Function at 0x100ca78
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x102e2b4], 0
push edi
jne 0x100cabb
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov edi, 0x102e218
push edi
mov dword [0x102e2b4], ebx
mov dword [0x102e218], 0x9c
call esi
test eax, eax
jne 0x100cabb
push edi
mov dword [0x102e218], 0x94
call esi
mov eax, dword [0x102e21c]
mov esi, dword [ebp + 8]
mov ecx, dword [0x102e220]
push 5
pop edx
cmp eax, edx
jne 0x100cb01
test ecx, ecx
jne 0x100cb01
cmp esi, 0x15
jne 0x100cb01
cmp byte [0x102e2b2], 3
jne case.0x100cb06.37
mov eax, dword [0x102e2b0]
test al, 2
je case.0x100cb06.37
test ah, 4
je case.0x100cb06.37
test al, al
jns 0x100ce2b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp esi, 0x26
ja case.0x100cb06.37
jmp dword [esi*4 + 0x100ce65]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x100cafa
test byte [0x102e2b0], 0x10
je case.0x100cb06.37
cmp eax, edx
jb case.0x100cb06.37
jmp 0x100ce2b
mov eax, dword [0x102e2b0]
test al, 0x10
je case.0x100cb06.37
test ah, 1
jmp 0x100ce25
mov eax, dword [0x102e2b0]
test al, 0x10
je case.0x100cb06.37
test ah, 1
je case.0x100cb06.37
jmp 0x100ce2b
mov eax, dword [0x102e2b0]
test ah, 1
je case.0x100cb06.37
test al, 0x10
jmp 0x100ce25
test word [0x102e2b0], 0x110
je case.0x100cb06.37
push 0x1002d18
push 0x1002cdc
push 0x1002ca4
push reloc.OLEAUT32.dll_SysReAllocString
jmp 0x100cbc5
cmp byte [0x102e2b2], bl
jne case.0x100cb06.37
call fcn.0100c8d4
test eax, eax
jne case.0x100cb06.37
push 0x1002c9c
mov edi, 0x1002ca4
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.0100c7af
test eax, eax
jne case.0x100cb06.37
push 0x1002c90
push 0x1002cdc
push edi
push esi
call fcn.0100c6fc
test eax, eax
jmp 0x100cb49
call fcn.0100c8d4
jmp 0x100cafa
cmp dword [0x102e228], 2
jne case.0x100cb06.37
jmp 0x100cb23
cmp byte [0x102e2b2], bl
jne case.0x100cb06.37
cmp eax, edx
jmp 0x100ce25
mov cl, byte [0x102e2b2]
cmp cl, 3
je 0x100cc14
cmp cl, 2
jne case.0x100cb06.37
cmp eax, edx
jmp 0x100cdc9
mov cl, byte [0x102e2b2]
cmp cl, 3
je 0x100cc2f
cmp cl, 2
jne case.0x100cb06.37
cmp eax, edx
jmp 0x100cdac
mov cl, byte [0x102e2b2]
cmp cl, 3
je 0x100cc4a
cmp cl, 2
jne case.0x100cb06.37
test byte [0x102e2b0], 0x82
jmp 0x100cbf3
mov eax, dword [0x102e2b0]
and eax, 0x40
jmp 0x100cafa
xor eax, eax
cmp dword [0x102e228], ebx
sete al
jmp 0x100cafa
xor eax, eax
cmp dword [0x102e228], 2
jmp 0x100cc68
cmp dword [0x102e228], ebx
jmp 0x100cd2e
cmp dword [0x102e228], ebx
jne case.0x100cb06.37
cmp eax, 4
jne case.0x100cb06.37
test ecx, ecx
jne case.0x100cb06.37
cmp word [0x102e224], 0x3b6
jmp 0x100ce25
cmp dword [0x102e228], ebx
jne case.0x100cb06.37
cmp eax, 4
ja 0x100ce2b
jne case.0x100cb06.37
cmp ecx, 0xa
jmp 0x100cb25
cmp dword [0x102e228], ebx
jne case.0x100cb06.37
cmp eax, 4
jne case.0x100cb06.37
cmp ecx, 0xa
jne case.0x100cb06.37
cmp word [0x102e224], 0x7ce
jmp 0x100ce25
cmp dword [0x102e228], ebx
jne case.0x100cb06.37
cmp eax, 4
jne 0x100cd1c
cmp ecx, 0x5a
jae 0x100ce2b
cmp eax, eax
jbe case.0x100cb06.37
jmp 0x100ce2b
cmp dword [0x102e228], 2
jne case.0x100cb06.37
cmp eax, 4
jmp 0x100cb25
cmp dword [0x102e228], 2
jne case.0x100cb06.37
cmp eax, edx
ja 0x100ce2b
jne case.0x100cb06.37
test ecx, ecx
ja 0x100ce2b
jne case.0x100cb06.37
cmp word [0x102e224], 0x893
jmp 0x100cd1c
cmp dword [0x102e228], 2
jne case.0x100cb06.37
test byte [0x102e2b1], 2
jmp 0x100cb49
cmp dword [0x102e228], 2
jne case.0x100cb06.37
cmp byte [0x102e2b2], bl
jmp 0x100ce25
mov al, byte [0x102e2b2]
cmp al, 3
je 0x100cdb2
cmp al, 2
jne case.0x100cb06.37
test byte [0x102e2b0], 0x80
jmp 0x100cb49
mov al, byte [0x102e2b2]
cmp al, 3
je 0x100cdcf
cmp al, 2
jne case.0x100cb06.37
mov al, byte [0x102e2b0]
test al, 2
jmp 0x100caee
mov al, byte [0x102e2b2]
cmp al, 3
je 0x100cdec
cmp al, 2
jne case.0x100cb06.37
mov eax, dword [0x102e2b0]
test al, 0xa2
jne case.0x100cb06.37
test ah, 4
jmp 0x100ce25
mov eax, dword [0x102e2b0]
and eax, 0x400
jmp 0x100cafa
mov eax, dword [0x102e2b0]
and eax, 0x20
jmp 0x100cafa
mov al, byte [0x102e2b2]
cmp al, 3
je 0x100ce2b
cmp al, 2
jne case.0x100cb06.37
mov eax, ebx
jmp 0x100cafa
call fcn.0100c932
jmp 0x100cafa
push 0x56
jmp 0x100cb12
push 0x57
jmp 0x100cb12
call fcn.0100c9ed
jmp 0x100cafa
push 0x58
jmp 0x100cb12
call fcn.0100c991
jmp 0x100cafa