Function at 0x10356ff
Capabilities:
Check os version

Disassembly:
push 0x2d0
push 0x1006e28
call fcn.01032098
mov eax, dword [reloc.msvcrt.dll___p__fmode]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], ecx
xor esi, esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
or dword [ebp - reloc.msvcrt.dll___p__fmode], 0xffffffff
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - 4], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
or dword [ebp - reloc.msvcrt.dll___p__fmode], 0xffffffff
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
cmp eax, esi
je 0x1034fb3
add eax, 4
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
push 0x1f
pop ecx
lea edi, [ebp - 0xc4]
rep stosd dword es:[edi], eax
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, reloc.msvcrt.dll___p__fmode
je 0x1035671
push esi
lea ecx, reloc.msvcrt.dll___p__fmode
push ecx
push 0x24
lea ecx, [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1035671
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], 0x24
jne 0x1035679
push 5
pop ecx
lea edi, [ebp - 0x48]
mov esi, 0x10400f8
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1035679
push dword [ebp - 0x34]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov esi, eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
xor edi, edi
cmp esi, edi
jne 0x1035054
mov dword [ebp - reloc.msvcrt.dll___p__fmode], 8
jmp 0x10356a5
push edi
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push dword [ebp - 0x34]
push esi
push dword [ebp - 0x18c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1035671
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - reloc.msvcrt.dll___p__fmode]
jne 0x1035671
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], edi
je 0x103520a
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, edi
je 0x1035671
push eax
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, edi
jne 0x10350ca
mov dword [ebp - reloc.msvcrt.dll___p__fmode], 0x1f
jmp 0x10356a5
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, edi
je 0x1035671
cmp dword [ebp - 0x34], edi
jne 0x10350f8
mov dword [ebp - reloc.msvcrt.dll___p__fmode], 0x12
jmp 0x10356a5
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
push esi
push dword [ebp - 0x34]
call dword [sym.imp.GDI32.dll_SetEnhMetaFileBits]
mov esi, eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], esi
cmp esi, edi
je 0x1035671
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push reloc.KERNEL32.dll_CancelWaitableTimer
push esi
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, edi
je 0x1035671
push ebx
push esi
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
test eax, eax
je 0x1035671
push edi
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], edi
push 1
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SetBkMode]
or esi, reloc.msvcrt.dll___p__fmode
cmp eax, esi
jne 0x1035185
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
jmp 0x103566c
push 8
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SetMapMode]
test eax, eax
je 0x1035174
lea eax, reloc.msvcrt.dll___p__fmode
push eax
mov eax, dword [ebp - 0x28]
neg eax
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
test eax, eax
je 0x1035174
lea eax, reloc.msvcrt.dll___p__fmode
push eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
push eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
push eax
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
test eax, eax
je 0x1035174
lea eax, reloc.msvcrt.dll___p__fmode
push eax
mov eax, dword [ebp - 0x28]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0x2c]
cdq
push 0xfffffffffffffffe
pop ecx
idiv ecx
push eax
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
test eax, eax
jne 0x103520d
jmp 0x1035174
or esi, reloc.msvcrt.dll___p__fmode
push 0x40
pop eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, edi
jne 0x1035237
mov dword [ebp - reloc.msvcrt.dll___p__fmode], 8
jmp 0x103566c
mov dword [ebp - reloc.msvcrt.dll___p__fmode], edi
mov eax, dword [ebp - reloc.msvcrt.dll___p__fmode]
push edi
cmp eax, dword [ebp - 0x30]
lea eax, reloc.msvcrt.dll___p__fmode
push eax
jge 0x1035645
push 0x7c
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x18c]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
call ebx
test eax, eax
je 0x1035174
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], 0x7c
jne 0x1035174
mov eax, dword [ebp - 0x4c]
lea eax, [eax + eax + 2]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], eax
jge 0x10352be
push eax
push dword [ebp - 0x190]
call dword [sym.imp.msvcrt.dll_realloc]
pop ecx
pop ecx
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, edi
je 0x1035228
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], edi
push edi
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x190]
push dword [ebp - 0x18c]
call ebx
test eax, eax
je 0x1035174
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], eax
jne 0x1035174
shr eax, 1
mov ebx, dword [ebp - reloc.msvcrt.dll___p__fmode]
mov word [ebx + eax*2], di
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], edi
je 0x1035313
push dword [ebp - 0x194]
call fcn.01035abf
mov dword [ebp - reloc.msvcrt.dll___p__fmode], edi
cmp ebx, edi
je 0x103532b
push ebx
call fcn.01034e55
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, edi
je 0x1035228
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], edi
je 0x1035383
mov eax, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xb8]
cmp eax, edi
mov ecx, eax
jg 0x1035347
mov ecx, edi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], ecx
mov edx, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xbc]
cmp edx, ebx
mov ecx, edx
jl 0x1035361
mov ecx, ebx
mov dword [ebp - reloc.msvcrt.dll___p__fmode], ecx
cmp eax, edi
jl 0x103536d
mov eax, edi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp edx, ebx
mov eax, edx
jg 0x103537b
mov eax, ebx
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
xor edi, edi
mov cx, word [ebp - 0x50]
cmp cx, di
je 0x1035459
xor eax, eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], 1
