Function at 0x1011915
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push edi
mov dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0x94
call esi
jmp 0x101192d
cmp esi, 0x15
jne 0x101194a
cmp byte [0x104743a], 3
jne case.0x1011953.37
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
test al, 2
je case.0x1011953.37
test ah, 4
je case.0x1011953.37
test al, al
jns 0x101196f
jmp case.0x1011953.37
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1011971
test byte [0x1047438], 0x10
je case.0x1011953.37
jmp 0x1011967
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
test al, 0x10
je case.0x1011953.37
test ah, 1
jmp 0x1011794
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
test al, 0x10
je case.0x1011953.37
test ah, 1
je case.0x1011953.37
jmp 0x101196f
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
test ah, 1
je case.0x1011953.37
test al, 0x10
jmp 0x1011794
test word [0x1047438], 0x110
je case.0x1011953.37
push 0x10118f8
push 0x10118bc
push 0x1011884
push 0x80000002
jmp 0x1011542
cmp byte [0x104743a], bl
jne case.0x1011953.37
call fcn.0103cca2
test eax, eax
jne case.0x1011953.37
push 0x101187c
mov edi, 0x1011884
push edi
mov esi, 0x80000002
push esi
call fcn.0103cb55
test eax, eax
jne case.0x1011953.37
push 0x1011870
push 0x10118bc
push edi
push esi
call fcn.0103caa2
test eax, eax
jmp 0x10114ba
call fcn.0103cca2
jmp 0x1011971
cmp byte [0x104743a], bl
jne case.0x1011953.37
cmp eax, edx
jmp 0x1011794
mov cl, byte [0x104743a]
cmp cl, 3
je 0x101157f
cmp cl, 2
jne case.0x1011953.37
cmp eax, edx
jmp 0x1011734
mov cl, byte [0x104743a]
cmp cl, 3
je 0x101159a
cmp cl, 2
jne case.0x1011953.37
cmp eax, edx
jmp 0x1011717
mov cl, byte [0x104743a]
cmp cl, 3
je 0x10115b5
cmp cl, 2
jne case.0x1011953.37
test byte [0x1047438], 0x82
jmp 0x101155e
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
and eax, 0x40
jmp 0x1011971
xor eax, eax
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
sete al
jmp 0x1011971
xor eax, eax
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 2
jmp 0x10115d3
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
jmp 0x1011699
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
jne case.0x1011953.37
cmp eax, 4
jne case.0x1011953.37
test ecx, ecx
jne case.0x1011953.37
cmp word [0x10473ac], 0x3b6
jmp 0x1011794
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
jne case.0x1011953.37
cmp eax, 4
ja 0x101196f
jne case.0x1011953.37
cmp ecx, 0xa
jmp 0x1011969
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
jne case.0x1011953.37
cmp eax, 4
jne case.0x1011953.37
cmp ecx, 0xa
jne case.0x1011953.37
cmp word [0x10473ac], 0x7ce
jmp 0x1011794
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
jne case.0x1011953.37
cmp eax, 4
jne 0x1011687
cmp ecx, 0x5a
jae 0x101196f
cmp eax, eax
jbe case.0x1011953.37
jmp 0x101196f
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 2
jne case.0x1011953.37
cmp eax, 4
jmp 0x1011969
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 2
jne case.0x1011953.37
cmp eax, edx
ja 0x101196f
jne case.0x1011953.37
test ecx, ecx
ja 0x101196f
jne case.0x1011953.37
cmp word [0x10473ac], 0x893
jmp 0x1011687
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 2
jne case.0x1011953.37
test byte [0x1047439], 2
jmp 0x10114ba
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 2
jne case.0x1011953.37
cmp byte [0x104743a], bl
jmp 0x1011794
mov al, byte [0x104743a]
cmp al, 3
je 0x101171d
cmp al, 2
jne case.0x1011953.37
test byte [0x1047438], 0x80
jmp 0x10114ba
mov al, byte [0x104743a]
cmp al, 3
je 0x101173a
cmp al, 2
jne case.0x1011953.37
mov al, byte [0x1047438]
test al, 2
jmp 0x1011460
mov al, byte [0x104743a]
cmp al, 3
je 0x1011757
cmp al, 2
jne case.0x1011953.37
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
test al, 0xa2
jne case.0x1011953.37
test ah, 4
jmp 0x1011794
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
and eax, 0x400
jmp 0x1011971
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
and eax, 0x20
jmp 0x1011971
mov al, byte [0x104743a]
cmp al, 3
je 0x101196f
cmp al, 2
jne case.0x1011953.37
jmp 0x101196f
call fcn.0103cd00
jmp 0x1011971
push 0x56
jmp 0x1011478
push 0x57
jmp 0x1011478
call fcn.0103cdeb
jmp 0x1011971
push 0x58
jmp 0x1011478
call fcn.0103cd8f
jmp 0x1011971
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0
push edi
je 0x101dc91
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov esi, dword [ebp + 8]
mov ecx, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
push 5
pop edx
cmp eax, edx
jne 0x101194a
test ecx, ecx
je 0x101143a
cmp esi, 0x26
ja case.0x1011953.37
jmp dword [esi*4 + 0x10117d2]
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 2
jne case.0x1011953.37
cmp eax, edx
jb case.0x1011953.37
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x10473a0
push edi
mov dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
mov dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0x9c
call esi
test eax, eax
je 0x1011428
jmp 0x101192d
xor eax, eax
jmp 0x1011971