Function at 0x1011486
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x101569c], 0
push edi
jne 0x10114c4
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1015600
push edi
mov dword [0x101569c], ebx
mov dword [0x1015600], 0x9c
call esi
test eax, eax
jne 0x10114c4
push edi
mov dword [0x1015600], 0x94
call esi
mov eax, dword [esp + 0x10]
cmp eax, 0x23
ja case.0x10114d1.31
jmp dword [eax*4 + 0x1011826]
push 0x1000
jmp 0x101181b
test byte [0x1015698], 0x10
je case.0x10114d1.31
cmp dword [0x1015604], 5
jb case.0x10114d1.31
mov eax, ebx
jmp 0x10115b0
mov eax, dword [0x1015698]
test al, 0x10
je case.0x10114d1.31
test ah, 1
jmp 0x1011800
mov eax, dword [0x1015698]
test al, 0x10
je case.0x10114d1.31
test ah, 1
jmp 0x10117a1
mov eax, dword [0x1015698]
test ah, 1
je case.0x10114d1.31
test al, 0x10
jmp 0x1011800
test word [0x1015698], 0x110
je case.0x10114d1.31
push 0x10024c4
push 0x1002488
push 0x1002450
push 0x80000002
call fcn.0101124c
test eax, eax
jmp 0x10117a1
call fcn.010113d7
test eax, eax
jne case.0x10114d1.31
push 0x1002448
mov edi, 0x1002450
push edi
mov esi, 0x80000002
push esi
call fcn.010112f8
test eax, eax
jne case.0x10114d1.31
push 0x100243c
push 0x1002488
push edi
push esi
jmp 0x101155d
call fcn.010113d7
jmp 0x10115b0
cmp dword [0x1015610], 2
je 0x10114ef
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
cmp byte [0x101569a], bl
jne case.0x10114d1.31
cmp dword [0x1015604], 5
jmp 0x1011800
mov al, byte [0x101569a]
cmp al, 3
je 0x10115d7
cmp al, 2
jne case.0x10114d1.31
cmp dword [0x1015604], 5
jmp 0x10117b7
mov al, byte [0x101569a]
cmp al, 3
je 0x10115f0
cmp al, 2
jne case.0x10114d1.31
cmp dword [0x1015604], 5
jmp 0x1011794
mov al, byte [0x101569a]
cmp al, 3
je 0x1011609
cmp al, 2
jne case.0x10114d1.31
test byte [0x1015698], 0x82
jmp 0x10115bc
mov eax, dword [0x1015698]
and eax, 0x40
jmp 0x10115b0
xor eax, eax
cmp dword [0x1015610], ebx
jmp 0x101162f
xor eax, eax
cmp dword [0x1015610], 2
sete al
jmp 0x10115b0
cmp dword [0x1015610], ebx
jmp 0x1011704
cmp dword [0x1015610], ebx
jne case.0x10114d1.31
cmp dword [0x1015604], 4
jne case.0x10114d1.31
cmp dword [0x1015608], 0
jne case.0x10114d1.31
cmp word [0x101560c], 0x3b6
jmp 0x1011800
cmp dword [0x1015610], ebx
jne case.0x10114d1.31
mov eax, dword [0x1015604]
cmp eax, 4
ja 0x10114fc
jne case.0x10114d1.31
cmp dword [0x1015608], 0xa
jmp 0x10114f6
cmp dword [0x1015610], ebx
jne case.0x10114d1.31
cmp dword [0x1015604], 4
jne case.0x10114d1.31
cmp dword [0x1015608], 0xa
jne case.0x10114d1.31
cmp word [0x101560c], 0x7ce
jmp 0x1011800
cmp dword [0x1015610], ebx
jne case.0x10114d1.31
mov eax, dword [0x1015604]
cmp eax, 4
jne 0x1011753
cmp dword [0x1015608], 0x5a
jae 0x10114fc
cmp eax, eax
jmp 0x1011753
cmp dword [0x1015610], 2
jne case.0x10114d1.31
cmp dword [0x1015604], 4
jmp 0x10114f6
cmp dword [0x1015610], 2
jne case.0x10114d1.31
mov eax, dword [0x1015604]
cmp eax, 5
ja 0x10114fc
jne case.0x10114d1.31
mov eax, dword [0x1015608]
test eax, eax
ja 0x10114fc
jne case.0x10114d1.31
cmp word [0x101560c], 0x893
jbe case.0x10114d1.31
jmp 0x10114fc
cmp dword [0x1015610], 2
jne case.0x10114d1.31
test byte [0x1015699], 2
jmp 0x10117a1
cmp dword [0x1015610], 2
jne case.0x10114d1.31
cmp byte [0x101569a], bl
jmp 0x1011800
mov al, byte [0x101569a]
cmp al, 3
je 0x101179a
cmp al, 2
jne case.0x10114d1.31
test byte [0x1015698], 0x80
je case.0x10114d1.31
jmp 0x10114fc
mov al, byte [0x101569a]
cmp al, 3
je 0x10117bd
cmp al, 2
jne case.0x10114d1.31
mov al, byte [0x1015698]
test al, 2
je case.0x10114d1.31
test al, al
js case.0x10114d1.31
jmp 0x10114fc
mov al, byte [0x101569a]
cmp al, 3
je 0x10117e8
cmp al, 2
jne case.0x10114d1.31
test byte [0x1015698], 0x82
jmp 0x1011800
mov al, byte [0x101569a]
cmp al, 3
je 0x10114fc
cmp al, 2
jne case.0x10114d1.31
jmp 0x10114fc
call fcn.0101142e
jmp 0x10115b0
push 0x56
jmp 0x101181b
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x10115b0