Function at 0x101f94f
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x10219bc], 0
push edi
jne 0x101f992
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1021920
push edi
mov dword [0x10219bc], ebx
mov dword [0x1021920], 0x9c
call esi
test eax, eax
jne 0x101f992
push edi
mov dword [0x1021920], 0x94
call esi
mov eax, dword [ebp + 8]
cmp eax, 0x29
ja case.default.0x101f99e
jmp dword [eax*4 + 0x101fd93]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x101fd8b
test byte [0x10219b8], 0x10
je case.default.0x101f99e
cmp dword [0x1021924], 5
jb case.default.0x101f99e
jmp 0x101fd11
mov eax, dword [0x10219b8]
test al, 0x10
je case.default.0x101f99e
test eax, 0x100
jmp 0x101fd0f
mov eax, dword [0x10219b8]
test al, 0x10
je case.default.0x101f99e
test eax, 0x100
je case.default.0x101f99e
jmp 0x101fd11
mov eax, dword [0x10219b8]
test eax, 0x100
je case.default.0x101f99e
test al, 0x10
jmp 0x101fd0f
test dword [0x10219b8], 0x110
je case.default.0x101f99e
push 0x1002404
push 0x10023c8
push 0x1002390
push 0x80000002
call fcn.0101f592
test eax, eax
jmp 0x101f9fd
push 0x25
call fcn.0101f94f
test eax, eax
jne case.default.0x101f99e
cmp byte [0x10219ba], bl
jne case.default.0x101f99e
push 0x1002388
mov edi, 0x1002390
push edi
mov esi, 0x80000002
push esi
call fcn.0101f645
test eax, eax
jne case.default.0x101f99e
push 0x100237c
push 0x10023c8
push edi
push esi
jmp 0x101fa43
call fcn.0101f76e
jmp 0x101fd8b
cmp dword [0x1021930], 2
jne case.default.0x101f99e
jmp 0x101f9c2
cmp byte [0x10219ba], bl
jne case.default.0x101f99e
cmp dword [0x1021924], 5
jmp 0x101fd0f
mov al, byte [0x10219ba]
cmp al, 3
je 0x101fad8
cmp al, 2
jne case.default.0x101f99e
cmp dword [0x1021924], 5
jne case.default.0x101f99e
mov al, byte [0x10219b8]
test al, 2
je case.default.0x101f99e
test al, al
js case.default.0x101f99e
jmp 0x101fd11
mov al, byte [0x10219ba]
cmp al, 3
je 0x101fb10
cmp al, 2
jne case.default.0x101f99e
cmp dword [0x1021924], 5
jne case.default.0x101f99e
test byte [0x10219b8], 0x80
jmp 0x101f9fd
mov al, byte [0x10219ba]
cmp al, 3
je 0x101fb3a
cmp al, 2
jne case.default.0x101f99e
test byte [0x10219b8], 0x82
jmp 0x101fab5
mov eax, dword [0x10219b8]
and eax, 0x40
jmp 0x101fd8b
xor eax, eax
cmp dword [0x1021930], ebx
sete al
jmp 0x101fd8b
xor eax, eax
cmp dword [0x1021930], 2
jmp 0x101fb5b
cmp dword [0x1021930], ebx
jne case.default.0x101f99e
cmp dword [0x1021924], 4
jmp 0x101f9c9
cmp dword [0x1021930], ebx
jne case.default.0x101f99e
cmp dword [0x1021924], 4
jne case.default.0x101f99e
cmp dword [0x1021928], 0
jne case.default.0x101f99e
mov eax, 0x3b6
cmp word [0x102192c], ax
jmp 0x101fd0f
cmp dword [0x1021930], ebx
jne case.default.0x101f99e
mov eax, dword [0x1021924]
cmp eax, 4
ja 0x101fd11
jne case.default.0x101f99e
cmp dword [0x1021928], 0xa
jmp 0x101f9c9
cmp dword [0x1021930], ebx
jne case.default.0x101f99e
cmp dword [0x1021924], 4
jne case.default.0x101f99e
cmp dword [0x1021928], 0xa
jne case.default.0x101f99e
mov eax, 0x7ce
jmp 0x101fbb1
cmp dword [0x1021930], ebx
jne case.default.0x101f99e
mov eax, dword [0x1021924]
cmp eax, 4
jne 0x101fd87
cmp dword [0x1021928], 0x5a
jae 0x101fd11
cmp eax, eax
jmp 0x101fd87
cmp dword [0x1021930], 2
jmp 0x101fb74
cmp dword [0x1021930], 2
jne case.default.0x101f99e
mov eax, dword [0x1021924]
cmp eax, 5
jmp 0x101fd7c
cmp dword [0x1021930], 2
jne case.default.0x101f99e
test dword [0x10219b8], 0x200
jmp 0x101f9fd
cmp dword [0x1021930], 2
jne case.default.0x101f99e
cmp byte [0x10219ba], bl
jmp 0x101fd0f
mov al, byte [0x10219ba]
cmp al, 3
je 0x101fb1d
cmp al, 2
jmp 0x101fb17
mov al, byte [0x10219ba]
cmp al, 3
je 0x101fae5
cmp al, 2
jmp 0x101fadf
mov al, byte [0x10219ba]
cmp al, 3
je 0x101fcd4
cmp al, 2
jne case.default.0x101f99e
mov eax, dword [0x10219b8]
test al, 0xa3
jne case.default.0x101f99e
test eax, 0x400
jmp 0x101fd0f
mov eax, dword [0x10219b8]
and eax, 0x400
jmp 0x101fd8b
mov eax, dword [0x10219b8]
and eax, 0x20
jmp 0x101fd8b
mov al, byte [0x10219ba]
cmp al, 3
je 0x101fd11
cmp al, 2
jne case.default.0x101f99e
mov eax, ebx
jmp 0x101fd8b
xor eax, eax
cmp byte [0x10219ba], 2
jmp 0x101fb5b
call fcn.0101f7cc
jmp 0x101fd8b
call fcn.0101f887
jmp 0x101fd8b
push 0x57
jmp 0x101f9aa
push 0x58
jmp 0x101f9aa
call fcn.0101f8c4
jmp 0x101fd8b
call fcn.0101f82b
jmp 0x101fd8b
cmp dword [0x1021930], 2
jne case.default.0x101f99e
cmp dword [0x1021924], 6
jmp 0x101f9c9
push 0x1e
call fcn.0101f94f
jmp 0x101fd8b
cmp dword [0x1021930], 2
jne case.default.0x101f99e
mov eax, dword [0x1021924]
cmp eax, 6
ja 0x101fd11
jne case.default.0x101f99e
cmp dword [0x1021928], 0
ja 0x101fd11
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4