Function at 0x6731c0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
xor ebp, ebp
call fcn.006731b0
mov esi, dword [eax]
inc dword [eax]
test esi, esi
je 0x6731e0
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
xor ebx, ebx
mov edi, 0x7d95a0
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add edi, 0x18
inc ebx
cmp ebx, 6
jl 0x6731e7
push 8
call fcn.00661870
pop ecx
mov dword [0x7f9f68], eax
test eax, eax
je 0x67324f
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ebx, [esp + 4]
push ebx
push eax
call fcn.00673160
pop ecx
pop ecx
test eax, eax
je 0x673230
mov eax, dword [0x7f9f68]
or dword [eax], 0xffffffff
jmp 0x67323c
mov edi, dword [0x7f9f68]
mov eax, dword [esp + 4]
mov dword [edi], eax
mov ecx, dword [0x7f9f68]
mov byte [ecx + 4], 1
mov eax, dword [0x7f9f68]
mov byte [eax + 5], 0
push 8
call fcn.00661870
pop ecx
mov dword [0x7f9f6c], eax
test eax, eax
je 0x6732a2
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [esp + 4]
push edx
push eax
call fcn.00673160
pop ecx
pop ecx
test eax, eax
je 0x673283
mov eax, dword [0x7f9f6c]
or dword [eax], 0xffffffff
jmp 0x67328f
mov esi, dword [0x7f9f6c]
mov eax, dword [esp + 4]
mov dword [esi], eax
mov ebx, dword [0x7f9f6c]
mov byte [ebx + 4], 1
mov eax, dword [0x7f9f6c]
mov byte [eax + 5], 0
push 8
call fcn.00661870
pop ecx
mov dword [0x7f9f70], eax
test eax, eax
je 0x6732f5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edi, [esp + 4]
push edi
push eax
call fcn.00673160
pop ecx
pop ecx
test eax, eax
je 0x6732d6
mov eax, dword [0x7f9f70]
or dword [eax], 0xffffffff
jmp 0x6732e2
mov ecx, dword [0x7f9f70]
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov edx, dword [0x7f9f70]
mov byte [edx + 4], 1
mov eax, dword [0x7f9f70]
mov byte [eax + 5], 0
mov dword [0x9786a0], 3
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
mov dword [esp], esi
jmp 0x673323
mov edi, esi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
add esi, eax
cmp byte [esi], 0x3d
je 0x673310
mov ebx, esi
jmp 0x673343
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x673330
sub ebx, esi
inc ebx
push ebx
call fcn.00661870
pop ecx
mov dword [0x78a61c], eax
test eax, eax
je 0x673366
push ebx
push esi
push eax
call fcn.0064dbf0
add esp, 0xc
mov dword [0x974b6c], 0x78a61c
mov eax, dword [0x974b6c]
mov edx, dword [eax]
jmp 0x673394
inc ebp
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
add edx, eax
cmp byte [edx], 0
jne 0x673380
inc ebp
lea ebp, [ebp*4]
push ebp
call fcn.00661870
pop ecx
mov dword [0x97878c], eax
mov eax, dword [0x974b6c]
mov ebx, dword [eax]
xor edx, edx
jmp 0x6733d4
mov eax, dword [0x97878c]
mov dword [eax + edx*4], ebx
inc edx
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x6733b8
mov eax, dword [0x97878c]
mov dword [eax + edx*4], 0
push dword [esp]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret