Function at 0x100dc42
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x1013f34], 0
push edi
jne 0x100dc85
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1013e98
push edi
mov dword [0x1013f34], ebx
mov dword [0x1013e98], 0x9c
call esi
test eax, eax
jne 0x100dc85
push edi
mov dword [0x1013e98], 0x94
call esi
mov eax, dword [ebp + 8]
cmp eax, 0x29
ja case.default.0x100dc91
jmp dword [eax*4 + 0x100e086]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x100e07e
test byte [0x1013f30], 0x10
je case.default.0x100dc91
cmp dword [0x1013e9c], 5
jb case.default.0x100dc91
jmp 0x100e004
mov eax, dword [0x1013f30]
test al, 0x10
je case.default.0x100dc91
test eax, 0x100
jmp 0x100e002
mov eax, dword [0x1013f30]
test al, 0x10
je case.default.0x100dc91
test eax, 0x100
je case.default.0x100dc91
jmp 0x100e004
mov eax, dword [0x1013f30]
test eax, 0x100
je case.default.0x100dc91
test al, 0x10
jmp 0x100e002
test dword [0x1013f30], 0x110
je case.default.0x100dc91
push 0x1003e24
push 0x1003de8
push 0x1003db0
push 0x80000002
call fcn.0100d885
test eax, eax
jmp 0x100dcf0
push 0x25
call fcn.0100dc42
test eax, eax
jne case.default.0x100dc91
cmp byte [0x1013f32], bl
jne case.default.0x100dc91
push 0x1003da8
mov edi, 0x1003db0
push edi
mov esi, 0x80000002
push esi
call fcn.0100d938
test eax, eax
jne case.default.0x100dc91
push 0x1003d9c
push 0x1003de8
push edi
push esi
jmp 0x100dd36
call fcn.0100da61
jmp 0x100e07e
cmp dword [0x1013ea8], 2
jne case.default.0x100dc91
jmp 0x100dcb5
cmp byte [0x1013f32], bl
jne case.default.0x100dc91
cmp dword [0x1013e9c], 5
jmp 0x100e002
mov al, byte [0x1013f32]
cmp al, 3
je 0x100ddcb
cmp al, 2
jne case.default.0x100dc91
cmp dword [0x1013e9c], 5
jne case.default.0x100dc91
mov al, byte [0x1013f30]
test al, 2
je case.default.0x100dc91
test al, al
js case.default.0x100dc91
jmp 0x100e004
mov al, byte [0x1013f32]
cmp al, 3
je 0x100de03
cmp al, 2
jne case.default.0x100dc91
cmp dword [0x1013e9c], 5
jne case.default.0x100dc91
test byte [0x1013f30], 0x80
jmp 0x100dcf0
mov al, byte [0x1013f32]
cmp al, 3
je 0x100de2d
cmp al, 2
jne case.default.0x100dc91
test byte [0x1013f30], 0x82
jmp 0x100dda8
mov eax, dword [0x1013f30]
and eax, 0x40
jmp 0x100e07e
xor eax, eax
cmp dword [0x1013ea8], ebx
sete al
jmp 0x100e07e
xor eax, eax
cmp dword [0x1013ea8], 2
jmp 0x100de4e
cmp dword [0x1013ea8], ebx
jne case.default.0x100dc91
cmp dword [0x1013e9c], 4
jmp 0x100dcbc
cmp dword [0x1013ea8], ebx
jne case.default.0x100dc91
cmp dword [0x1013e9c], 4
jne case.default.0x100dc91
cmp dword [0x1013ea0], 0
jne case.default.0x100dc91
mov eax, 0x3b6
cmp word [0x1013ea4], ax
jmp 0x100e002
cmp dword [0x1013ea8], ebx
jne case.default.0x100dc91
mov eax, dword [0x1013e9c]
cmp eax, 4
ja 0x100e004
jne case.default.0x100dc91
cmp dword [0x1013ea0], 0xa
jmp 0x100dcbc
cmp dword [0x1013ea8], ebx
jne case.default.0x100dc91
cmp dword [0x1013e9c], 4
jne case.default.0x100dc91
cmp dword [0x1013ea0], 0xa
jne case.default.0x100dc91
mov eax, 0x7ce
jmp 0x100dea4
cmp dword [0x1013ea8], ebx
jne case.default.0x100dc91
mov eax, dword [0x1013e9c]
cmp eax, 4
jne 0x100e07a
cmp dword [0x1013ea0], 0x5a
jae 0x100e004
cmp eax, eax
jmp 0x100e07a
cmp dword [0x1013ea8], 2
jmp 0x100de67
cmp dword [0x1013ea8], 2
jne case.default.0x100dc91
mov eax, dword [0x1013e9c]
cmp eax, 5
jmp 0x100e06f
cmp dword [0x1013ea8], 2
jne case.default.0x100dc91
test dword [0x1013f30], 0x200
jmp 0x100dcf0
cmp dword [0x1013ea8], 2
jne case.default.0x100dc91
cmp byte [0x1013f32], bl
jmp 0x100e002
mov al, byte [0x1013f32]
cmp al, 3
je 0x100de10
cmp al, 2
jmp 0x100de0a
mov al, byte [0x1013f32]
cmp al, 3
je 0x100ddd8
cmp al, 2
jmp 0x100ddd2
mov al, byte [0x1013f32]
cmp al, 3
je 0x100dfc7
cmp al, 2
jne case.default.0x100dc91
mov eax, dword [0x1013f30]
test al, 0xa3
jne case.default.0x100dc91
test eax, 0x400
jmp 0x100e002
mov eax, dword [0x1013f30]
and eax, 0x400
jmp 0x100e07e
mov eax, dword [0x1013f30]
and eax, 0x20
jmp 0x100e07e
mov al, byte [0x1013f32]
cmp al, 3
je 0x100e004
cmp al, 2
jne case.default.0x100dc91
mov eax, ebx
jmp 0x100e07e
xor eax, eax
cmp byte [0x1013f32], 2
jmp 0x100de4e
call fcn.0100dabf
jmp 0x100e07e
call fcn.0100db7a
jmp 0x100e07e
push 0x57
jmp 0x100dc9d
push 0x58
jmp 0x100dc9d
call fcn.0100dbb7
jmp 0x100e07e
call fcn.0100db1e
jmp 0x100e07e
cmp dword [0x1013ea8], 2
jne case.default.0x100dc91
cmp dword [0x1013e9c], 6
jmp 0x100dcbc
push 0x1e
call fcn.0100dc42
jmp 0x100e07e
cmp dword [0x1013ea8], 2
jne case.default.0x100dc91
mov eax, dword [0x1013e9c]
cmp eax, 6
ja 0x100e004
jne case.default.0x100dc91
cmp dword [0x1013ea0], 0
ja 0x100e004
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4