Function at 0x409000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x436c47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x568
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea eax, [esp + 0xc]
push edi
mov dword [esi + 0x9c], 1
mov dword [esi + 0x90], ebx
mov dword [esi + 0x8c], ebx
push eax
mov dword [0xe4c198], ebx
call fcn.00427b96
mov ecx, dword [eax]
xor eax, eax
mov dword [esi + 0xac], ecx
mov dl, byte [0xe4c18c]
mov ecx, 0x3f
lea edi, [esp + 0x55]
mov byte [esp + 0x54], dl
lea ebp, [esi + 0x94]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x109
xor eax, eax
lea edi, [esp + 0x154]
rep stosd dword es:[edi], eax
mov eax, dword [ebp]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea eax, [esp + 0x15c]
push eax
mov dword [esp + 0x15c], 0x424
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0xe47860
call fcn.0042a001
push ecx
mov dword [esp + 0x588], ebx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xe47c34
call fcn.0042a001
push ecx
mov byte [esp + 0x58c], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xe47bd8
call fcn.0042a001
lea ecx, [esp + 0x20]
mov dword [esp + 0x58c], 0xffffffff
push ecx
mov ecx, 0xe4c0b8
call fcn.00402590
mov eax, dword [eax]
push eax
call fcn.004169f6
add esp, 4
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00429f93
cmp ebx, 1
jne 0x40918a
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.00408980
mov ebx, eax
push 0xe47984
lea ecx, [esp + 0x1c]
mov dword [esp + 0x584], 2
call fcn.0042a001
push ebx
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x588], 3
push eax
call fcn.0042a1c2
mov eax, dword [eax]
lea ecx, [esp + 0x259]
push eax
push ecx
call edi
lea ecx, [esp + 0x14]
call fcn.00429f93
lea ecx, [esp + 0x18]
mov byte [esp + 0x580], 2
call fcn.00429f93
mov dword [esp + 0x580], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x4091a7
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.00408980
mov eax, dword [eax]
push eax
lea eax, [esp + 0x25d]
push eax
call edi
lea ecx, [esp + 0x10]
call fcn.00429f93
mov eax, dword [0xe47e48]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x580], 4
mov dword [esp + 0x24], eax
push ecx
mov bl, 5
mov ecx, esp
mov dword [esp + 0x24], esp
push 0xe4c18c
mov byte [esp + 0x588], bl
call fcn.0042a001
push ecx
mov byte [esp + 0x588], 6
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xe47978
call fcn.0042a001
push ecx
mov byte [esp + 0x58c], 7
mov ecx, esp
mov dword [esp + 0x34], esp
push ebp
call fcn.00429d08
lea ecx, [esp + 0x1c]
mov byte [esp + 0x58c], bl
push ecx
mov ecx, 0xe4c0b8
call fcn.00402590
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x584], 8
call fcn.0042a0cc
lea ecx, [esp + 0x10]
mov byte [esp + 0x580], bl
call fcn.00429f93
lea edx, [esp + 0x10]
push 1
push edx
mov ecx, 0xe4c0b8
call fcn.00402a70
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x584], 9
call fcn.0042a0cc
lea ecx, [esp + 0x10]
mov byte [esp + 0x580], bl
call fcn.00429f93
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x35b]
push eax
push ecx
call edi
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x45c]
push edx
push eax
call edi
lea ecx, [esp + 0x2c]
push 0
mov al, 0x2a
push ecx
mov ecx, 0xe4c0b8
mov byte [esp + 0x2e2], al
mov byte [esp + 0x565], al
call fcn.00402a70
push eax
lea edx, [esp + 0x2c]
push 0xe47968
push edx
mov byte [esp + 0x58c], 0xa
call fcn.0042a29c
mov edi, eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push eax
push 0xe47958
push ecx
mov byte [esp + 0x58c], 0xb
call fcn.0042a29c
mov dword [esp + 0x14], eax
lea edx, [esp + 0x259]
lea ecx, [esp + 0x44]
push edx
mov byte [esp + 0x584], 0xc
call fcn.0042a001
mov dword [esp + 0x18], eax
push 0xe4794c
lea ecx, [esp + 0x50]
mov byte [esp + 0x584], 0xd
call fcn.0042a001
mov dword [esp + 0x10], eax
push ebp
lea eax, [esp + 0x40]
push 0xe478cc
push eax
mov byte [esp + 0x58c], 0xe
call fcn.0042a29c
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
push ecx
push eax
push edx
mov byte [esp + 0x58c], 0xf
call fcn.0042a1c2
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x48]
push ecx
push eax
push edx
mov byte [esp + 0x58c], 0x10
call fcn.0042a1c2
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x40]
push ecx
push eax
push edx
mov byte [esp + 0x58c], 0x11
call fcn.0042a1c2
push edi
push eax
lea eax, [esp + 0x40]
mov byte [esp + 0x588], 0x12
push eax
call fcn.0042a1c2
push 0xe47948
lea ecx, [esp + 0x54]
push eax
push ecx
mov byte [esp + 0x58c], 0x13
call fcn.0042a228
lea edi, [esi + 0x168]
push eax
mov ecx, edi
mov byte [esp + 0x584], 0x14
call fcn.0042a0cc
lea ecx, [esp + 0x50]
mov byte [esp + 0x580], 0x13
call fcn.00429f93
lea ecx, [esp + 0x38]
mov byte [esp + 0x580], 0x12
call fcn.00429f93
lea ecx, [esp + 0x40]
mov byte [esp + 0x580], 0x11
call fcn.00429f93
lea ecx, [esp + 0x48]
mov byte [esp + 0x580], 0x10
call fcn.00429f93
lea ecx, [esp + 0x30]
mov byte [esp + 0x580], 0xf
call fcn.00429f93
lea ecx, [esp + 0x3c]
mov byte [esp + 0x580], 0xe
call fcn.00429f93
lea ecx, [esp + 0x4c]
mov byte [esp + 0x580], 0xd
call fcn.00429f93
lea ecx, [esp + 0x44]
mov byte [esp + 0x580], 0xc
call fcn.00429f93
lea ecx, [esp + 0x34]
mov byte [esp + 0x580], 0xb
call fcn.00429f93
lea ecx, [esp + 0x28]
mov byte [esp + 0x580], 0xa
call fcn.00429f93
lea ecx, [esp + 0x2c]
mov byte [esp + 0x580], bl
call fcn.00429f93
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edi
call fcn.00429d08
mov ecx, 0xe4c0b8
call fcn.00402380
push 0
mov ecx, esi
call fcn.0042ca62
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xe4c198
push 0x4061c0
lea edx, [esp + 0x15c]
push 0
push edx
push 0
push 0
call sub.RASAPI32.dll_RasDialA
test eax, eax
je 0x409529
lea ecx, [esp + 0x54]
push 0x100
push ecx
push eax
call sub.RASAPI32.dll_RasGetErrorStringA
test eax, eax
je 0x4094f3
lea edx, [esp + 0x54]
lea ecx, [esi + 0x16c]
push edx
call fcn.0042a11c
push ecx
lea eax, [esi + 0x16c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00429d08
mov ecx, 0xe4c0b8
call fcn.00402380
push 0
mov ecx, esi
call fcn.0042ca62
push 0
mov ecx, esi
call fcn.00408540
mov ecx, esi
call fcn.004088c0
lea ecx, [esp + 0x24]
mov byte [esp + 0x580], 4
call fcn.00429f93
lea ecx, [esp + 0x1c]
mov dword [esp + 0x580], 0xffffffff
call fcn.00429f93
mov ecx, dword [esp + 0x578]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x574
ret