Function at 0x38c17fa8
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x38c2844c], 0
push edi
jne 0x38c17feb
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x38c283b0
push edi
mov dword [0x38c2844c], ebx
mov dword [0x38c283b0], 0x9c
call esi
test eax, eax
jne 0x38c17feb
push edi
mov dword [0x38c283b0], 0x94
call esi
mov eax, dword [0x38c283b4]
mov esi, dword [ebp + 8]
mov ecx, dword [0x38c283b8]
push 5
pop edx
cmp eax, edx
jne 0x38c18031
test ecx, ecx
jne 0x38c18031
cmp esi, 0x15
jne 0x38c18031
cmp byte [0x38c2844a], 3
jne case.default.0x38c18036
mov eax, dword [0x38c28448]
test al, 2
je case.default.0x38c18036
test ah, 4
je case.default.0x38c18036
test al, al
jns 0x38c1835d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp esi, 0x25
ja case.default.0x38c18036
jmp dword [esi*4 + 0x38c18397]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x38c1802a
test byte [0x38c28448], 0x10
je case.default.0x38c18036
cmp eax, edx
jae 0x38c1835d
jmp case.default.0x38c18036
mov eax, dword [0x38c28448]
test al, 0x10
je case.default.0x38c18036
test ah, 1
jmp 0x38c18357
mov eax, dword [0x38c28448]
test al, 0x10
je case.default.0x38c18036
test ah, 1
jne 0x38c1835d
jmp case.default.0x38c18036
mov eax, dword [0x38c28448]
test ah, 1
je case.default.0x38c18036
test al, 0x10
jmp 0x38c18357
test word [0x38c28448], 0x110
je case.default.0x38c18036
push 0x38c184b8
push 0x38c1847c
push 0x38c18444
push 0x80000002
jmp 0x38c180f7
cmp byte [0x38c2844a], bl
jne case.default.0x38c18036
call fcn.38c17d26
test eax, eax
jne case.default.0x38c18036
push 0x38c1843c
mov edi, 0x38c18444
push edi
mov esi, 0x80000002
push esi
call fcn.38c44c52
test eax, eax
jne case.default.0x38c18036
push 0x38c18430
push 0x38c1847c
push edi
push esi
call fcn.38c17b26
test eax, eax
jmp 0x38c1807a
call fcn.38c17d26
jmp 0x38c1802a
cmp dword [0x38c283c0], 2
je 0x38c18053
jmp case.default.0x38c18036
cmp byte [0x38c2844a], bl
jne case.default.0x38c18036
cmp eax, edx
jmp 0x38c18357
mov cl, byte [0x38c2844a]
cmp cl, 3
je 0x38c18146
cmp cl, 2
jne case.default.0x38c18036
cmp eax, edx
jmp 0x38c182fb
mov cl, byte [0x38c2844a]
cmp cl, 3
je 0x38c18161
cmp cl, 2
jne case.default.0x38c18036
cmp eax, edx
jmp 0x38c182de
mov cl, byte [0x38c2844a]
cmp cl, 3
je 0x38c1817c
cmp cl, 2
jne case.default.0x38c18036
test byte [0x38c28448], 0x82
jmp 0x38c18125
mov eax, dword [0x38c28448]
and eax, 0x40
jmp 0x38c1802a
xor eax, eax
cmp dword [0x38c283c0], ebx
sete al
jmp 0x38c1802a
xor eax, eax
cmp dword [0x38c283c0], 2
jmp 0x38c1819a
cmp dword [0x38c283c0], ebx
jmp 0x38c18260
cmp dword [0x38c283c0], ebx
jne case.default.0x38c18036
cmp eax, 4
jne case.default.0x38c18036
test ecx, ecx
jne case.default.0x38c18036
cmp word [0x38c283bc], 0x3b6
jmp 0x38c18357
cmp dword [0x38c283c0], ebx
jne case.default.0x38c18036
cmp eax, 4
ja 0x38c1835d
jne case.default.0x38c18036
cmp ecx, 0xa
jmp 0x38c18055
cmp dword [0x38c283c0], ebx
jne case.default.0x38c18036
cmp eax, 4
jne case.default.0x38c18036
cmp ecx, 0xa
jne case.default.0x38c18036
cmp word [0x38c283bc], 0x7ce
jmp 0x38c18357
cmp dword [0x38c283c0], ebx
jne case.default.0x38c18036
cmp eax, 4
jne 0x38c1824e
cmp ecx, 0x5a
jae 0x38c1835d
cmp eax, eax
ja 0x38c1835d
jmp case.default.0x38c18036
cmp dword [0x38c283c0], 2
jne case.default.0x38c18036
cmp eax, 4
jmp 0x38c18055
cmp dword [0x38c283c0], 2
jne case.default.0x38c18036
cmp eax, edx
ja 0x38c1835d
jne case.default.0x38c18036
test ecx, ecx
ja 0x38c1835d
jne case.default.0x38c18036
cmp word [0x38c283bc], 0x893
jmp 0x38c1824e
cmp dword [0x38c283c0], 2
jne case.default.0x38c18036
test byte [0x38c28449], 2
jmp 0x38c1807a
cmp dword [0x38c283c0], 2
jne case.default.0x38c18036
cmp byte [0x38c2844a], bl
jmp 0x38c18357
mov al, byte [0x38c2844a]
cmp al, 3
je 0x38c182e4
cmp al, 2
jne case.default.0x38c18036
test byte [0x38c28448], 0x80
jmp 0x38c1807a
mov al, byte [0x38c2844a]
cmp al, 3
je 0x38c18301
cmp al, 2
jne case.default.0x38c18036
mov al, byte [0x38c28448]
test al, 2
jmp 0x38c1801e
mov al, byte [0x38c2844a]
cmp al, 3
je 0x38c1831e
cmp al, 2
jne case.default.0x38c18036
mov eax, dword [0x38c28448]
test al, 0xa2
jne case.default.0x38c18036
test ah, 4
jmp 0x38c18357
mov eax, dword [0x38c28448]
and eax, 0x400
jmp 0x38c1802a
mov eax, dword [0x38c28448]
and eax, 0x20
jmp 0x38c1802a
mov al, byte [0x38c2844a]
cmp al, 3
je 0x38c1835d
cmp al, 2
jne case.default.0x38c18036
mov eax, ebx
jmp 0x38c1802a
call fcn.38c17d84
jmp 0x38c1802a
push 0x56
jmp 0x38c18042
push 0x57
jmp 0x38c18042
call fcn.38c17ef5
jmp 0x38c1802a
push 0x58
jmp 0x38c18042
call fcn.38c17dff
jmp 0x38c1802a