Function at 0x1000ee07
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x10077060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x160], ebx
lea edi, [ebp - 0x15c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x160]
push eax
mov esi, edx
push ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x14c], esi
mov byte [ebp - 0x139], bl
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
jne 0x1000ee5e
xor al, al
jmp 0x1000f08d
lea eax, [ebp - 0x1a0]
push eax
push 0x18
push dword [ebp - 0x150]
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x118
lea eax, [ebp - 0x134]
push ebx
push eax
mov dword [ebp - 0x148], ebx
call fcn.10042870
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
mov dword [ebp - 0x138], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push dword [ebp - 0x140]
call fcn.1000e41d
cmp word [ebp - 0x18e], 0x20
pop ecx
jne 0x1000f008
cmp dword [ebp - 0x134], 5
je 0x1000f008
mov edi, dword [ebp - 0x150]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
cmp esi, ebx
je 0x1000ef07
lea eax, [ebp - 0x144]
push eax
push ebx
push edi
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 0x144], ebx
call sub.gdiplus.dll_GdipCreateBitmapFromHBITMAP
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x144]
mov dword [esi + 4], eax
jmp 0x1000ef09
xor esi, esi
lea eax, [ebp - 0x144]
push eax
push dword [esi + 4]
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x144], ebx
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebx
je 0x1000ef2b
mov dword [esi + 8], eax
mov edi, dword [ebp - 0x144]
lea eax, [ebp - 0x140]
push eax
push dword [esi + 4]
mov dword [ebp - 0x140], ebx
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebx
je 0x1000ef4d
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x140]
push eax
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x164], edi
push dword [esi + 4]
call sub.gdiplus.dll_GdipGetImagePixelFormat
cmp eax, ebx
je 0x1000ef81
mov dword [esi + 8], eax
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0x140]
lea eax, [ebp - 0x170]
push 1
push eax
push dword [esi + 4]
call sub.gdiplus.dll_GdipBitmapLockBits
cmp eax, ebx
je 0x1000efa6
mov dword [esi + 8], eax
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
cmp esi, ebx
je 0x1000effc
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x180]
mov edx, dword [ebp - 0x184]
mov edi, dword [ebp - 0x188]
mov dword [ebp - 0x140], ebx
lea ebx, [ebp - 0x140]
push ebx
push eax
push 0xe200b
push ecx
push edx
push edi
mov dword [esi], vtable.Gdiplus::Bitmap.0
call sub.gdiplus.dll_GdipCreateBitmapFromScan0
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x140]
mov dword [esi + 4], eax
xor ebx, ebx
jmp 0x1000effe
xor esi, esi
mov edi, esi
mov esi, dword [ebp - 0x14c]
jmp 0x1000f016
push dword [ebp - 0x140]
call fcn.1000e41d
pop ecx
mov edi, eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000ed7b
test al, al
je 0x1000f055
cmp dword [esi + 0x18], 8
jb 0x1000f02e
mov esi, dword [esi + 4]
jmp 0x1000f031
add esi, 4
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
push dword [edi + 4]
call sub.gdiplus.dll_GdipSaveImageToFile
cmp eax, ebx
je 0x1000f048
mov dword [edi + 8], eax
jmp 0x1000f04a
xor eax, eax
cmp eax, ebx
jne 0x1000f055
mov byte [ebp - 0x139], 1
cmp edi, ebx
je 0x1000f061
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov ecx, dword [ebp - 0x148]
cmp ecx, ebx
je 0x1000f071
mov eax, dword [ecx]
push 1
call dword [eax]
push dword [ebp - 0x150]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x154]
call esi
mov al, byte [ebp - 0x139]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004017c
leave
ret