Function at 0x1014fa9
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push edi
mov dword [0x1046c28], 0x94
call esi
jmp 0x1014fc1
push 0x1000
jmp 0x1014e12
test byte [0x1046cc0], 0x10
jne 0x1014fe1
jmp case.0x1014fcd.37
mov eax, dword [0x1046cc0]
test al, 0x10
je case.0x1014fcd.37
test ah, 1
jmp 0x1014de9
mov eax, dword [0x1046cc0]
test al, 0x10
je case.0x1014fcd.37
test ah, 1
jmp 0x1014d65
mov eax, dword [0x1046cc0]
test ah, 1
je case.0x1014fcd.37
test al, 0x10
jmp 0x1014de9
test word [0x1046cc0], 0x110
je case.0x1014fcd.37
push 0x1014f8c
push 0x1014f50
push 0x1014f18
push 0x80000002
call fcn.0103a3ce
test eax, eax
jmp 0x1014d65
cmp byte [0x1046cc2], bl
jne case.0x1014fcd.37
call fcn.0103a5ce
test eax, eax
jne case.0x1014fcd.37
push 0x1014f10
mov edi, 0x1014f18
push edi
mov esi, 0x80000002
push esi
call fcn.0103a481
test eax, eax
jne case.0x1014fcd.37
push 0x1014f04
push 0x1014f50
push edi
push esi
jmp 0x1014b09
call fcn.0103a5ce
jmp 0x1014ff0
cmp byte [0x1046cc2], bl
jne case.0x1014fcd.37
cmp dword [0x1046c2c], 5
jmp 0x1014de9
mov al, byte [0x1046cc2]
cmp al, 3
je 0x1014b8d
cmp al, 2
jne case.0x1014fcd.37
cmp dword [0x1046c2c], 5
jmp 0x1014d7b
mov al, byte [0x1046cc2]
cmp al, 3
je 0x1014baa
cmp al, 2
jne case.0x1014fcd.37
cmp dword [0x1046c2c], 5
jmp 0x1014d58
mov al, byte [0x1046cc2]
cmp al, 3
je 0x1014bc7
cmp al, 2
jne case.0x1014fcd.37
test byte [0x1046cc0], 0x82
jmp 0x1014b6a
mov eax, dword [0x1046cc0]
and eax, 0x40
jmp 0x1014ff0
xor eax, eax
cmp dword [0x1046c38], ebx
jmp 0x1014bf0
xor eax, eax
cmp dword [0x1046c38], 2
sete al
jmp 0x1014ff0
cmp dword [0x1046c38], ebx
jmp 0x1014cc5
cmp dword [0x1046c38], ebx
jne case.0x1014fcd.37
cmp dword [0x1046c2c], 4
jne case.0x1014fcd.37
cmp dword [0x1046c30], 0
jne case.0x1014fcd.37
cmp word [0x1046c34], 0x3b6
jmp 0x1014de9
cmp dword [0x1046c38], ebx
jne case.0x1014fcd.37
mov eax, dword [0x1046c2c]
cmp eax, 4
ja 0x1014fee
jne case.0x1014fcd.37
cmp dword [0x1046c30], 0xa
jmp 0x1014fe8
cmp dword [0x1046c38], ebx
jne case.0x1014fcd.37
cmp dword [0x1046c2c], 4
jne case.0x1014fcd.37
cmp dword [0x1046c30], 0xa
jne case.0x1014fcd.37
cmp word [0x1046c34], 0x7ce
jmp 0x1014de9
cmp dword [0x1046c38], ebx
jne case.0x1014fcd.37
mov eax, dword [0x1046c2c]
cmp eax, 4
jne 0x1014d14
cmp dword [0x1046c30], 0x5a
jae 0x1014fee
cmp eax, eax
jmp 0x1014d14
cmp dword [0x1046c38], 2
jne case.0x1014fcd.37
cmp dword [0x1046c2c], 4
jmp 0x1014fe8
cmp dword [0x1046c38], 2
jne case.0x1014fcd.37
mov eax, dword [0x1046c2c]
cmp eax, 5
ja 0x1014fee
jne case.0x1014fcd.37
mov eax, dword [0x1046c30]
test eax, eax
ja 0x1014fee
jne case.0x1014fcd.37
cmp word [0x1046c34], 0x893
ja 0x1014fee
jmp case.0x1014fcd.37
cmp dword [0x1046c38], 2
jne case.0x1014fcd.37
test byte [0x1046cc1], 2
jmp 0x1014d65
cmp dword [0x1046c38], 2
jne case.0x1014fcd.37
cmp byte [0x1046cc2], bl
jmp 0x1014de9
mov al, byte [0x1046cc2]
cmp al, 3
je 0x1014d5e
cmp al, 2
jne case.0x1014fcd.37
test byte [0x1046cc0], 0x80
jne 0x1014fee
jmp case.0x1014fcd.37
mov al, byte [0x1046cc2]
cmp al, 3
je 0x1014d81
cmp al, 2
jne case.0x1014fcd.37
mov al, byte [0x1046cc0]
test al, 2
je case.0x1014fcd.37
test al, al
jns 0x1014fee
jmp case.0x1014fcd.37
mov al, byte [0x1046cc2]
cmp al, 3
je 0x1014dac
cmp al, 2
jne case.0x1014fcd.37
mov eax, dword [0x1046cc0]
test al, 0xa2
jne case.0x1014fcd.37
test ah, 4
jmp 0x1014de9
mov eax, dword [0x1046cc0]
and eax, 0x400
jmp 0x1014ff0
mov eax, dword [0x1046cc0]
and eax, 0x20
jmp 0x1014ff0
mov al, byte [0x1046cc2]
cmp al, 3
je 0x1014fee
cmp al, 2
je 0x1014fee
jmp case.0x1014fcd.37
call fcn.0103a62c
jmp 0x1014ff0
push 0x56
jmp 0x1014e12
push 0x57
jmp 0x1014e12
call fcn.0103a717
jmp 0x1014ff0
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1014ff0
call fcn.0103a6bb
jmp 0x1014ff0
mov eax, dword [0x1046cc0]
and eax, 0x2000
jmp 0x1014ff0
mov eax, dword [0x1046cc0]
and eax, 0x4000
jmp 0x1014ff0
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
jmp 0x1014ff0
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x1046cc4], 0
push edi
je 0x1018426
mov eax, dword [ebp + 8]
cmp eax, 0x2a
ja case.0x1014fcd.37
jmp dword [eax*4 + 0x1014e58]
cmp dword [0x1046c38], 2
jne case.0x1014fcd.37
cmp dword [0x1046c2c], 5
jb case.0x1014fcd.37
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1046c28
push edi
mov dword [0x1046cc4], ebx
mov dword [0x1046c28], 0x9c
call esi
test eax, eax
jne 0x1014fc1
jmp 0x1014a79
xor eax, eax
jmp 0x1014ff0