Function at 0x100215ae
Capabilities:
Check os version
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006c274
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
movdqa xmm0, xmmword [0x10006740]
lea eax, [esp + 0x11c]
push ebx
push esi
push edi
push dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x4c], edx
push eax
lea eax, [esp + 0x120]
mov dword [esp + 0x7c], ebx
push eax
mov esi, ecx
mov dword [esp + 0x84], ebx
push ebx
lea ecx, [esp + 0x84]
mov dword [esp + 0x8c], ebx
movdqu xmmword [esp + 0x128], xmm0
call fcn.100153db
mov ecx, dword [esp + 0x74]
or edi, 0xffffffff
mov eax, dword [ecx + 8]
cmp eax, dword [ecx]
jg 0x10021660
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], ebx
jmp 0x10021647
cmp byte [esp + 0x1b], bl
je 0x10021643
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff1
mov byte [esp + 0x1b], bl
jne 0x10021636
cmp byte [esp + 0x1b], bl
je 0x100216a0
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x100216a0
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x10021677
push ebx
push 0x800
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x100216a0
push ebx
push 0x2268
push 0x161f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
lea ecx, [esp + 0x74]
call fcn.10013eb6
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0xc8]
push 1
call fcn.10013e31
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x10], ebx
jmp 0x100216de
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0x7013dce9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100216c8
mov dword [esp + 0x10], 0x1b
jmp 0x10021745
mov dword [esp + 0x14], 0x2304b25b
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x10021720
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x14]
dec dword [esp + 0x14]
jns 0x10021701
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x10021741
lea eax, [esp + 0x37]
mov byte [esp + 0x37], bl
push eax
push ebx
call fcn.10024a75
dec dword [esp + 0x1c]
pop ecx
pop ecx
jns 0x1002172a
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 5
jle 0x100216ef
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x100217cb
push ebx
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0x84217059
push 0x67fd
mov dword [esp + 0x88], 0x4c3f4f88
push eax
call fcn.100249f4
mov eax, dword [esp + 0x58]
add esp, 0xc
push 0xfffffffffffffffb
pop ecx
sub ecx, eax
cmp dword [esp + 0x10], ecx
je 0x100217a0
push 0x2bde
lea eax, [esp + 0x84]
push ebx
push eax
call fcn.100241ef
jmp 0x100217c2
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0xfffffff7
push eax
push 0x1cfe
push 0x6c77
xor dl, dl
lea ecx, [esp + 0x58]
call fcn.100209f4
add esp, 0xc
dec dword [esp + 0x10]
jns 0x10021756
lea ecx, [esp + 0xc8]
mov dword [esp + 0x15c], edi
call fcn.10013eb6
cmp dword [esi + 0x10], ebx
jne 0x100217ea
xor al, al
jmp 0x100220bf
push 2
lea ecx, [esp + 0xb4]
call fcn.10013e31
lea eax, [esp + 0xb0]
mov dword [esp + 0x15c], 1
push eax
lea eax, [esp + 0x70]
mov dword [esp + 0x3c], 0xfffffffd
push eax
mov dword [esp + 0x98], edi
mov dword [esp + 0x38], 0x3384
push ebx
call fcn.100239c3
add esp, 0xc
mov dword [esp + 0x38], ebx
jmp 0x1002184c
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], 0xa32b1cec
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 2
jl 0x10021836
push 0x5e04
lea eax, [esp + 0x3c]
mov dl, 1
push eax
lea eax, [esp + 0x98]
mov ecx, 0x5a77
push eax
call fcn.100209f4
add esp, 0xc
mov dword [esp + 0x15c], edi
lea ecx, [esp + 0xb0]
call fcn.10013eb6
mov eax, dword [esp + 0x48]
push 3
pop edi
mov dword [eax], ebx
mov dword [esp + 0x10], 0xa76aabec
mov dword [esp + 0x24], 0x9f3690f1
mov dword [esp + 0x10], ebx
jmp 0x100218b9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x128], 0x3dd3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100218a6
mov dword [esp + 0x10], ebx
jmp 0x100218eb
mov eax, dword [esp + 0x10]
push ebx
push 0x6a77
push 0x43c2
mov eax, dword [esp + eax*4 + 0x134]
mov dword [esp + 0x30], eax
call fcn.10023853
add esp, 0xc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x100218c5
mov dword [esp + 0x1c], ebx
mov eax, 0xeb4c
mov dword [esp + 0x24], 0xf6d4a0d4
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0x10], ebx
jmp 0x10021938
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x134], 0xe08974b6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10021925
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x13c], 5
mov eax, dword [esp + 0x1c]
neg eax
cmp eax, 0xb95
mov eax, dword [esp + 0x1c]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp eax, 5
setge cl
imul edx, ecx
mov dword [esp + 0x24], edx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], al
je 0x100219a0
push 0x10c7
push 0x1f46
push 0xde1
push 0xac5
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
cmp dword [esi + 0x14], 0x10
jb 0x100219aa
mov ecx, dword [esi]
jmp 0x100219ac
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x50], ecx
jb 0x100219ba
mov edx, dword [esi]
jmp 0x100219bc
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x10021ba3
mov al, byte [ecx]
cmp al, 0x30
jl 0x10021ad0
cmp al, 0x39
jg 0x10021ad0
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0x10006710]
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x110]
mov dword [esp + 0x8c], ebx
push eax
push ebx
lea ecx, [esp + 0x94]
mov dword [esp + 0x98], ebx
movdqu xmmword [esp + 0x118], xmm0
mov dword [esp + 0x9c], ebx
call fcn.100153db
mov dword [esp + 0x15c], 2
mov dword [esp + 0x3c], 0xfffffff6
mov dword [esp + 0x68], 0xa2910a83
mov dword [esp + 0x3c], ebx
jmp 0x10021a99
push 0x2e2d
lea eax, [esp + 0x6c]
mov dword [esp + 0x98], 0x504dbf0c
push eax
push 0x7bcc
push 0x3e37
lea eax, [esp + 0x4c]
mov dword [esp + 0x74], 7
push eax
push 0x42dd
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x84]
push ebx
push eax
call fcn.10024703
add esp, 0x28
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], edi
jle 0x10021a43
or dword [esp + 0x15c], 0xffffffff
lea ecx, [esp + 0x84]
call fcn.10013eb6
push ebx
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.10023ad2
mov ecx, dword [esp + 0x5c]
add esp, 0xc
inc ecx
jmp 0x100219ac
mov eax, dword [esp + 0x48]
mov dword [eax], ebx
mov eax, 0xffb871c7
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x10], 0x3250e6da
mov dword [esp + 0x24], 7
mov dword [esp + 0x28], 0xc9b780f8
mov dword [esp + 0x58], 0x64a6847d
mov dword [esp + 0x10], ebx
jmp 0x10021b94
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x54], ebx
je 0x10021b7c
mov ecx, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xffffffff
setle al
xor ecx, ecx
cmp eax, 0x39e2
mov eax, dword [esp + 0x28]
setl cl
add eax, 0xc1d6b3bf
add ecx, eax
xor edx, edx
mov eax, dword [esp + 0x58]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setg dl
cmp edx, 0xffff
sbb ecx, ecx
neg ecx
cmp dword [esp + eax*4 + 0x54], ecx
jge 0x10021b6f
cmp dword [esp + 0x10], ebx
je 0x10021b6f
xor eax, eax
inc eax
jmp 0x10021b71
mov eax, ebx
cmp eax, dword [esp + 0x28]
jl 0x10021b7c
xor edx, edx
inc edx
jmp 0x10021b7e
mov edx, ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x54]
mov eax, dword [esp + 0x10]
add ecx, edx
mov dword [esp + eax*4 + 0x54], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10021b14
jmp 0x100217e3
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x98]
mov dword [esp + 0x20], 0xbe135e1f
mov dword [esp + 0x40], 0x8a52b4b5
mov dword [esp + 0x28], ebx
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x30], 0x69919c44
push 1
call fcn.10013e31
push 2
mov dword [esp + 0x28], 0x28e4
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], ebx
jmp 0x10021c01
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xbc], 0x141a9c21
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10021bee
mov dword [esp + 0x14], ebx
jmp 0x10021c23
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0x79dc8669
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10021c0d
mov dword [esp + 0x10], 0x1a
jmp 0x10021c87
mov dword [esp + 0x14], 5
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], 0xfffffff6
jmp 0x10021c7c
mov dword [esp + 0x20], 0x3d4e
xor edx, edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setle dl
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xbc]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff4
jne 0x10021c4e
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff8
jge 0x10021c34
mov dword [esp + 0x10], 0xfffffff8
jmp 0x10021d5f
mov dword [esp + 0x28], 0xfff6
mov dword [esp + 0x24], 0xbcf5
mov dword [esp + 0x2c], 0x1a770aac
mov dword [esp + 0x14], ebx
jmp 0x10021ccc
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xe0], 0xec5ec62b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10021cb9
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
je 0x10021d41
inc dword [esp + 0x1c]
mov dword [esp + 0x28], 0x16037280
cmp dword [esp + 0x28], ebx
jne 0x10021cfa
dec dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0xe4], ebx
je 0x10021d14
cmp dword [esp + 0x24], 0xbb6a
je 0x10021d14
mov eax, dword [esp + 0xbc]
mov eax, dword [esp + 0x24]
xor edx, edx
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0x40]
cmp ecx, eax
mov ecx, dword [esp + 0x98]
setle dl
mov eax, dword [ecx]
add eax, 0x1eb1ed30
add eax, edx
je 0x10021d48
xor eax, eax
inc eax
jmp 0x10021d4a
mov ecx, dword [esp + 0x98]
mov eax, ebx
mov dword [ecx], eax
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xe4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x11
jle 0x10021c9b
lea ecx, [esp + 0x98]
call fcn.10013eb6
mov dword [esp + 0x10], 0x1928c176
xor edx, edx
inc edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], 5
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10021db2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xa4], 0xb4763523
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10021d9f
mov dword [esp + 0x10], 0xfffffffa
jmp 0x10021f31
mov dword [esp + 0x1c], 0xd193
mov dword [esp + 0x2c], 4
mov dword [esp + 0x40], 0xbbc1846e
dec dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], ebx
je 0x10021df7
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x2c], ebx
je 0x10021e9d
mov dword [esp + 0x44], 0xc2f5
mov dword [esp + 0x24], 0x99e1f953
mov dword [esp + 0x40], 0xe7baa9d7
cmp dword [esp + 0x1c], ebx
je 0x10021e6c
mov eax, dword [esp + 0x14]
mov ecx, 0xcaf1e2cd
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov ecx, 0xacb314b8
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], edx
sbb eax, eax
neg eax
sub eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
sub ecx, eax
mov ecx, edx
jne 0x10021e6e
mov ecx, ebx
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
add eax, ecx
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
add eax, dword [esp + 0x2c]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
jmp 0x10021f2d
mov dword [esp + 0x2c], 0xece01153
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x1c], edx
xor edx, edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xa8]
add eax, 0x702b6816
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
setl dl
sub ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x2c]
setge dl
add eax, dword [esp + 0x28]
sub edx, 0x24e2
imul edx, eax
test edx, edx
jne 0x10021f15
cmp dword [esp + 0xa8], ebx
jne 0x10021f15
cmp dword [esp + 0x1c], ebx
jne 0x10021f15
mov edx, ebx
jmp 0x10021f18
xor edx, edx
inc edx
mov eax, dword [esp + 0xa4]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x20], ecx
inc edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1d
jne 0x10021dc5
mov dword [esp + 0x14], 0x743d837b
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jmp 0x10021f61
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xfc], 0x20624039
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10021f4e
mov dword [esp + 0x14], ebx
jmp 0x10021fdd
mov dword [esp + 0x20], 0xe1ca2961
mov dword [esp + 0x30], 0x1860ec01
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0xfc], ebx
jne 0x10021fe3
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], ebx
jl 0x10021fd9
push edi
lea ecx, [esp + 0xd8]
call fcn.10013e31
mov dword [esp + 0x1c], ebx
jmp 0x10021fbd
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10021fa7
dec dword [esp + 0x10]
lea ecx, [esp + 0xd4]
call fcn.10013eb6
dec dword [esp + 0x20]
jns 0x10021f94
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x10021f6d
xor edx, edx
mov dword [esp + 0xfc], ebx
mov eax, dword [esp + 0x10]
cmp eax, 1
mov eax, dword [esp + 0x10]
setl dl
sub edx, 0xfffd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0x1f4d0986
setne cl
sub ecx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1002204b
mov dword [esp + 0x1c], ebx
jmp 0x10022037
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x140], 0x300c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10022024
mov dword [esp + 0x14c], 1
jmp 0x100220bd
mov dword [esp + 0x24], 0x108f
mov dword [esp + 0x14], 0xfffffff0
jmp 0x100220b6
mov dword [esp + 0x30], 0x97ab83de
mov dword [esp + 0x10], 0xfffffffd
jmp 0x100220ab
mov dword [esp + 0x1c], 1
mov dword [esp + 0x1c], ebx
jmp 0x1002209d
dec dword [esp + 0x24]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10022099
push 0x7d5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x1002207d
mov eax, dword [esp + 0x30]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x38
jl 0x1002206f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff5
jg 0x1002205d
mov al, 1
mov ecx, dword [esp + 0x154]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret