Was able to take a look at https://github.com/osquery/osquery/pull/5479 . Looks good to me. Had a minor comment about usage of CoCreateInstance multiple times but found that not applicable in this case.