Function at 0x101b72b
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x10230ac], 0
push edi
jne 0x101b76e
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1023010
push edi
mov dword [0x10230ac], ebx
mov dword [0x1023010], 0x9c
call esi
test eax, eax
jne 0x101b76e
push edi
mov dword [0x1023010], 0x94
call esi
mov eax, dword [ebp + 8]
cmp eax, 0x29
ja case.default.0x101b77a
jmp dword [eax*4 + 0x101bb6f]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x101bb67
test byte [0x10230a8], 0x10
je case.default.0x101b77a
cmp dword [0x1023014], 5
jb case.default.0x101b77a
jmp 0x101baed
mov eax, dword [0x10230a8]
test al, 0x10
je case.default.0x101b77a
test eax, 0x100
jmp 0x101baeb
mov eax, dword [0x10230a8]
test al, 0x10
je case.default.0x101b77a
test eax, 0x100
je case.default.0x101b77a
jmp 0x101baed
mov eax, dword [0x10230a8]
test eax, 0x100
je case.default.0x101b77a
test al, 0x10
jmp 0x101baeb
test dword [0x10230a8], 0x110
je case.default.0x101b77a
push 0x1006318
push 0x10062dc
push 0x10062a4
push 0x80000002
call fcn.0101b36e
test eax, eax
jmp 0x101b7d9
push 0x25
call fcn.0101b72b
test eax, eax
jne case.default.0x101b77a
cmp byte [0x10230aa], bl
jne case.default.0x101b77a
push 0x100629c
mov edi, 0x10062a4
push edi
mov esi, 0x80000002
push esi
call fcn.0101b421
test eax, eax
jne case.default.0x101b77a
push 0x1006290
push 0x10062dc
push edi
push esi
jmp 0x101b81f
call fcn.0101b54a
jmp 0x101bb67
cmp dword [0x1023020], 2
jne case.default.0x101b77a
jmp 0x101b79e
cmp byte [0x10230aa], bl
jne case.default.0x101b77a
cmp dword [0x1023014], 5
jmp 0x101baeb
mov al, byte [0x10230aa]
cmp al, 3
je 0x101b8b4
cmp al, 2
jne case.default.0x101b77a
cmp dword [0x1023014], 5
jne case.default.0x101b77a
mov al, byte [0x10230a8]
test al, 2
je case.default.0x101b77a
test al, al
js case.default.0x101b77a
jmp 0x101baed
mov al, byte [0x10230aa]
cmp al, 3
je 0x101b8ec
cmp al, 2
jne case.default.0x101b77a
cmp dword [0x1023014], 5
jne case.default.0x101b77a
test byte [0x10230a8], 0x80
jmp 0x101b7d9
mov al, byte [0x10230aa]
cmp al, 3
je 0x101b916
cmp al, 2
jne case.default.0x101b77a
test byte [0x10230a8], 0x82
jmp 0x101b891
mov eax, dword [0x10230a8]
and eax, 0x40
jmp 0x101bb67
xor eax, eax
cmp dword [0x1023020], ebx
sete al
jmp 0x101bb67
xor eax, eax
cmp dword [0x1023020], 2
jmp 0x101b937
cmp dword [0x1023020], ebx
jne case.default.0x101b77a
cmp dword [0x1023014], 4
jmp 0x101b7a5
cmp dword [0x1023020], ebx
jne case.default.0x101b77a
cmp dword [0x1023014], 4
jne case.default.0x101b77a
cmp dword [0x1023018], 0
jne case.default.0x101b77a
mov eax, 0x3b6
cmp word [0x102301c], ax
jmp 0x101baeb
cmp dword [0x1023020], ebx
jne case.default.0x101b77a
mov eax, dword [0x1023014]
cmp eax, 4
ja 0x101baed
jne case.default.0x101b77a
cmp dword [0x1023018], 0xa
jmp 0x101b7a5
cmp dword [0x1023020], ebx
jne case.default.0x101b77a
cmp dword [0x1023014], 4
jne case.default.0x101b77a
cmp dword [0x1023018], 0xa
jne case.default.0x101b77a
mov eax, 0x7ce
jmp 0x101b98d
cmp dword [0x1023020], ebx
jne case.default.0x101b77a
mov eax, dword [0x1023014]
cmp eax, 4
jne 0x101bb63
cmp dword [0x1023018], 0x5a
jae 0x101baed
cmp eax, eax
jmp 0x101bb63
cmp dword [0x1023020], 2
jmp 0x101b950
cmp dword [0x1023020], 2
jne case.default.0x101b77a
mov eax, dword [0x1023014]
cmp eax, 5
jmp 0x101bb58
cmp dword [0x1023020], 2
jne case.default.0x101b77a
test dword [0x10230a8], 0x200
jmp 0x101b7d9
cmp dword [0x1023020], 2
jne case.default.0x101b77a
cmp byte [0x10230aa], bl
jmp 0x101baeb
mov al, byte [0x10230aa]
cmp al, 3
je 0x101b8f9
cmp al, 2
jmp 0x101b8f3
mov al, byte [0x10230aa]
cmp al, 3
je 0x101b8c1
cmp al, 2
jmp 0x101b8bb
mov al, byte [0x10230aa]
cmp al, 3
je 0x101bab0
cmp al, 2
jne case.default.0x101b77a
mov eax, dword [0x10230a8]
test al, 0xa3
jne case.default.0x101b77a
test eax, 0x400
jmp 0x101baeb
mov eax, dword [0x10230a8]
and eax, 0x400
jmp 0x101bb67
mov eax, dword [0x10230a8]
and eax, 0x20
jmp 0x101bb67
mov al, byte [0x10230aa]
cmp al, 3
je 0x101baed
cmp al, 2
jne case.default.0x101b77a
mov eax, ebx
jmp 0x101bb67
xor eax, eax
cmp byte [0x10230aa], 2
jmp 0x101b937
call fcn.0101b5a8
jmp 0x101bb67
call fcn.0101b663
jmp 0x101bb67
push 0x57
jmp 0x101b786
push 0x58
jmp 0x101b786
call fcn.0101b6a0
jmp 0x101bb67
call fcn.0101b607
jmp 0x101bb67
cmp dword [0x1023020], 2
jne case.default.0x101b77a
cmp dword [0x1023014], 6
jmp 0x101b7a5
push 0x1e
call fcn.0101b72b
jmp 0x101bb67
cmp dword [0x1023020], 2
jne case.default.0x101b77a
mov eax, dword [0x1023014]
cmp eax, 6
ja 0x101baed
jne case.default.0x101b77a
cmp dword [0x1023018], 0
ja 0x101baed
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4