cmp eax, 0x1c
jae 0x10353dc
cmp cx, word [eax*2 + 0x104010c]
jne 0x1035633
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], edi
je 0x10353c8
mov edx, dword [ebp - reloc.msvcrt.dll___p__fmode]
mov eax, dword [edx + eax*4]
jmp 0x10353ca
xor eax, eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
mov eax, dword [ebp - reloc.msvcrt.dll___p__fmode]
or dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp cx, 0x80f
jne 0x1035459
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], edi
je 0x1035459
lea esi, reloc.msvcrt.dll___p__fmode
lea edi, reloc.msvcrt.dll___p__fmode
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 2
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_LPtoDP]
lea eax, reloc.msvcrt.dll___p__fmode
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.01034e71
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
test eax, eax
jne 0x10356a5
push reloc.KERNEL32.dll_FormatMessageW
push 0x5a
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push dword [ebp - 0x17c]
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
or esi, reloc.msvcrt.dll___p__fmode
xor edi, edi
mov eax, dword [ebp - reloc.msvcrt.dll___p__fmode]
cmp word [eax], di
jne 0x103546a
mov eax, dword [ebp - reloc.msvcrt.dll___p__fmode]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], edi
je 0x1035628
cmp eax, edi
je 0x1035628
push dword [ebp - 0xb4]
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, esi
je 0x1035174
lea eax, reloc.msvcrt.dll___p__fmode
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.01034e71
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
cmp eax, edi
jne 0x103566c
cmp dword [ebp + 0x1c], edi
je 0x10354d8
mov al, byte [ebp - 0x108]
or al, 7
mov byte [ebp - 0x108], al
lea eax, reloc.msvcrt.dll___p__fmode
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ebx, eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], ebx
cmp ebx, edi
je 0x1035174
push ebx
push dword [ebp - 0x184]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
call edi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
test eax, eax
je 0x1035174
cmp dword [ebp + 0x1c], 0
je 0x1035592
and dword [ebp - reloc.msvcrt.dll___p__fmode], 0
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
test eax, eax
je 0x1035174
test byte [ebp - 0x23d], 4
ja 0x1035592
push reloc.TAPI32.dll_lineClose
lea eax, reloc.msvcrt.dll___p__fmode
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, reloc.msvcrt.dll___p__fmode
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ebx, eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], ebx
test ebx, ebx
je 0x1035174
push ebx
push dword [ebp - 0x184]
call edi
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
test eax, eax
je 0x1035174
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [ebp - reloc.msvcrt.dll___p__fmode], 0
cmp word [ebp - 0x50], 0
je 0x10355be
push dword [ebp - 0x1c8]
push 0x800
call fcn.010378b8
test eax, eax
je 0x10355be
mov dword [ebp - reloc.msvcrt.dll___p__fmode], 0x20000
mov eax, dword [ebp - 0xb0]
or eax, dword [ebp - reloc.msvcrt.dll___p__fmode]
or eax, 0x810
push eax
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push esi
push dword [ebp - 0x1c8]
push dword [ebp - 0x184]
call dword [sym.imp.USER32.dll_DrawTextW]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
test eax, eax
je 0x1035174
push dword [ebp - 0x1d4]
push dword [ebp - 0x184]
call edi
push dword [ebp - 0x1d8]
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_SetTextColor]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [ebp - reloc.msvcrt.dll___p__fmode], 0
xor edi, edi
inc dword [ebp - reloc.msvcrt.dll___p__fmode]
jmp 0x103523d
inc eax
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
shl dword [ebp - reloc.msvcrt.dll___p__fmode], 1
jmp 0x10353a2
push 6
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x18c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1035174
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], 6
jne 0x1035174
mov dword [ebp - 4], esi
jmp 0x10356a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x103569f
mov dword [ebp - reloc.msvcrt.dll___p__fmode], reloc.ADVAPI32.dll_RegRestoreKeyW
jmp 0x10356a5
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
or dword [ebp - 4], reloc.msvcrt.dll___p__fmode
xor esi, esi
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
je 0x10356bf
push dword [ebp - 0x1a4]
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
je 0x10356d2
push dword [ebp - 0x194]
call fcn.01035abf
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
je 0x10356e6
push dword [ebp - 0x198]
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
je 0x10356fb
push dword [ebp - 0x190]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
je 0x1035710
push dword [ebp - 0x1b0]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], 0xffffffff
je 0x1035725
push dword [ebp - 0x18c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
je 0x103573f
push dword [ebp - 0x1a0]
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_RestoreDC]
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
je 0x1035759
push dword [ebp - 0x19c]
push dword [ebp - 0x184]
call dword [sym.imp.GDI32.dll_RestoreDC]
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
jne 0x10357a2
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], esi
je 0x10357a2
mov ecx, dword [ebp - reloc.msvcrt.dll___p__fmode]
mov eax, dword [ebp - reloc.msvcrt.dll___p__fmode]
mov dword [eax], ecx
lea edi, [eax + 4]
lea esi, reloc.msvcrt.dll___p__fmode
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x22]
mov word [eax + 0x16], cx
mov cx, word [ebp - 0x20]
mov word [eax + 0x14], cx
lea edi, [eax + 0x18]
push 0x17
pop ecx
lea esi, reloc.msvcrt.dll___p__fmode
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], 0
je 0x10357b7
push dword [ebp - 0x1b4]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - reloc.msvcrt.dll___p__fmode]
mov ecx, dword [ebp - 0x1c]
call fcn.01031d91
call fcn.010320d3
ret 0x18