Function at 0x10004580
Capabilities:
Check os version
Write file on windows

Disassembly:
sub esp, 0x28c
mov eax, dword [0x101561c0]
xor eax, esp
mov dword [esp + 0x288], eax
mov eax, dword [esp + 0x2a0]
movzx ecx, word [esp + 0x290]
push ebx
mov ebx, dword [esp + 0x29c]
push ebp
mov bp, word [esp + 0x2a4]
push esi
push edi
mov edi, dword [esp + 0x2a4]
movzx edx, bp
push edx
mov dword [esp + 0x2c], eax
movzx eax, bx
push eax
movzx esi, di
push esi
push ecx
push str.sue__u__x__x__d_
push 0xa
push 0x10158458
call fcn.1000f810
mov eax, dword [esp + 0x2b8]
add esp, 0x1c
push eax
mov ecx, 0x10158200
call fcn.100061a0
test eax, eax
jne 0x100048e1
test edx, edx
jne 0x100048e1
mov eax, 0xffff
cmp di, ax
je 0x100048d2
mov ecx, eax
cmp bx, cx
je 0x100048d2
cmp bp, 2
jae 0x100048d2
cmp dword [esp + 0x28], edx
je 0x100048d2
mov ebx, dword [esp + 0x2b4]
test ebx, ebx
je 0x100048d2
cmp dword [esp + 0x2b8], edx
jne 0x100048d2
lea eax, [ebx + 0x20]
cmp dx, bp
jne 0x10004657
mov eax, ebx
push eax
lea ecx, [esp + 0x14]
call fcn.10004080
cmp dword [esp + 0x14], 0
jne 0x1000468d
push 0xe
push 0x220f1e01
call fcn.1000e600
add esp, 8
lea ecx, [esp + 0x10]
mov esi, eax
mov edi, edx
call fcn.100040c0
mov eax, esi
mov edx, edi
jmp 0x100048e1
mov edi, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x20]
call fcn.10004080
cmp dword [esp + 0x20], 0
jne 0x100046d0
push 0xe
push 0x220f1e01
call fcn.1000e600
add esp, 8
lea ecx, [esp + 0x1c]
mov esi, eax
mov edi, edx
call fcn.100040c0
lea ecx, [esp + 0x10]
call fcn.100040c0
mov eax, esi
mov edx, edi
jmp 0x100048e1
xor eax, eax
cmp ax, bp
mov eax, dword [esp + 0x14]
push ebx
je 0x10004729
mov ecx, dword [0x10108534]
mov dword [eax], ecx
mov edx, dword [0x10108538]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], edx
mov edx, 1
mov ecx, edx
mov word [eax + 0xa], cx
mov word [eax + 8], dx
xor ecx, ecx
mov edx, 0x20
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov word [eax + 0xc], dx
mov word [eax + 0xe], bp
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], edi
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
push eax
add ecx, edx
push ecx
jmp 0x1000472f
mov edx, dword [esp + 0x2c]
push edx
push eax
call fcn.10010aa0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
add esp, 0xc
push 1
push edi
push ecx
push edx
call sym.AhnI2t.dll_AhnInst2_EnDeSecData
movzx eax, word [esp + 0x2a0]
push eax
push str.SoftwareAhnlabAhnInst_d
lea eax, [esp + 0x58]
push 0x20
push eax
call fcn.10002910
movzx eax, word [esp + 0x2b8]
shl esi, 0x10
or esi, eax
push esi
push str._08x
lea ecx, [esp + 0x48]
push 0x10
push ecx
call fcn.10002910
mov edx, dword [esp + 0x40]
push 1
push edi
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x80]
push ecx
push closesocket
call fcn.1000eae0
add esp, 0x38
test eax, eax
je 0x100047d5
push eax
push 0x220f1201
call fcn.1000e600
add esp, 8
lea ecx, [esp + 0x1c]
mov esi, eax
mov edi, edx
call fcn.100040c0
lea ecx, [esp + 0x10]
call fcn.100040c0
mov eax, esi
mov edx, edi
jmp 0x100048e1
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x100047fa
lea ecx, [esp + 0x1c]
call fcn.100040c0
lea ecx, [esp + 0x10]
call fcn.100040c0
xor eax, eax
xor edx, edx
jmp 0x100048e1
mov edx, dword [esp + 0x2a8]
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a0]
push 1
push edx
push eax
push ecx
lea edx, [esp + 0xa0]
push edx
call fcn.10004390
mov esi, eax
add esp, 0x14
mov ebx, edx
test esi, esi
jne 0x10004830
test ebx, ebx
je 0x1000484b
lea ecx, [esp + 0x1c]
call fcn.100040c0
lea ecx, [esp + 0x10]
call fcn.100040c0
mov eax, esi
mov edx, ebx
jmp 0x100048e1
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100048a2
mov ecx, dword [esp + 0x20]
push edi
push ecx
call fcn.100041d0
mov eax, dword [esp + 0x28]
add esp, 8
push 0
lea edx, [esp + 0x30]
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x100047df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x220f1322
call fcn.1000e600
add esp, 8
lea ecx, [esp + 0x1c]
mov esi, eax
mov edi, edx
call fcn.100040c0
lea ecx, [esp + 0x10]
call fcn.100040c0
mov eax, esi
mov edx, edi
jmp 0x100048e1
push 0x57
push 0x220f1001
call fcn.1000e600
add esp, 8
mov ecx, dword [esp + 0x298]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100108f1
add esp, 0x28c
ret 0x1c