Function at 0x75b86b62c
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov rsi, rcx
xor r15d, r15d
cmp byte [rcx + 0x88], r15b
jne 0x75b86b9c8
lea r13d, [r15 + 1]
or r12d, 0xffffffff
mov r14b, r15b
mov rax, qword [rsi + 0x10]
mov r9, qword [rsi + 0x40]
mov r8d, 5
mov dl, r13b
mov rcx, qword [rax + 0x10]
call fcn.75b8a2094
mov ebx, eax
test eax, eax
js 0x75b86b6bf
mov dword [rbp + 0x50], r15d
lea rcx, [rbp + 0x50]
call fcn.75b856740
nop
cmp dword [rbp + 0x50], r15d
je 0x75b86b9c8
mov dword [rbp + 0x48], r15d
mov r8d, 2
lea rdx, [rbp + 0x48]
lea rcx, str.MpConfigUt_53E7E780_2330_40C6_94C6_BE75E946E933
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x75b86b9c8
mov r14b, r13b
lea rdi, [rsi + 0x18]
cmp qword [rdi + 0x18], 8
jb 0x75b86b6cd
mov rdi, qword [rdi]
cmp ebx, 0x800703fa
je 0x75b86b71b
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b86b711
test byte [rcx + 0x1c], r13b
je 0x75b86b711
mov edx, 0x26
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x75b8f3970]
mov rcx, qword [rcx + 0x10]
call fcn.75b81bf90
mov rcx, qword [0x75b91a090]
test ebx, ebx
js 0x75b86b9df
jmp 0x75b86b722
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b86b751
test byte [rcx + 0x1c], 2
je 0x75b86b751
mov edx, 0x27
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x75b8f3970]
mov rcx, qword [rcx + 0x10]
call fcn.75b81bf90
nop
call fcn.75b856730
nop
test eax, eax
je 0x75b86b831
mov qword [rsp + 0x28], r15
mov r9d, 0x10
mov r8, rdi
mov rdx, qword [rsi + 0x38]
lea rcx, [rbp + 0x60]
call fcn.75b8bc0f4
mov rbx, qword [rbp + 0x60]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rdx + 0x10]
mov rax, qword [rbx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [rbx + 0x10], rcx
mov r10, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp r10, rax
je 0x75b86b7f3
test byte [r10 + 0x1c], 4
je 0x75b86b7f3
lea rax, [0x75b8ddfe0]
mov rcx, qword [rsi + 0x38]
cmp qword [rax], rcx
je 0x75b86b7d5
add rax, 0x10
lea rdx, [0x75b8de080]
cmp rax, rdx
jne 0x75b86b7b7
lea r9, str.HKNA
jmp 0x75b86b7d9
mov r9, qword [rax + 8]
mov edx, 0x28
mov qword [rsp + 0x20], rdi
lea r8, [0x75b8f3970]
mov rcx, qword [r10 + 0x10]
call fcn.75b805094
test rbx, rbx
je 0x75b86b65e
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86b65e
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
mov edx, r13d
mov rax, qword [rax]
call qword [0x75b8df5b0]
jmp 0x75b86b65e
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x20], r13b
mov r9d, 0x10
mov r8, rdi
mov rdx, qword [rsi + 0x38]
lea rcx, [rbp + 0x58]
call fcn.75b8bc19c
nop
mov rbx, qword [rbp + 0x58]
test rbx, rbx
je 0x75b86b893
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rdx + 0x10]
mov rax, qword [rbx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [rbx + 0x10], rcx
test r14b, r14b
jne 0x75b86b893
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86b65e
mov rcx, qword [rbp + 0x58]
jmp 0x75b86b813
lea rcx, [0x75b922f90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [0x75b922fe8]
lea rcx, [0x75b922f90]
test rdi, rdi
jne 0x75b86b8df
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r14b, r14b
jne 0x75b86b997
mov eax, 0x80070002
mov ecx, eax
shr eax, 0x1f
test al, al
jne 0x75b86b9d9
test rbx, rbx
je 0x75b86b65e
jmp 0x75b86b87a
lock add dword [rdi + 8], r13d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [0x75b922ecd], r15b
je 0x75b86b924
mov eax, r12d
lock xadd dword [rdi + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86b993
mov rax, qword [rdi]
movabs r10, 0xe5453fe31659f270
mov edx, r13d
mov rcx, rdi
mov rax, qword [rax]
call qword [0x75b8df5b0]
jmp 0x75b86b993
mov byte [0x75b922ecd], r13b
lea rbx, [rdi + 0x20]
cmp qword [rbx], r15
jne 0x75b86b968
mov r8, rdi
lea rdx, [0x75b857930]
mov rcx, rbx
call fcn.75b89ce88
cmp qword [rbx], r15
jne 0x75b86b968
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
movabs r10, 0xa7ed1f9372d1f970
xor edx, edx
mov rax, qword [rax + 0x20]
call qword [0x75b8df5b0]
mov eax, r12d
lock xadd dword [rdi + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86b993
mov rax, qword [rdi]
movabs r10, 0xe5453fe31659f270
mov edx, r13d
mov rcx, rdi
mov rax, qword [rax]
call qword [0x75b8df5b0]
mov rbx, qword [rbp + 0x58]
test rbx, rbx
je 0x75b86b9c8
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86b9c8
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
mov edx, r13d
mov rax, qword [rax]
call qword [0x75b8df5b0]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.75b89b774
nop
mov ecx, ebx
call fcn.75b89b774
int3