import re, sys
data = open(sys.argv[1], "rb").read()
text = data[: len(data) // 2 * 2].decode("utf-16-le", errors="replace")
# Unicode NSIS keeps a variable reference as one char NS_VAR_CODE (U+0003) + one char whose
# low 15 bits carry the index (high bit set); literal "$pid" text would survive as "$pid".
def show(s):
    def rep(m):
        kind = {"\x01": "LANG", "\x02": "SHELL", "\x03": "VAR", "\x04": "SKIP"}[m.group(1)]
        return "<NS_%s #%d>" % (kind, ord(m.group(2)) & 0x7FFF)
    return re.sub(r"([\x01-\x04])(.)", rep, s, flags=re.S)
hits = re.findall(r'Get-CimInstance[^"]{0,250}', text)
print("%s: %d Get-CimInstance string(s) (UTF-16LE)" % (sys.argv[1], len(hits)))
for h in hits:
    print("  " + show(h))
    print("    codepoints near -ne:", [hex(ord(c)) for c in h[h.find("-ne") + 3 : h.find("-ne") + 7]] if "-ne" in h else "-")
print("literal '$pid' text present:", "$pid" in text)
for m in re.finditer(r'Get-CimInstance -ClassName', text):
    print("prefix before Get-CimInstance -ClassName:", repr(text[m.start() - 6 : m.start()]))
for h in re.findall(r'PID ne [^"]{0,6}', text):
    print("taskkill filter (same var expected):", show(h))