Function at 0x567d30
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb6ad
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.Repairing_the_Windows_Management_Instrumentation__WMI_...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, esi
call fcn.005494d0
mov ecx, esi
call fcn.0056aac0
push 0
push 1
mov ecx, esi
call fcn.005494d0
test eax, eax
jne 0x567dff
movsd xmm0, qword [0x6edac8]
comisd xmm0, xmmword [esi]
jbe 0x567da2
mov ecx, esi
call fcn.0056a8e0
push 0
push 1
mov ecx, esi
call fcn.005494d0
test eax, eax
jne 0x567dff
sub esp, 8
mov dword [ebp - 0x1c], eax
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.wbemwinmgmt.exe__salvagerepository
push dword [esi + 0x44]
call fcn.005dc520
push 0
push 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0057b4f0
cmp eax, 0xffffffff
jne 0x567e1f
lea ecx, [ebp - 0x24]
call fcn.005dc430
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x40], str.wbemcons
xor edi, edi
mov dword [ebp - 0x3c], str.wbemcore
mov dword [ebp - 0x38], str.wbemess
mov dword [ebp - 0x34], str.wbemsvc
mov dword [ebp - 0x30], str.wmiprvsd
mov dword [ebp - 0x2c], str.wmisvc
mov dword [ebp - 0x28], str.wmiutils
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..dll
push dword [ebp + edi*4 - 0x40]
lea ecx, [ebp - 0x24]
push str.wbem_
push dword [esi + 0x44]
call fcn.005dc200
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov ecx, eax
call fcn.005e5910
inc edi
cmp edi, 7
jl 0x567e52
movsd xmm3, qword [esi]
mov edx, 2
push 0
mov ecx, str.Winmgmt
call fcn.0058f7a0
movsd xmm3, qword [esi]
mov edx, 3
push 0xffffffffffffffff
mov ecx, str.wmiApSrv
call fcn.0058f7a0
call fcn.0058c0c0
push 0x38
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00420090
add esp, 8
lea ecx, [ebp - 0x7c]
push str.ROOTCIMV2
call fcn.005889d0
push str.SELECT__FROM_Win32_OperatingSystem
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 1
call fcn.005887d0
xor ebx, ebx
mov edx, str.Failed_to_repair
test eax, eax
mov ecx, str.Successfully_repaired
push 0
setne bl
test eax, eax
push 0
cmove ecx, edx
push str._the_Windows_Management_Instrumentation__WMI_.
push ecx
mov ecx, esi
call fcn.0057b7e0
lea ecx, [ebp - 0x7c]
call fcn.00588a50
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.005dc430
push 0
push 1
mov ecx, esi
call fcn.005494d0
test eax, eax
jne 0x5680fa
push str.Repairing_and_enabling_the_System_Restore...
push 0xffffffffffffffff
mov ecx, esi
call fcn.0057b610
push 0
push 1
mov ecx, esi
call fcn.005494d0
test eax, eax
jne 0x5680fa
push 1
push eax
push str.SFCDisable
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.00553890
cmp byte [esi + 0x48], 0
je 0x567f8a
push 1
push 0
push str.SFCDisable
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.00553890
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d6aa0
push 0
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_NTSystemRestore
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 2
call fcn.005d55d0
push str.DisableSR
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
lea ecx, [ebp - 0x18]
call fcn.005d55d0
push 1
push 1
push str.RPSessionInterval
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
call fcn.00553890
movsd xmm3, qword [esi]
mov edx, 2
push 0xffffffffffffffff
mov ecx, str.srservice
call fcn.0058f7a0
movsd xmm3, qword [esi]
mov edx, 2
push 0xffffffffffffffff
mov ecx, str.RpcSs
call fcn.0058f7a0
movsd xmm3, qword [esi]
mov edx, 3
push 0xffffffffffffffff
mov ecx, 0x63bb64
call fcn.0058f7a0
movsd xmm0, qword [0x6edab0]
comisd xmm0, xmmword [esi]
push ecx
push 0x10
mov ecx, esi
jbe 0x56802d
push str.srservice
jmp 0x568032
push 0x63bb64
call fcn.00553620
call fcn.0058c0c0
push 0x38
lea eax, [ebp - 0xb4]
push 0
push eax
call fcn.00420090
add esp, 8
lea ecx, [ebp - 0xb4]
push str.root_default
call fcn.005889d0
push 1
push str.Drive
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.005dc570
mov eax, 8
mov byte [ebp - 4], 4
push 0x62439c
mov word [ebp - 0x34], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x568101
push 0
push ecx
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
push str.Enable
push ecx
lea ecx, [ebp - 0xb4]
call fcn.00588660
test al, al
je 0x5680b4
add ebx, 2
push 0
push 0
test bl, 2
mov ecx, str.Failed_to_repair_and_enable
mov eax, str.Successfully_repaired_and_enabled
cmove eax, ecx
mov ecx, esi
push str._the_System_Restore.
push eax
call fcn.0057b7e0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x44]
call fcn.005dc430
lea ecx, [ebp - 0xb4]
call fcn.00588a50
lea ecx, [ebp - 0x18]
call fcn.005d69e0
mov eax, ebx
jmp 0x567e01
push 0x8007000e
call fcn.0041de50
int3