Function at 0x1402aad1c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14, rcx
xor r15d, r15d
mov qword [rbp - 0x29], r15
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea r9, [0x14034f878]
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [0x14034f868]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
jns 0x1402aad90
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
lea edx, [r15 + 0x2d]
call fcn.1400449f8
jmp 0x1402ab10e
mov qword [rbp + 0x6f], r15
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
lea rdx, [rbp + 0x6f]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ROOTMicrosoftWindowsCI
mov rax, qword [rax + 0x18]
call qword [str.PM_]
mov esi, eax
test eax, eax
jns 0x1402aaddc
mov edx, 0x30
jmp 0x1402aae19
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov r12d, 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea r13d, [r12 + 7]
mov edx, r13d
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test eax, eax
jns 0x1402aae31
lea edx, [r12 + 0x2f]
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
mov r9d, eax
mov rcx, qword [rbp + 0x5f]
call fcn.1400449f8
jmp 0x1402ab0f7
lea rcx, str.Update
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x17], rax
test rax, rax
je 0x1402ab141
lea rcx, str.PS_UpdateAndCompareCIPolicy
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp + 0x1f], rax
test rax, rax
je 0x1402ab14c
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], r15
mov qword [rbp + 0x77], r15
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
lea rdx, [rbp - 0x31]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rax + 0x30]
call qword [str.PM_]
mov esi, eax
test eax, eax
jns 0x1402aaeac
mov edx, 0x3b
jmp 0x1402aaefe
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rax + 0x98]
call qword [str.PM_]
mov esi, eax
test eax, eax
jns 0x1402aaedc
mov edx, 0x3c
jmp 0x1402aaefe
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
lea r8, [rbp + 0x77]
xor edx, edx
mov rax, qword [rax + 0x78]
call qword [str.PM_]
mov esi, eax
test eax, eax
jns 0x1402aaf16
mov edx, 0x3d
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
call fcn.1400449f8
jmp 0x1402ab09e
mov esi, 8
cmp qword [r14 + 0x18], rsi
jb 0x1402aaf24
mov r14, qword [r14]
mov word [rbp - 0x21], r15w
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rbp - 0x21], si
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x19], rax
test rax, rax
jne 0x1402aaf52
test r14, r14
jne 0x1402ab157
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 0x21]
xor r8d, r8d
lea rdx, [0x140312eb0]
mov rax, qword [rax + 0x28]
call qword [str.PM_]
mov esi, eax
test eax, eax
jns 0x1402aaf99
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
mov edx, 0x43
call fcn.1400449f8
jmp 0x1402ab093
mov qword [rbp + 0x7f], r15
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx]
mov r10, qword [rax + 0xc0]
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rbx
mov rdx, rdi
mov rax, r10
call qword [str.PM_]
mov esi, eax
test eax, eax
jns 0x1402aaffc
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
mov edx, 0x46
call fcn.1400449f8
jmp 0x1402ab07c
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, str.ReturnValue
mov rax, qword [rax + 0x20]
call qword [str.PM_]
mov esi, eax
test eax, eax
jns 0x1402ab050
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
mov edx, VarR8FromUI1
call fcn.1400449f8
jmp 0x1402ab071
mov eax, dword [rbp - 1]
cmp word [rbp - 9], r12w
jne 0x1402ab063
test eax, eax
jne 0x1402ab063
mov esi, r15d
jmp 0x1402ab071
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1402ab093
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PM_]
nop
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x1402ab0b5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PM_]
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1402ab0cc
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PM_]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1402ab0e3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PM_]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x1402ab10e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PM_]
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1402ab124
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [str.PM_]
mov eax, esi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1401ba4f0
nop
mov ecx, 0x8007000e
call fcn.1401ba4f0
nop
mov word [rbp - 0x21], r13w
mov dword [rbp - 0x19], 0x8007000e
mov ecx, 0x8007000e
call fcn.1401ba4f0
int3