Function at 0x673210
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
xor ebp, ebp
call fcn.00673200
mov esi, dword [eax]
inc dword [eax]
test esi, esi
je 0x673230
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
xor ebx, ebx
mov edi, 0x7d95a8
push edi
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
add edi, 0x18
inc ebx
cmp ebx, 6
jl 0x673237
push 8
call fcn.006618c0
pop ecx
mov dword [0x7f9f70], eax
test eax, eax
je 0x67329f
push 0xfffffffffffffff6
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea ebx, [esp + 4]
push ebx
push eax
call fcn.006731b0
pop ecx
pop ecx
test eax, eax
je 0x673280
mov eax, dword [0x7f9f70]
or dword [eax], 0xffffffff
jmp 0x67328c
mov edi, dword [0x7f9f70]
mov eax, dword [esp + 4]
mov dword [edi], eax
mov ecx, dword [0x7f9f70]
mov byte [ecx + 4], 1
mov eax, dword [0x7f9f70]
mov byte [eax + 5], 0
push 8
call fcn.006618c0
pop ecx
mov dword [0x7f9f74], eax
test eax, eax
je 0x6732f2
push 0xfffffffffffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea edx, [esp + 4]
push edx
push eax
call fcn.006731b0
pop ecx
pop ecx
test eax, eax
je 0x6732d3
mov eax, dword [0x7f9f74]
or dword [eax], 0xffffffff
jmp 0x6732df
mov esi, dword [0x7f9f74]
mov eax, dword [esp + 4]
mov dword [esi], eax
mov ebx, dword [0x7f9f74]
mov byte [ebx + 4], 1
mov eax, dword [0x7f9f74]
mov byte [eax + 5], 0
push 8
call fcn.006618c0
pop ecx
mov dword [0x7f9f78], eax
test eax, eax
je 0x673345
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea edi, [esp + 4]
push edi
push eax
call fcn.006731b0
pop ecx
pop ecx
test eax, eax
je 0x673326
mov eax, dword [0x7f9f78]
or dword [eax], 0xffffffff
jmp 0x673332
mov ecx, dword [0x7f9f78]
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov edx, dword [0x7f9f78]
mov byte [edx + 4], 1
mov eax, dword [0x7f9f78]
mov byte [eax + 5], 0
mov dword [0x9786a8], 3
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov esi, eax
mov dword [esp], esi
jmp 0x673373
mov edi, esi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
add esi, eax
cmp byte [esi], 0x3d
je 0x673360
mov ebx, esi
jmp 0x673393
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x673380
sub ebx, esi
inc ebx
push ebx
call fcn.006618c0
pop ecx
mov dword [0x78a624], eax
test eax, eax
je 0x6733b6
push ebx
push esi
push eax
call fcn.0064dc40
add esp, 0xc
mov dword [0x974b74], 0x78a624
mov eax, dword [0x974b74]
mov edx, dword [eax]
jmp 0x6733e4
inc ebp
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
add edx, eax
cmp byte [edx], 0
jne 0x6733d0
inc ebp
lea ebp, [ebp*4]
push ebp
call fcn.006618c0
pop ecx
mov dword [0x978794], eax
mov eax, dword [0x974b74]
mov ebx, dword [eax]
xor edx, edx
jmp 0x673424
mov eax, dword [0x978794]
mov dword [eax + edx*4], ebx
inc edx
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x673408
mov eax, dword [0x978794]
mov dword [eax + edx*4], 0
push dword [esp]
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret