Function at 0x1402dbb00
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14, rcx
xor r15d, r15d
mov qword [rbp - 0x29], r15
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea r9, [0x14038ab18]
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [0x14038ab08]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
jns 0x1402dbb74
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
lea edx, [r15 + 0x2d]
call fcn.140047668
jmp 0x1402dbef2
mov qword [rbp + 0x6f], r15
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
lea rdx, [rbp + 0x6f]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ROOTMicrosoftWindowsCI
mov rax, qword [rax + 0x18]
call qword [case.0x140245398.0]
mov esi, eax
test eax, eax
jns 0x1402dbbc0
mov edx, 0x30
jmp 0x1402dbbfd
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov r12d, 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea r13d, [r12 + 7]
mov edx, r13d
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test eax, eax
jns 0x1402dbc15
lea edx, [r12 + 0x2f]
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
mov r9d, eax
mov rcx, qword [rbp + 0x5f]
call fcn.140047668
jmp 0x1402dbedb
lea rcx, str.Update
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x17], rax
test rax, rax
je 0x1402dbf25
lea rcx, str.PS_UpdateAndCompareCIPolicy
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp + 0x1f], rax
test rax, rax
je 0x1402dbf30
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], r15
mov qword [rbp + 0x77], r15
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
lea rdx, [rbp - 0x31]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rax + 0x30]
call qword [case.0x140245398.0]
mov esi, eax
test eax, eax
jns 0x1402dbc90
mov edx, 0x3b
jmp 0x1402dbce2
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rax + 0x98]
call qword [case.0x140245398.0]
mov esi, eax
test eax, eax
jns 0x1402dbcc0
mov edx, 0x3c
jmp 0x1402dbce2
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
lea r8, [rbp + 0x77]
xor edx, edx
mov rax, qword [rax + 0x78]
call qword [case.0x140245398.0]
mov esi, eax
test eax, eax
jns 0x1402dbcfa
mov edx, 0x3d
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
call fcn.140047668
jmp 0x1402dbe82
mov esi, 8
cmp qword [r14 + 0x18], rsi
jb 0x1402dbd08
mov r14, qword [r14]
mov word [rbp - 0x21], r15w
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rbp - 0x21], si
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x19], rax
test rax, rax
jne 0x1402dbd36
test r14, r14
jne 0x1402dbf3b
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 0x21]
xor r8d, r8d
lea rdx, [0x14034ac08]
mov rax, qword [rax + 0x28]
call qword [case.0x140245398.0]
mov esi, eax
test eax, eax
jns 0x1402dbd7d
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
mov edx, 0x43
call fcn.140047668
jmp 0x1402dbe77
mov qword [rbp + 0x7f], r15
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx]
mov r10, qword [rax + 0xc0]
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rbx
mov rdx, rdi
mov rax, r10
call qword [case.0x140245398.0]
mov esi, eax
test eax, eax
jns 0x1402dbde0
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
mov edx, 0x46
call fcn.140047668
jmp 0x1402dbe60
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, str.ReturnValue
mov rax, qword [rax + 0x20]
call qword [case.0x140245398.0]
mov esi, eax
test eax, eax
jns 0x1402dbe34
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_srcdeviceguardutils.cpp
mov edx, VarR8FromUI1
call fcn.140047668
jmp 0x1402dbe55
mov eax, dword [rbp - 1]
cmp word [rbp - 9], r12w
jne 0x1402dbe47
test eax, eax
jne 0x1402dbe47
mov esi, r15d
jmp 0x1402dbe55
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1402dbe77
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140245398.0]
nop
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x1402dbe99
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140245398.0]
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1402dbeb0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140245398.0]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1402dbec7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140245398.0]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x1402dbef2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140245398.0]
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1402dbf08
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x140245398.0]
mov eax, esi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1401ca0c0
nop
mov ecx, 0x8007000e
call fcn.1401ca0c0
nop
mov word [rbp - 0x21], r13w
mov dword [rbp - 0x19], 0x8007000e
mov ecx, 0x8007000e
call fcn.1401ca0c0
int3