Function at 0x100f86d
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push edi
mov dword [0x1047390], 0x94
call esi
jmp 0x100f885
cmp esi, 0x15
jne 0x100f8a2
cmp byte [0x104742a], 3
jne case.0x100f8ab.37
mov eax, dword [0x1047428]
test al, 2
je case.0x100f8ab.37
test ah, 4
je case.0x100f8ab.37
test al, al
js case.0x100f8ab.37
jmp 0x100f8c7
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x100f8c9
test byte [0x1047428], 0x10
jne 0x100f8bf
jmp case.0x100f8ab.37
mov eax, dword [0x1047428]
test al, 0x10
je case.0x100f8ab.37
test ah, 1
jmp 0x100f6b3
mov eax, dword [0x1047428]
test al, 0x10
je case.0x100f8ab.37
test ah, 1
jne 0x100f8c7
jmp case.0x100f8ab.37
mov eax, dword [0x1047428]
test ah, 1
je case.0x100f8ab.37
test al, 0x10
jmp 0x100f6b3
test word [0x1047428], 0x110
je case.0x100f8ab.37
push 0x100f850
push 0x100f814
push 0x100f7dc
push reloc.OLEAUT32.dll_SysReAllocString
jmp 0x100f461
cmp byte [0x104742a], bl
jne case.0x100f8ab.37
call fcn.0103cf02
test eax, eax
jne case.0x100f8ab.37
push 0x100f7d4
mov edi, 0x100f7dc
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.0103cdb5
test eax, eax
jne case.0x100f8ab.37
push 0x100f7c8
push 0x100f814
push edi
push esi
call fcn.0103cd02
test eax, eax
jmp 0x100f3d9
call fcn.0103cf02
jmp 0x100f8c9
cmp byte [0x104742a], bl
jne case.0x100f8ab.37
cmp eax, edx
jmp 0x100f6b3
mov cl, byte [0x104742a]
cmp cl, 3
je 0x100f49e
cmp cl, 2
jne case.0x100f8ab.37
cmp eax, edx
jmp 0x100f653
mov cl, byte [0x104742a]
cmp cl, 3
je 0x100f4b9
cmp cl, 2
jne case.0x100f8ab.37
cmp eax, edx
jmp 0x100f636
mov cl, byte [0x104742a]
cmp cl, 3
je 0x100f4d4
cmp cl, 2
jne case.0x100f8ab.37
test byte [0x1047428], 0x82
jmp 0x100f47d
mov eax, dword [0x1047428]
and eax, 0x40
jmp 0x100f8c9
xor eax, eax
cmp dword [0x10473a0], ebx
sete al
jmp 0x100f8c9
xor eax, eax
cmp dword [0x10473a0], 2
jmp 0x100f4f2
cmp dword [0x10473a0], ebx
jmp 0x100f5b8
cmp dword [0x10473a0], ebx
jne case.0x100f8ab.37
cmp eax, 4
jne case.0x100f8ab.37
test ecx, ecx
jne case.0x100f8ab.37
cmp word [0x104739c], 0x3b6
jmp 0x100f6b3
cmp dword [0x10473a0], ebx
jne case.0x100f8ab.37
cmp eax, 4
ja 0x100f8c7
jne case.0x100f8ab.37
cmp ecx, 0xa
jmp 0x100f8c1
cmp dword [0x10473a0], ebx
jne case.0x100f8ab.37
cmp eax, 4
jne case.0x100f8ab.37
cmp ecx, 0xa
jne case.0x100f8ab.37
cmp word [0x104739c], 0x7ce
jmp 0x100f6b3
cmp dword [0x10473a0], ebx
jne case.0x100f8ab.37
cmp eax, 4
jne 0x100f5a6
cmp ecx, 0x5a
jae 0x100f8c7
cmp eax, eax
ja 0x100f8c7
jmp case.0x100f8ab.37
cmp dword [0x10473a0], 2
jne case.0x100f8ab.37
cmp eax, 4
jmp 0x100f8c1
cmp dword [0x10473a0], 2
jne case.0x100f8ab.37
cmp eax, edx
ja 0x100f8c7
jne case.0x100f8ab.37
test ecx, ecx
ja 0x100f8c7
jne case.0x100f8ab.37
cmp word [0x104739c], 0x893
jmp 0x100f5a6
cmp dword [0x10473a0], 2
jne case.0x100f8ab.37
test byte [0x1047429], 2
jmp 0x100f3d9
cmp dword [0x10473a0], 2
jne case.0x100f8ab.37
cmp byte [0x104742a], bl
jmp 0x100f6b3
mov al, byte [0x104742a]
cmp al, 3
je 0x100f63c
cmp al, 2
jne case.0x100f8ab.37
test byte [0x1047428], 0x80
jmp 0x100f3d9
mov al, byte [0x104742a]
cmp al, 3
je 0x100f659
cmp al, 2
jne case.0x100f8ab.37
mov al, byte [0x1047428]
test al, 2
jmp 0x100f37f
mov al, byte [0x104742a]
cmp al, 3
je 0x100f676
cmp al, 2
jne case.0x100f8ab.37
mov eax, dword [0x1047428]
test al, 0xa2
jne case.0x100f8ab.37
test ah, 4
jmp 0x100f6b3
mov eax, dword [0x1047428]
and eax, 0x400
jmp 0x100f8c9
mov eax, dword [0x1047428]
and eax, 0x20
jmp 0x100f8c9
mov al, byte [0x104742a]
cmp al, 3
je 0x100f8c7
cmp al, 2
je 0x100f8c7
jmp case.0x100f8ab.37
call fcn.0103cf60
jmp 0x100f8c9
push 0x56
jmp 0x100f397
push 0x57
jmp 0x100f397
call fcn.0103d04b
jmp 0x100f8c9
push 0x2003
jmp 0x100f397
push 0x2004
jmp 0x100f397
push 0x2005
jmp 0x100f397
push 0x58
jmp 0x100f397
call fcn.0103cfef
jmp 0x100f8c9
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x104742c], 0
push edi
je 0x101a2a9
mov eax, dword [0x1047394]
mov esi, dword [ebp + 8]
mov ecx, dword [0x1047398]
push 5
pop edx
cmp eax, edx
jne 0x100f8a2
test ecx, ecx
je 0x100f359
cmp esi, 0x2d
ja case.0x100f8ab.37
jmp dword [esi*4 + 0x100f70f]
cmp dword [0x10473a0], 2
jne case.0x100f8ab.37
cmp eax, edx
jb case.0x100f8ab.37
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1047390
push edi
mov dword [0x104742c], ebx
mov dword [0x1047390], 0x9c
call esi
test eax, eax
jne 0x100f885
jmp 0x100f347
xor eax, eax
jmp 0x100f8c9