Function at 0x100bcac
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x102c034], 0
push edi
jne 0x100bcea
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x102bf98
push edi
mov dword [0x102c034], ebx
mov dword [0x102bf98], 0x9c
call esi
test eax, eax
jne 0x100bcea
push edi
mov dword [0x102bf98], 0x94
call esi
mov eax, dword [esp + 0x10]
cmp eax, 0x1e
ja case.default.0x100bcf7
jmp dword [eax*4 + 0x100c041]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x100bddc
test byte [0x102c030], 0x10
je case.default.0x100bcf7
cmp dword [0x102bf9c], 5
jb case.default.0x100bcf7
mov eax, ebx
jmp 0x100bddc
mov eax, dword [0x102c030]
test al, 0x10
je case.default.0x100bcf7
test ah, 1
jmp 0x100c02c
mov eax, dword [0x102c030]
test al, 0x10
je case.default.0x100bcf7
test ah, 1
jmp 0x100bfcd
mov eax, dword [0x102c030]
test ah, 1
je case.default.0x100bcf7
test al, 0x10
jmp 0x100c02c
test word [0x102c030], 0x110
je case.default.0x100bcf7
push 0x1002d8c
push 0x1002d50
push 0x1002d18
push 0x80000002
call fcn.0100ba72
test eax, eax
jmp 0x100bfcd
call fcn.0100bbfd
test eax, eax
jne case.default.0x100bcf7
push 0x1002d10
mov edi, 0x1002d18
push edi
mov esi, 0x80000002
push esi
call fcn.0100bb1e
test eax, eax
jne case.default.0x100bcf7
push 0x1002d04
push 0x1002d50
push edi
push esi
jmp 0x100bd89
call fcn.0100bbfd
jmp 0x100bddc
cmp dword [0x102bfa8], 2
je 0x100bd1b
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
cmp byte [0x102c032], bl
jne case.default.0x100bcf7
cmp dword [0x102bf9c], 5
jmp 0x100c02c
mov al, byte [0x102c032]
cmp al, 3
je 0x100be03
cmp al, 2
jne case.default.0x100bcf7
cmp dword [0x102bf9c], 5
jmp 0x100bfe3
mov al, byte [0x102c032]
cmp al, 3
je 0x100be1c
cmp al, 2
jne case.default.0x100bcf7
cmp dword [0x102bf9c], 5
jmp 0x100bfc0
mov al, byte [0x102c032]
cmp al, 3
je 0x100be35
cmp al, 2
jne case.default.0x100bcf7
test byte [0x102c030], 0x82
jmp 0x100bde8
mov eax, dword [0x102c030]
and eax, 0x40
jmp 0x100bddc
xor eax, eax
cmp dword [0x102bfa8], ebx
jmp 0x100be5b
xor eax, eax
cmp dword [0x102bfa8], 2
sete al
jmp 0x100bddc
cmp dword [0x102bfa8], ebx
jmp 0x100bf30
cmp dword [0x102bfa8], ebx
jne case.default.0x100bcf7
cmp dword [0x102bf9c], 4
jne case.default.0x100bcf7
cmp dword [0x102bfa0], 0
jne case.default.0x100bcf7
cmp word [0x102bfa4], 0x3b6
jmp 0x100c02c
cmp dword [0x102bfa8], ebx
jne case.default.0x100bcf7
mov eax, dword [0x102bf9c]
cmp eax, 4
ja 0x100bd28
jne case.default.0x100bcf7
cmp dword [0x102bfa0], 0xa
jmp 0x100bd22
cmp dword [0x102bfa8], ebx
jne case.default.0x100bcf7
cmp dword [0x102bf9c], 4
jne case.default.0x100bcf7
cmp dword [0x102bfa0], 0xa
jne case.default.0x100bcf7
cmp word [0x102bfa4], 0x7ce
jmp 0x100c02c
cmp dword [0x102bfa8], ebx
jne case.default.0x100bcf7
mov eax, dword [0x102bf9c]
cmp eax, 4
jne 0x100bf7f
cmp dword [0x102bfa0], 0x5a
jae 0x100bd28
cmp eax, eax
jmp 0x100bf7f
cmp dword [0x102bfa8], 2
jne case.default.0x100bcf7
cmp dword [0x102bf9c], 4
jmp 0x100bd22
cmp dword [0x102bfa8], 2
jne case.default.0x100bcf7
mov eax, dword [0x102bf9c]
cmp eax, 5
ja 0x100bd28
jne case.default.0x100bcf7
mov eax, dword [0x102bfa0]
test eax, eax
ja 0x100bd28
jne case.default.0x100bcf7
cmp word [0x102bfa4], 0x893
jbe case.default.0x100bcf7
jmp 0x100bd28
cmp dword [0x102bfa8], 2
jne case.default.0x100bcf7
test byte [0x102c031], 2
jmp 0x100bfcd
cmp dword [0x102bfa8], 2
jne case.default.0x100bcf7
cmp byte [0x102c032], bl
jmp 0x100c02c
mov al, byte [0x102c032]
cmp al, 3
je 0x100bfc6
cmp al, 2
jne case.default.0x100bcf7
test byte [0x102c030], 0x80
je case.default.0x100bcf7
jmp 0x100bd28
mov al, byte [0x102c032]
cmp al, 3
je 0x100bfe9
cmp al, 2
jne case.default.0x100bcf7
mov al, byte [0x102c030]
test al, 2
je case.default.0x100bcf7
test al, al
js case.default.0x100bcf7
jmp 0x100bd28
mov al, byte [0x102c032]
cmp al, 3
je 0x100c014
cmp al, 2
jne case.default.0x100bcf7
test byte [0x102c030], 0x82
jmp 0x100c02c
mov al, byte [0x102c032]
cmp al, 3
je 0x100bd28
cmp al, 2
jne case.default.0x100bcf7
jmp 0x100bd28
call fcn.0100bc54
jmp 0x100bddc