Function at 0x102b004
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x103ed34], 0
push edi
jne 0x102b042
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x103ec98
push edi
mov dword [0x103ed34], ebx
mov dword [0x103ec98], 0x9c
call esi
test eax, eax
jne 0x102b042
push edi
mov dword [0x103ec98], 0x94
call esi
mov eax, dword [0x103ec9c]
mov edx, dword [esp + 0x10]
mov ecx, dword [0x103eca0]
push 5
pop esi
cmp eax, esi
jne 0x102b088
test ecx, ecx
jne 0x102b088
cmp edx, 0x15
jne 0x102b088
cmp byte [0x103ed32], 3
jne case.0x102b08d.31
mov eax, dword [0x103ed30]
test al, 2
je case.0x102b08d.31
test ah, 4
je case.0x102b08d.31
test al, al
jns 0x102b37b
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
cmp edx, 0x23
ja case.0x102b08d.31
jmp dword [edx*4 + 0x102b39a]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x102b082
test byte [0x103ed30], 0x10
je case.0x102b08d.31
cmp eax, esi
jb case.0x102b08d.31
jmp 0x102b37b
mov eax, dword [0x103ed30]
test al, 0x10
je case.0x102b08d.31
test ah, 1
jmp 0x102b375
mov eax, dword [0x103ed30]
test al, 0x10
je case.0x102b08d.31
test ah, 1
je case.0x102b08d.31
jmp 0x102b37b
mov eax, dword [0x103ed30]
test ah, 1
je case.0x102b08d.31
test al, 0x10
jmp 0x102b375
test word [0x103ed30], 0x110
je case.0x102b08d.31
push 0x1006890
push 0x1006854
push 0x100681c
push reloc.SHELL32.dll_SHChangeNotifyRegister
jmp 0x102b140
call fcn.0102af55
test eax, eax
jne case.0x102b08d.31
push 0x1006814
mov edi, 0x100681c
push edi
mov esi, reloc.SHELL32.dll_SHChangeNotifyRegister
push esi
call fcn.0102ae76
test eax, eax
jne case.0x102b08d.31
push 0x1006808
push 0x1006854
push edi
push esi
call fcn.0102adca
test eax, eax
jmp 0x102b0d0
call fcn.0102af55
jmp 0x102b082
cmp dword [0x103eca8], 2
jne case.0x102b08d.31
jmp 0x102b0aa
cmp byte [0x103ed32], bl
jne case.0x102b08d.31
cmp eax, esi
jmp 0x102b375
mov cl, byte [0x103ed32]
cmp cl, 3
je 0x102b18c
cmp cl, 2
jne case.0x102b08d.31
cmp eax, esi
jmp 0x102b33e
mov cl, byte [0x103ed32]
cmp cl, 3
je 0x102b1a7
cmp cl, 2
jne case.0x102b08d.31
cmp eax, esi
jmp 0x102b321
mov cl, byte [0x103ed32]
cmp cl, 3
je 0x102b1c2
cmp cl, 2
jne case.0x102b08d.31
test byte [0x103ed30], 0x82
jmp 0x102b16b
mov eax, dword [0x103ed30]
and eax, 0x40
jmp 0x102b082
xor eax, eax
cmp dword [0x103eca8], ebx
sete al
jmp 0x102b082
xor eax, eax
cmp dword [0x103eca8], 2
jmp 0x102b1e0
cmp dword [0x103eca8], ebx
jmp 0x102b2a6
cmp dword [0x103eca8], ebx
jne case.0x102b08d.31
cmp eax, 4
jne case.0x102b08d.31
test ecx, ecx
jne case.0x102b08d.31
cmp word [0x103eca4], 0x3b6
jmp 0x102b375
cmp dword [0x103eca8], ebx
jne case.0x102b08d.31
cmp eax, 4
ja 0x102b37b
jne case.0x102b08d.31
cmp ecx, 0xa
jmp 0x102b0ac
cmp dword [0x103eca8], ebx
jne case.0x102b08d.31
cmp eax, 4
jne case.0x102b08d.31
cmp ecx, 0xa
jne case.0x102b08d.31
cmp word [0x103eca4], 0x7ce
jmp 0x102b375
cmp dword [0x103eca8], ebx
jne case.0x102b08d.31
cmp eax, 4
jne 0x102b294
cmp ecx, 0x5a
jae 0x102b37b
cmp eax, eax
jbe case.0x102b08d.31
jmp 0x102b37b
cmp dword [0x103eca8], 2
jne case.0x102b08d.31
cmp eax, 4
jmp 0x102b0ac
cmp dword [0x103eca8], 2
jne case.0x102b08d.31
cmp eax, esi
ja 0x102b37b
jne case.0x102b08d.31
test ecx, ecx
ja 0x102b37b
jne case.0x102b08d.31
cmp word [0x103eca4], 0x893
jmp 0x102b294
cmp dword [0x103eca8], 2
jne case.0x102b08d.31
test byte [0x103ed31], 2
jmp 0x102b0d0
cmp dword [0x103eca8], 2
jne case.0x102b08d.31
cmp byte [0x103ed32], bl
jmp 0x102b375
mov al, byte [0x103ed32]
cmp al, 3
je 0x102b327
cmp al, 2
jne case.0x102b08d.31
test byte [0x103ed30], 0x80
jmp 0x102b0d0
mov al, byte [0x103ed32]
cmp al, 3
je 0x102b344
cmp al, 2
jne case.0x102b08d.31
mov al, byte [0x103ed30]
test al, 2
jmp 0x102b076
mov al, byte [0x103ed32]
cmp al, 3
je 0x102b361
cmp al, 2
jne case.0x102b08d.31
test byte [0x103ed30], 0x82
jmp 0x102b375
mov al, byte [0x103ed32]
cmp al, 3
je 0x102b37b
cmp al, 2
jne case.0x102b08d.31
mov eax, ebx
jmp 0x102b082
call fcn.0102afac
jmp 0x102b082
push 0x56
jmp 0x102b099
push 0x57
jmp 0x102b099