Function at 0x140004d54
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x280
mov rax, qword [0x14000c078]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor r15d, r15d
mov r13, rdx
mov qword [rsp + 0x50], r15
mov rbx, rcx
mov ebp, r15d
mov esi, r15d
test rdx, rdx
jne 0x140004da2
mov ebx, 0x80070057
jmp 0x140005012
mov ecx, 0x30
call fcn.14000735c
mov rdi, rax
test rax, rax
je 0x140004dcd
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
jmp 0x140004dd0
mov rdi, r15
test rdi, rdi
jne 0x140004ddf
mov ebx, 0x8007000e
jmp 0x140005012
test rbx, rbx
je 0x140004dea
cmp word [rbx], r15w
jne 0x140004df1
lea rbx, [0x140009f90]
lea rax, str.rootcimv2_securitymicrosofttpm
mov qword [rdi], rbx
lea rcx, str.Win32_Tpm
mov qword [rdi + 8], rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x140004e78
mov ebx, 0x8007000e
mov rcx, rdi
call fcn.140004cc8
test ebx, ebx
js 0x140004ff0
lea r8, [rsp + 0x50]
mov rcx, rbp
call fcn.140005a64
mov ebx, eax
test eax, eax
js 0x140004feb
mov ecx, 0x20
call fcn.14000735c
mov rdi, rax
test rax, rax
je 0x140004f9b
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
lea rax, [0x140009010]
mov qword [rdi], rax
jmp 0x140004f9e
xor edx, edx
lea r12, [rdi + 0x10]
lea r9, [0x140009fc8]
mov qword [rsp + 0x20], r12
lea rcx, [0x140009fb8]
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140004f8b
mov rax, qword [rdi + 8]
lea r8, str._s_s
mov r9, qword [rdi]
lea rcx, [rsp + 0x60]
mov edx, 0x105
mov qword [rsp + 0x20], rax
call fcn.14000126c
mov ebx, eax
test eax, eax
js 0x140004f8b
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
xor edx, edx
mov r15, rax
test rax, rax
jne 0x140004efc
mov ebx, 0x8007000e
jmp 0x140004e20
mov rcx, qword [r12]
xor r9d, r9d
lea r12, [rdi + 0x18]
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rdx
mov rax, qword [rcx]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdx
mov rdx, r15
mov rax, qword [rax + 0x18]
call qword [0x1400094f8]
mov ebx, eax
test eax, eax
js 0x140004f79
mov rcx, qword [r12]
call fcn.140006c1c
mov ebx, eax
test eax, eax
js 0x140004f79
mov r10, qword [r12]
lea rcx, [rdi + 0x20]
and qword [rsp + 0x28], rsi
xor r9d, r9d
mov rdx, qword [rdi + 0x28]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, r10
mov rax, qword [r10]
mov rax, qword [rax + 0x30]
call qword [0x1400094f8]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
xor r15d, r15d
test ebx, ebx
js 0x140004e20
mov rbp, rdi
jmp 0x140004e28
mov rdi, r15
mov rsi, qword [rsp + 0x50]
test rdi, rdi
jne 0x140004faf
mov ebx, 0x8007000e
jmp 0x140004ff0
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.1400066bc
mov ebx, eax
test eax, eax
js 0x140004fd0
mov qword [r13], rdi
mov rbp, r15
mov rdi, r15
mov rsi, r15
test rdi, rdi
je 0x140004ff0
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
mov rax, qword [rax]
call qword [0x1400094f8]
jmp 0x140004ff0
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x140005005
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x10]
call qword [0x1400094f8]
test rbp, rbp
je 0x140005012
mov rcx, rbp
call fcn.140004cc8
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140007750
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret