Function at 0x100044f0
Capabilities:
Check os version
Write file on windows

Disassembly:
sub esp, 0x28c
mov eax, dword [0x1023d1a4]
xor eax, esp
mov dword [esp + 0x288], eax
mov eax, dword [esp + 0x2a0]
movzx ecx, word [esp + 0x290]
push ebx
mov ebx, dword [esp + 0x29c]
push ebp
mov bp, word [esp + 0x2a4]
push esi
push edi
mov edi, dword [esp + 0x2a4]
movzx edx, bp
push edx
mov dword [esp + 0x2c], eax
movzx eax, bx
push eax
movzx esi, di
push esi
push ecx
push str.sue__u__x__x__d_
push 0xa
push 0x1023e498
call fcn.1000f390
mov eax, dword [esp + 0x2b8]
add esp, 0x1c
push eax
mov ecx, 0x1023e240
call fcn.10006110
test eax, eax
jne 0x10004851
test edx, edx
jne 0x10004851
mov eax, 0xffff
cmp di, ax
je 0x10004842
mov ecx, eax
cmp bx, cx
je 0x10004842
cmp bp, 2
jae 0x10004842
cmp dword [esp + 0x28], edx
je 0x10004842
mov ebx, dword [esp + 0x2b4]
test ebx, ebx
je 0x10004842
cmp dword [esp + 0x2b8], edx
jne 0x10004842
lea eax, [ebx + 0x20]
cmp dx, bp
jne 0x100045c7
mov eax, ebx
push eax
lea ecx, [esp + 0x14]
call fcn.10003ff0
cmp dword [esp + 0x14], 0
jne 0x100045fd
push 0xe
push 0x220f1e01
call fcn.1000e150
add esp, 8
lea ecx, [esp + 0x10]
mov esi, eax
mov edi, edx
call fcn.10004030
mov eax, esi
mov edx, edi
jmp 0x10004851
mov edi, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x20]
call fcn.10003ff0
cmp dword [esp + 0x20], 0
jne 0x10004640
push 0xe
push 0x220f1e01
call fcn.1000e150
add esp, 8
lea ecx, [esp + 0x1c]
mov esi, eax
mov edi, edx
call fcn.10004030
lea ecx, [esp + 0x10]
call fcn.10004030
mov eax, esi
mov edx, edi
jmp 0x10004851
xor eax, eax
cmp ax, bp
mov eax, dword [esp + 0x14]
push ebx
je 0x10004699
mov ecx, dword [0x101c563c]
mov dword [eax], ecx
mov edx, dword [0x101c5640]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], edx
mov edx, 1
mov ecx, edx
mov word [eax + 0xa], cx
mov word [eax + 8], dx
xor ecx, ecx
mov edx, 0x20
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov word [eax + 0xc], dx
mov word [eax + 0xe], bp
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], edi
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
push eax
add ecx, edx
push ecx
jmp 0x1000469f
mov edx, dword [esp + 0x2c]
push edx
push eax
call sub.MSVCR90.dll_memcpy
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
add esp, 0xc
push 1
push edi
push ecx
push edx
call sym.AhnI2.dll_AhnInst2_EnDeSecData
movzx eax, word [esp + 0x2a0]
push eax
push str.SoftwareAhnlabAhnInst_d
lea eax, [esp + 0x58]
push 0x20
push eax
call fcn.10002880
movzx eax, word [esp + 0x2b8]
shl esi, 0x10
or esi, eax
push esi
push str._08x
lea ecx, [esp + 0x48]
push 0x10
push ecx
call fcn.10002880
mov edx, dword [esp + 0x40]
push 1
push edi
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x80]
push ecx
push closesocket
call fcn.1000e660
add esp, 0x38
test eax, eax
je 0x10004745
push eax
push 0x220f1201
call fcn.1000e150
add esp, 8
lea ecx, [esp + 0x1c]
mov esi, eax
mov edi, edx
call fcn.10004030
lea ecx, [esp + 0x10]
call fcn.10004030
mov eax, esi
mov edx, edi
jmp 0x10004851
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x1000476a
lea ecx, [esp + 0x1c]
call fcn.10004030
lea ecx, [esp + 0x10]
call fcn.10004030
xor eax, eax
xor edx, edx
jmp 0x10004851
mov edx, dword [esp + 0x2a8]
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a0]
push 1
push edx
push eax
push ecx
lea edx, [esp + 0xa0]
push edx
call fcn.10004300
mov esi, eax
add esp, 0x14
mov ebx, edx
test esi, esi
jne 0x100047a0
test ebx, ebx
je 0x100047bb
lea ecx, [esp + 0x1c]
call fcn.10004030
lea ecx, [esp + 0x10]
call fcn.10004030
mov eax, esi
mov edx, ebx
jmp 0x10004851
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004812
mov ecx, dword [esp + 0x20]
push edi
push ecx
call fcn.10004140
mov eax, dword [esp + 0x28]
add esp, 8
push 0
lea edx, [esp + 0x30]
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1000474f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x220f1322
call fcn.1000e150
add esp, 8
lea ecx, [esp + 0x1c]
mov esi, eax
mov edi, edx
call fcn.10004030
lea ecx, [esp + 0x10]
call fcn.10004030
mov eax, esi
mov edx, edi
jmp 0x10004851
push 0x57
push 0x220f1001
call fcn.1000e150
add esp, 8
mov ecx, dword [esp + 0x298]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10010586
add esp, 0x28c
ret 0x1c