edx, byte [0x1403fdd76]
mov byte [rsp + 0x20], dl
lea r9, [rbp - 0x58]
lea rdx, [rbp + 0x68]
lea rcx, [rsi + 0x18]
call fcn.1400e06b0
mov dword [rbp - 0x60], 0xc
movzx eax, byte [0x1403fdd76]
mov byte [rsp + 0x20], al
lea r9, [rbp - 0x60]
lea rdx, [rbp + 0x78]
lea rcx, [rsi + 0x18]
call fcn.1400e06b0
xor edx, edx
test dil, dil
setne dl
add edx, 7
mov rcx, rsi
call fcn.1400e0370
cmp byte [rsi + 0xa], 1
je 0x1401ce85b
mov byte [rsi + 0xa], 1
cmp byte [rsi + 8], 0
je 0x1401ce85b
mov rax, qword [rsi]
mov rdx, qword [0x1403fd7a8]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 1
lea rcx, [rdx + 0x388]
lea r8, [rbp - 0x20]
call fcn.140119670
cmp byte [rsi + 9], r12b
je 0x1401ce890
mov byte [rsi + 9], r12b
cmp byte [rsi + 8], 0
je 0x1401ce890
mov rax, qword [rsi]
mov rdx, qword [0x1403fd7a8]
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 2
lea rcx, [rdx + 0x388]
lea r8, [rbp - 0x10]
call fcn.140119670
mov dl, 1
mov rcx, rsi
call fcn.1400e03e0
nop
cmp dword [rbp - 0x38], 0
jle 0x1401ce8ab
mov rcx, qword [rbp - 0x40]
call fcn.140298600
nop
cmp dword [rsp + 0x68], 0
jle 0x1401ce8bc
mov rcx, qword [rsp + 0x60]
call fcn.140298600
lea rsi, [0x140323de0]
xor r12d, r12d
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x48]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
je 0x1401ce450
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1401ce900
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1401ce90f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1401ce91f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
cmp dword [rbp - 0x68], 0
jle 0x1401ce92e
mov rcx, qword [rbp - 0x70]
call fcn.140298600
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret