Function at 0x4070a8
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov edi, ecx
mov ebx, 1
cmp dword [0x00411bdc], esi
jne 0x407100
lea rcx, [0x00411b40]
mov dword [0x00411bdc], ebx
mov dword [0x00411b40], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, esi
jne 0x407100
lea rcx, [0x00411b40]
mov dword [0x00411b40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp edi, 0x15
ja 0x4073e7
je 0x4073d2
cmp edi, 0xa
ja 0x407279
je 0x407246
cmp edi, 5
ja 0x4071c1
je 0x407194
cmp edi, esi
je 0x407185
sub edi, ebx
je 0x407174
sub edi, ebx
je 0x40715c
sub edi, ebx
je 0x407153
cmp edi, ebx
jne 0x4072ee
cmp dword [0x00411b50], 2
jne 0x4072ee
jmp 0x4072e1
cmp dword [0x00411b50], 2
jmp 0x407162
cmp dword [0x00411b50], ebx
jne 0x4072ee
cmp dword [0x00411b44], 4
jmp 0x4072e8
cmp dword [0x00411b50], 2
mov ebx, esi
sete bl
jmp 0x407640
cmp dword [0x00411b50], ebx
sete sil
jmp 0x4072ee
cmp dword [0x00411b50], ebx
jne 0x4072ee
mov eax, dword [0x00411b44]
cmp eax, 4
ja 0x407640
jne 0x4072ee
cmp dword [0x00411b48], 0xa
jmp 0x4072e8
sub edi, 6
je 0x407216
sub edi, ebx
je 0x407141
sub edi, ebx
je 0x4071fe
cmp edi, ebx
jne 0x4072ee
mov al, byte [0x00411bda]
cmp al, 3
je 0x4071ec
cmp al, 2
jne 0x4072ee
mov al, byte [0x00411bd8]
test al, al
js 0x4072ee
test al, 2
jmp 0x407204
cmp byte [0x00411bda], bl
jne 0x4072ee
cmp dword [0x00411b44], 5
jmp 0x407494
cmp dword [0x00411b50], ebx
jne 0x4072ee
cmp dword [0x00411b44], 4
jne 0x4072ee
cmp dword [0x00411b48], 0xa
jne 0x4072ee
mov eax, 0x7ce
jmp 0x407333
mov al, byte [0x00411bda]
cmp al, 3
je 0x407258
cmp al, 2
jne 0x4072ee
cmp dword [0x00411b44], 5
jne 0x4072ee
mov al, byte [0x00411bd8]
test al, 2
je 0x4072ee
test al, al
jns 0x407640
jmp 0x4072ee
cmp edi, 0x10
ja 0x40733f
je 0x407315
sub edi, 0xb
je 0x4072f5
sub edi, ebx
je 0x4072d8
sub edi, ebx
je 0x4072ca
sub edi, ebx
je 0x4072ba
cmp edi, ebx
jne 0x4072ee
test byte [0x00411bd8], 0x10
je 0x4072ee
mov eax, 0x100
test word [0x00411bd8], ax
jne 0x407640
jmp 0x4072ee
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x40763e
mov ebx, dword [0x00411bd8]
and ebx, 0x40
jmp 0x407640
test byte [0x00411bd8], 0x10
je 0x4072ee
cmp dword [0x00411b44], 5
jae 0x407640
mov ebx, esi
jmp 0x407640
mov al, byte [0x00411bda]
cmp al, 3
je 0x407303
cmp al, 2
jne 0x4072ee
cmp dword [0x00411b44], 5
jne 0x4072ee
test byte [0x00411bd8], 0x80
jmp 0x4072b2
cmp dword [0x00411b50], ebx
jne 0x4072ee
cmp dword [0x00411b44], 4
jne 0x4072ee
cmp dword [0x00411b48], esi
jne 0x4072ee
mov eax, 0x3b6
cmp word [0x00411b4c], ax
jmp 0x407494
sub edi, 0x11
je 0x4073a1
sub edi, ebx
je 0x407377
sub edi, ebx
je 0x407364
cmp edi, ebx
jne 0x4072ee
cmp dword [0x00411b50], 2
jne 0x4072ee
cmp byte [0x00411bda], bl
jmp 0x407494
cmp dword [0x00411b50], 2
jne 0x4072ee
mov eax, 0x200
jmp 0x4072ab
cmp dword [0x00411b50], 2
jne 0x4072ee
mov eax, dword [0x00411b44]
cmp eax, 5
ja 0x407640
jne 0x4072ee
cmp dword [0x00411b48], esi
jmp 0x4073c7
cmp dword [0x00411b50], ebx
jne 0x4072ee
mov eax, dword [0x00411b44]
cmp eax, 4
jne 0x4073c7
cmp dword [0x00411b48], 0x5a
jae 0x407640
cmp eax, eax
ja 0x407640
jmp 0x4072ee
mov al, byte [0x00411bda]
cmp al, 3
je 0x40730c
cmp al, 2
jmp 0x40730a
cmp edi, 0x20
ja 0x4075aa
je 0x40759c
cmp edi, 0x1b
ja 0x40754c
je 0x4074fa
sub edi, 0x16
je 0x4074e5
sub edi, ebx
je 0x40749f
sub edi, ebx
je 0x40747b
sub edi, ebx
je 0x407460
cmp edi, ebx
jne 0x4072ee
mov eax, 0x110
test word [0x00411bd8], ax
je 0x4072ee
lea r9, str.AllowMultipleTSSessions
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionpolicies_system
call fcn.00406b58
cmp eax, esi
jmp 0x4072b2
mov eax, 0x100
test word [0x00411bd8], ax
je 0x4072ee
test byte [0x00411bd8], 0x10
jmp 0x407494
test byte [0x00411bd8], 0x10
je 0x4072ee
mov eax, 0x100
test word [0x00411bd8], ax
je 0x407640
jmp 0x4072ee
mov al, byte [0x00411bda]
cmp al, 3
je 0x4074b1
cmp al, 2
jne 0x4072ee
mov al, byte [0x00411bd8]
test al, al
js 0x4072ee
test al, 2
jne 0x4072ee
mov ecx, 0x400
test word [0x00411bd8], cx
jne 0x4072ee
test bl, al
jne 0x4072ee
test al, 0x20
jmp 0x407494
mov al, byte [0x00411bda]
cmp al, 3
je 0x407265
cmp al, 2
jmp 0x40725f
mov ecx, 0x25
call fcn.004070a8
cmp eax, esi
jne 0x4072ee
cmp byte [0x00411bda], bl
jne 0x4072ee
mov rdi, 0xffffffff80000002
lea r8, str.GinaDLL
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, rdi
call fcn.00406c78
cmp eax, esi
jne 0x4072ee
lea r9, str.LogonType
mov rcx, rdi
jmp 0x407446
sub edi, 0x1c
je 0x407592
sub edi, ebx
je 0x40757d
sub edi, ebx
je 0x407573
cmp edi, ebx
jne 0x4072ee
mov ebx, dword [0x00411bd8]
mov ecx, 0x400
and ebx, ecx
jmp 0x407640
call fcn.00406e88
jmp 0x40763e
mov al, byte [0x00411bda]
cmp al, 3
je 0x407640
cmp al, 2
jmp 0x407494
call fcn.00406e14
jmp 0x40763e
mov ebx, dword [0x00411bd8]
and ebx, 0x20
jmp 0x407640
sub edi, 0x21
je 0x407639
sub edi, ebx
je 0x407632
sub edi, ebx
je 0x407628
sub edi, ebx
je 0x407621
sub edi, ebx
je 0x407608
sub edi, ebx
je 0x4075fe
sub edi, ebx
je 0x4075f2
sub edi, ebx
je 0x407640
cmp edi, ebx
jne 0x4072ee
cmp dword [0x00411b50], 2
jne 0x4072ee
mov eax, dword [0x00411b44]
cmp eax, 6
jmp 0x40738d
cmp byte [0x00411bda], 2
jmp 0x40717b
mov ecx, 0x58
jmp 0x4072bf
cmp dword [0x00411b50], 2
jne 0x4072ee
cmp dword [0x00411b44], 6
jmp 0x4072e8
call fcn.00406fe4
jmp 0x40763e
mov ecx, 0x57
jmp 0x4072bf
call fcn.00406f0c
jmp 0x40763e
call fcn.00406f90
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret