Function at 0x101f2ee
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x10219bc], 0
push edi
jne 0x101f331
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1021920
push edi
mov dword [0x10219bc], ebx
mov dword [0x1021920], 0x9c
call esi
test eax, eax
jne 0x101f331
push edi
mov dword [0x1021920], 0x94
call esi
mov eax, dword [ebp + 8]
cmp eax, 0x29
ja case.default.0x101f33d
jmp dword [eax*4 + 0x101f732]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x101f728
test byte [0x10219b8], 0x10
je case.default.0x101f33d
cmp dword [0x1021924], 5
jb case.default.0x101f33d
jmp 0x101f6ae
mov eax, dword [0x10219b8]
test al, 0x10
je case.default.0x101f33d
test ax, 0x100
jmp 0x101f6ac
mov eax, dword [0x10219b8]
test al, 0x10
je case.default.0x101f33d
test ax, 0x100
je case.default.0x101f33d
jmp 0x101f6ae
mov eax, dword [0x10219b8]
test ax, 0x100
je case.default.0x101f33d
test al, 0x10
jmp 0x101f6ac
test word [0x10219b8], 0x110
je case.default.0x101f33d
push 0x1002404
push 0x10023c8
push 0x1002390
push 0x80000002
call fcn.0101ef31
test eax, eax
jmp 0x101f39a
push 0x25
call fcn.0101f2ee
test eax, eax
jne case.default.0x101f33d
cmp byte [0x10219ba], bl
jne case.default.0x101f33d
push 0x1002388
mov edi, 0x1002390
push edi
mov esi, 0x80000002
push esi
call fcn.0101efe4
test eax, eax
jne case.default.0x101f33d
push 0x100237c
push 0x10023c8
push edi
push esi
jmp 0x101f3de
call fcn.0101f10d
jmp 0x101f728
cmp dword [0x1021930], 2
jne case.default.0x101f33d
jmp 0x101f361
cmp byte [0x10219ba], bl
jne case.default.0x101f33d
cmp dword [0x1021924], 5
jmp 0x101f6ac
mov al, byte [0x10219ba]
cmp al, 3
je 0x101f473
cmp al, 2
jne case.default.0x101f33d
cmp dword [0x1021924], 5
jne case.default.0x101f33d
mov al, byte [0x10219b8]
test al, 2
je case.default.0x101f33d
test al, al
js case.default.0x101f33d
jmp 0x101f6ae
mov al, byte [0x10219ba]
cmp al, 3
je 0x101f4ab
cmp al, 2
jne case.default.0x101f33d
cmp dword [0x1021924], 5
jne case.default.0x101f33d
test byte [0x10219b8], 0x80
jmp 0x101f39a
mov al, byte [0x10219ba]
cmp al, 3
je 0x101f4d5
cmp al, 2
jne case.default.0x101f33d
test byte [0x10219b8], 0x82
jmp 0x101f450
mov eax, dword [0x10219b8]
and eax, 0x40
jmp 0x101f728
xor eax, eax
cmp dword [0x1021930], ebx
sete al
jmp 0x101f728
xor eax, eax
cmp dword [0x1021930], 2
jmp 0x101f4f6
cmp dword [0x1021930], ebx
jne case.default.0x101f33d
cmp dword [0x1021924], 4
jmp 0x101f368
cmp dword [0x1021930], ebx
jne case.default.0x101f33d
cmp dword [0x1021924], 4
jne case.default.0x101f33d
cmp dword [0x1021928], 0
jne case.default.0x101f33d
cmp word [0x102192c], 0x3b6
jmp 0x101f6ac
cmp dword [0x1021930], ebx
jne case.default.0x101f33d
mov eax, dword [0x1021924]
cmp eax, 4
ja 0x101f6ae
jne case.default.0x101f33d
cmp dword [0x1021928], 0xa
jmp 0x101f368
cmp dword [0x1021930], ebx
jne case.default.0x101f33d
cmp dword [0x1021924], 4
jne case.default.0x101f33d
cmp dword [0x1021928], 0xa
jne case.default.0x101f33d
cmp word [0x102192c], 0x7ce
jmp 0x101f6ac
cmp dword [0x1021930], ebx
jne case.default.0x101f33d
mov eax, dword [0x1021924]
cmp eax, 4
jne 0x101f724
cmp dword [0x1021928], 0x5a
jae 0x101f6ae
cmp eax, eax
jmp 0x101f724
cmp dword [0x1021930], 2
jmp 0x101f50f
cmp dword [0x1021930], 2
jne case.default.0x101f33d
mov eax, dword [0x1021924]
cmp eax, 5
jmp 0x101f719
cmp dword [0x1021930], 2
jne case.default.0x101f33d
test word [0x10219b8], 0x200
jmp 0x101f39a
cmp dword [0x1021930], 2
jne case.default.0x101f33d
cmp byte [0x10219ba], bl
jmp 0x101f6ac
mov al, byte [0x10219ba]
cmp al, 3
je 0x101f4b8
cmp al, 2
jmp 0x101f4b2
mov al, byte [0x10219ba]
cmp al, 3
je 0x101f480
cmp al, 2
jmp 0x101f47a
mov al, byte [0x10219ba]
cmp al, 3
je 0x101f672
cmp al, 2
jne case.default.0x101f33d
mov eax, dword [0x10219b8]
test al, 0xa3
jne case.default.0x101f33d
test ax, 0x400
jmp 0x101f6ac
mov eax, dword [0x10219b8]
and eax, 0x400
jmp 0x101f728
mov eax, dword [0x10219b8]
and eax, 0x20
jmp 0x101f728
mov al, byte [0x10219ba]
cmp al, 3
je 0x101f6ae
cmp al, 2
jne case.default.0x101f33d
mov eax, ebx
jmp 0x101f728
xor eax, eax
cmp byte [0x10219ba], 2
jmp 0x101f4f6
call fcn.0101f16b
jmp 0x101f728
call fcn.0101f226
jmp 0x101f728
push 0x57
jmp 0x101f349
push 0x58
jmp 0x101f349
call fcn.0101f263
jmp 0x101f728
call fcn.0101f1ca
jmp 0x101f728
cmp dword [0x1021930], 2
jne case.default.0x101f33d
cmp dword [0x1021924], 6
jmp 0x101f368
push 0x1e
call fcn.0101f2ee
jmp 0x101f728
cmp dword [0x1021930], 2
jne case.default.0x101f33d
mov eax, dword [0x1021924]
cmp eax, 6
ja 0x101f6ae
jne case.default.0x101f33d
cmp dword [0x1021928], 0
ja 0x101f6ae
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4