Function at 0x1011954
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x1040494], 0
push edi
je 0x1015ca2
mov eax, dword [esp + 0x10]
cmp eax, 0x23
ja case.0x1011974.31
jmp dword [eax*4 + 0x101cd04]
cmp dword [0x1040408], 2
jne case.0x1011974.31
cmp dword [0x10403fc], 5
jb case.0x1011974.31
mov eax, ebx
pop edi
pop esi
pop ebx
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x10403f8
push edi
mov dword [0x1040494], ebx
mov dword [0x10403f8], 0x9c
call esi
test eax, eax
jne 0x1011967
jmp 0x10256cc
xor eax, eax
jmp 0x1011997
push edi
mov dword [0x10403f8], 0x94
call esi
jmp 0x1011967
push 0x1000
jmp 0x1025a23
test byte [0x1040490], 0x10
je case.0x1011974.31
jmp 0x1011988
mov eax, dword [0x1040490]
test al, 0x10
je case.0x1011974.31
test ah, 1
jmp 0x1025a08
mov eax, dword [0x1040490]
test al, 0x10
je case.0x1011974.31
test ah, 1
jmp 0x10259a9
mov eax, dword [0x1040490]
test ah, 1
je case.0x1011974.31
test al, 0x10
jmp 0x1025a08
test word [0x1040490], 0x110
je case.0x1011974.31
push 0x1027884
push 0x1027848
push 0x1027810
push 0x80000002
call fcn.01035771
test eax, eax
jmp 0x10259a9
call fcn.010358fc
test eax, eax
jne case.0x1011974.31
push 0x1027808
mov edi, 0x1027810
push edi
mov esi, 0x80000002
push esi
call fcn.0103581d
test eax, eax
jne case.0x1011974.31
push 0x10277fc
push 0x1027848
push edi
push esi
jmp 0x102575c
call fcn.010358fc
jmp 0x1011997
cmp byte [0x1040492], bl
jne case.0x1011974.31
cmp dword [0x10403fc], 5
jmp 0x1025a08
mov al, byte [0x1040492]
cmp al, 3
je 0x10257d4
cmp al, 2
jne case.0x1011974.31
cmp dword [0x10403fc], 5
jmp 0x10259bf
mov al, byte [0x1040492]
cmp al, 3
je 0x10257f1
cmp al, 2
jne case.0x1011974.31
cmp dword [0x10403fc], 5
jmp 0x102599c
mov al, byte [0x1040492]
cmp al, 3
je 0x102580e
cmp al, 2
jne case.0x1011974.31
test byte [0x1040490], 0x82
jmp 0x10257b1
mov eax, dword [0x1040490]
and eax, 0x40
jmp 0x1011997
xor eax, eax
cmp dword [0x1040408], ebx
jmp 0x1025837
xor eax, eax
cmp dword [0x1040408], 2
sete al
jmp 0x1011997
cmp dword [0x1040408], ebx
jmp 0x102590c
cmp dword [0x1040408], ebx
jne case.0x1011974.31
cmp dword [0x10403fc], 4
jne case.0x1011974.31
cmp dword [0x1040400], 0
jne case.0x1011974.31
cmp word [0x1040404], 0x3b6
jmp 0x1025a08
cmp dword [0x1040408], ebx
jne case.0x1011974.31
mov eax, dword [0x10403fc]
cmp eax, 4
ja 0x1011995
jne case.0x1011974.31
cmp dword [0x1040400], 0xa
jmp 0x101198f
cmp dword [0x1040408], ebx
jne case.0x1011974.31
cmp dword [0x10403fc], 4
jne case.0x1011974.31
cmp dword [0x1040400], 0xa
jne case.0x1011974.31
cmp word [0x1040404], 0x7ce
jmp 0x1025a08
cmp dword [0x1040408], ebx
jne case.0x1011974.31
mov eax, dword [0x10403fc]
cmp eax, 4
jne 0x102595b
cmp dword [0x1040400], 0x5a
jae 0x1011995
cmp eax, eax
jmp 0x102595b
cmp dword [0x1040408], 2
jne case.0x1011974.31
cmp dword [0x10403fc], 4
jmp 0x101198f
cmp dword [0x1040408], 2
jne case.0x1011974.31
mov eax, dword [0x10403fc]
cmp eax, 5
ja 0x1011995
jne case.0x1011974.31
mov eax, dword [0x1040400]
test eax, eax
ja 0x1011995
jne case.0x1011974.31
cmp word [0x1040404], 0x893
jbe case.0x1011974.31
jmp 0x1011995
cmp dword [0x1040408], 2
jne case.0x1011974.31
test byte [0x1040491], 2
jmp 0x10259a9
cmp dword [0x1040408], 2
jne case.0x1011974.31
cmp byte [0x1040492], bl
jmp 0x1025a08
mov al, byte [0x1040492]
cmp al, 3
je 0x10259a2
cmp al, 2
jne case.0x1011974.31
test byte [0x1040490], 0x80
je case.0x1011974.31
jmp 0x1011995
mov al, byte [0x1040492]
cmp al, 3
je 0x10259c5
cmp al, 2
jne case.0x1011974.31
mov al, byte [0x1040490]
test al, 2
je case.0x1011974.31
test al, al
js case.0x1011974.31
jmp 0x1011995
mov al, byte [0x1040492]
cmp al, 3
je 0x10259f0
cmp al, 2
jne case.0x1011974.31
test byte [0x1040490], 0x82
jmp 0x1025a08
mov al, byte [0x1040492]
cmp al, 3
je 0x1011995
cmp al, 2
jne case.0x1011974.31
jmp 0x1011995
call fcn.01035953
jmp 0x1011997
push 0x56
jmp 0x1025a23
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1011997