Function at 0x75b86c7dc
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov rsi, rcx
xor r15d, r15d
cmp byte [rcx + 0x88], r15b
jne 0x75b86cb78
lea r13d, [r15 + 1]
or r12d, 0xffffffff
mov r14b, r15b
mov rax, qword [rsi + 0x10]
mov r9, qword [rsi + 0x40]
mov r8d, 5
mov dl, r13b
mov rcx, qword [rax + 0x10]
call fcn.75b8a3394
mov ebx, eax
test eax, eax
js 0x75b86c86f
mov dword [rbp + 0x50], r15d
lea rcx, [rbp + 0x50]
call fcn.75b857820
nop
cmp dword [rbp + 0x50], r15d
je 0x75b86cb78
mov dword [rbp + 0x48], r15d
mov r8d, 2
lea rdx, [rbp + 0x48]
lea rcx, str.MpConfigUt_53E7E780_2330_40C6_94C6_BE75E946E933
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x75b86cb78
mov r14b, r13b
lea rdi, [rsi + 0x18]
cmp qword [rdi + 0x18], 8
jb 0x75b86c87d
mov rdi, qword [rdi]
cmp ebx, 0x800703fa
je 0x75b86c8cb
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b86c8c1
test byte [rcx + 0x1c], r13b
je 0x75b86c8c1
mov edx, 0x26
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x75b8f52c0]
mov rcx, qword [rcx + 0x10]
call fcn.75b81c350
mov rcx, qword [0x75b91c090]
test ebx, ebx
js 0x75b86cb8f
jmp 0x75b86c8d2
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b86c901
test byte [rcx + 0x1c], 2
je 0x75b86c901
mov edx, 0x27
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x75b8f52c0]
mov rcx, qword [rcx + 0x10]
call fcn.75b81c350
nop
call fcn.75b857810
nop
test eax, eax
je 0x75b86c9e1
mov qword [rsp + 0x28], r15
mov r9d, 0x10
mov r8, rdi
mov rdx, qword [rsi + 0x38]
lea rcx, [rbp + 0x60]
call fcn.75b8bd594
mov rbx, qword [rbp + 0x60]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rdx + 0x10]
mov rax, qword [rbx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [rbx + 0x10], rcx
mov r10, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp r10, rax
je 0x75b86c9a3
test byte [r10 + 0x1c], 4
je 0x75b86c9a3
lea rax, [0x75b8df4a0]
mov rcx, qword [rsi + 0x38]
cmp qword [rax], rcx
je 0x75b86c985
add rax, 0x10
lea rdx, [0x75b8df540]
cmp rax, rdx
jne 0x75b86c967
lea r9, str.HKNA
jmp 0x75b86c989
mov r9, qword [rax + 8]
mov edx, 0x28
mov qword [rsp + 0x20], rdi
lea r8, [0x75b8f52c0]
mov rcx, qword [r10 + 0x10]
call fcn.75b8050d4
test rbx, rbx
je 0x75b86c80e
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86c80e
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
mov edx, r13d
mov rax, qword [rax]
call qword [0x75b8e0a70]
jmp 0x75b86c80e
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x20], r13b
mov r9d, 0x10
mov r8, rdi
mov rdx, qword [rsi + 0x38]
lea rcx, [rbp + 0x58]
call fcn.75b8bd63c
nop
mov rbx, qword [rbp + 0x58]
test rbx, rbx
je 0x75b86ca43
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rdx + 0x10]
mov rax, qword [rbx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [rbx + 0x10], rcx
test r14b, r14b
jne 0x75b86ca43
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86c80e
mov rcx, qword [rbp + 0x58]
jmp 0x75b86c9c3
lea rcx, [0x75b925010]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [0x75b925068]
lea rcx, [0x75b925010]
test rdi, rdi
jne 0x75b86ca8f
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r14b, r14b
jne 0x75b86cb47
mov eax, 0x80070002
mov ecx, eax
shr eax, 0x1f
test al, al
jne 0x75b86cb89
test rbx, rbx
je 0x75b86c80e
jmp 0x75b86ca2a
lock add dword [rdi + 8], r13d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [0x75b9251e5], r15b
je 0x75b86cad4
mov eax, r12d
lock xadd dword [rdi + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86cb43
mov rax, qword [rdi]
movabs r10, 0xe5453fe31659f270
mov edx, r13d
mov rcx, rdi
mov rax, qword [rax]
call qword [0x75b8e0a70]
jmp 0x75b86cb43
mov byte [0x75b9251e5], r13b
lea rbx, [rdi + 0x20]
cmp qword [rbx], r15
jne 0x75b86cb18
mov r8, rdi
lea rdx, [0x75b858a10]
mov rcx, rbx
call fcn.75b89e188
cmp qword [rbx], r15
jne 0x75b86cb18
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
movabs r10, 0xa7ed1f9372d1f970
xor edx, edx
mov rax, qword [rax + 0x20]
call qword [0x75b8e0a70]
mov eax, r12d
lock xadd dword [rdi + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86cb43
mov rax, qword [rdi]
movabs r10, 0xe5453fe31659f270
mov edx, r13d
mov rcx, rdi
mov rax, qword [rax]
call qword [0x75b8e0a70]
mov rbx, qword [rbp + 0x58]
test rbx, rbx
je 0x75b86cb78
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
test eax, eax
jg 0x75b86cb78
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
mov edx, r13d
mov rax, qword [rax]
call qword [0x75b8e0a70]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.75b89ca74
nop
mov ecx, ebx
call fcn.75b89ca74
int3