Function at 0x101adf5
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x1020e54], 0
push edi
jne 0x101ae38
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1020db8
push edi
mov dword [0x1020e54], ebx
mov dword [0x1020db8], 0x9c
call esi
test eax, eax
jne 0x101ae38
push edi
mov dword [0x1020db8], 0x94
call esi
mov eax, dword [ebp + 8]
cmp eax, 0x2b
ja case.0x101ae44.37
jmp dword [eax*4 + 0x101b222]
push 0x1000
jmp 0x101b1cd
test byte [0x1020e50], 0x10
je case.0x101ae44.37
cmp dword [0x1020dbc], 5
jb case.0x101ae44.37
mov eax, ebx
jmp 0x101af2b
mov eax, dword [0x1020e50]
test al, 0x10
je case.0x101ae44.37
test ah, 1
jmp 0x101b1a4
mov eax, dword [0x1020e50]
test al, 0x10
je case.0x101ae44.37
test ah, 1
jmp 0x101b120
mov eax, dword [0x1020e50]
test ah, 1
je case.0x101ae44.37
test al, 0x10
jmp 0x101b1a4
test word [0x1020e50], 0x110
je case.0x101ae44.37
push 0x1003810
push 0x10037d4
push 0x100379c
push 0x80000002
call fcn.0101aa79
test eax, eax
jmp 0x101b120
cmp byte [0x1020e52], bl
jne case.0x101ae44.37
call fcn.0101ac51
test eax, eax
jne case.0x101ae44.37
push 0x1003794
mov edi, 0x100379c
push edi
mov esi, 0x80000002
push esi
call fcn.0101ab2c
test eax, eax
jne case.0x101ae44.37
push 0x1003788
push 0x10037d4
push edi
push esi
jmp 0x101aed0
call fcn.0101ac51
jmp 0x101af2b
cmp dword [0x1020dc8], 2
je 0x101ae62
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp byte [0x1020e52], bl
jne case.0x101ae44.37
cmp dword [0x1020dbc], 5
jmp 0x101b1a4
mov al, byte [0x1020e52]
cmp al, 3
je 0x101af53
cmp al, 2
jne case.0x101ae44.37
cmp dword [0x1020dbc], 5
jmp 0x101b136
mov al, byte [0x1020e52]
cmp al, 3
je 0x101af6c
cmp al, 2
jne case.0x101ae44.37
cmp dword [0x1020dbc], 5
jmp 0x101b113
mov al, byte [0x1020e52]
cmp al, 3
je 0x101af85
cmp al, 2
jne case.0x101ae44.37
test byte [0x1020e50], 0x82
jmp 0x101af38
mov eax, dword [0x1020e50]
and eax, 0x40
jmp 0x101af2b
xor eax, eax
cmp dword [0x1020dc8], ebx
jmp 0x101afab
xor eax, eax
cmp dword [0x1020dc8], 2
sete al
jmp 0x101af2b
cmp dword [0x1020dc8], ebx
jmp 0x101b080
cmp dword [0x1020dc8], ebx
jne case.0x101ae44.37
cmp dword [0x1020dbc], 4
jne case.0x101ae44.37
cmp dword [0x1020dc0], 0
jne case.0x101ae44.37
cmp word [0x1020dc4], 0x3b6
jmp 0x101b1a4
cmp dword [0x1020dc8], ebx
jne case.0x101ae44.37
mov eax, dword [0x1020dbc]
cmp eax, 4
ja 0x101ae6f
jne case.0x101ae44.37
cmp dword [0x1020dc0], 0xa
jmp 0x101ae69
cmp dword [0x1020dc8], ebx
jne case.0x101ae44.37
cmp dword [0x1020dbc], 4
jne case.0x101ae44.37
cmp dword [0x1020dc0], 0xa
jne case.0x101ae44.37
cmp word [0x1020dc4], 0x7ce
jmp 0x101b1a4
cmp dword [0x1020dc8], ebx
jne case.0x101ae44.37
mov eax, dword [0x1020dbc]
cmp eax, 4
jne 0x101b0cf
cmp dword [0x1020dc0], 0x5a
jae 0x101ae6f
cmp eax, eax
jmp 0x101b0cf
cmp dword [0x1020dc8], 2
jne case.0x101ae44.37
cmp dword [0x1020dbc], 4
jmp 0x101ae69
cmp dword [0x1020dc8], 2
jne case.0x101ae44.37
mov eax, dword [0x1020dbc]
cmp eax, 5
ja 0x101ae6f
jne case.0x101ae44.37
mov eax, dword [0x1020dc0]
test eax, eax
ja 0x101ae6f
jne case.0x101ae44.37
cmp word [0x1020dc4], 0x893
jbe case.0x101ae44.37
jmp 0x101ae6f
cmp dword [0x1020dc8], 2
jne case.0x101ae44.37
test byte [0x1020e51], 2
jmp 0x101b120
cmp dword [0x1020dc8], 2
jne case.0x101ae44.37
cmp byte [0x1020e52], bl
jmp 0x101b1a4
mov al, byte [0x1020e52]
cmp al, 3
je 0x101b119
cmp al, 2
jne case.0x101ae44.37
test byte [0x1020e50], 0x80
je case.0x101ae44.37
jmp 0x101ae6f
mov al, byte [0x1020e52]
cmp al, 3
je 0x101b13c
cmp al, 2
jne case.0x101ae44.37
mov al, byte [0x1020e50]
test al, 2
je case.0x101ae44.37
test al, al
js case.0x101ae44.37
jmp 0x101ae6f
mov al, byte [0x1020e52]
cmp al, 3
je 0x101b167
cmp al, 2
jne case.0x101ae44.37
mov eax, dword [0x1020e50]
test al, 0xa2
jne case.0x101ae44.37
test ah, 4
jmp 0x101b1a4
mov eax, dword [0x1020e50]
and eax, 0x400
jmp 0x101af2b
mov eax, dword [0x1020e50]
and eax, 0x20
jmp 0x101af2b
mov al, byte [0x1020e52]
cmp al, 3
je 0x101ae6f
cmp al, 2
jne case.0x101ae44.37
jmp 0x101ae6f
call fcn.0101acaf
jmp 0x101af2b
push 0x56
jmp 0x101b1cd
push 0x57
jmp 0x101b1cd
call fcn.0101ad6a
jmp 0x101af2b
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x101af2b
call fcn.0101ad0e
jmp 0x101af2b
mov eax, dword [0x1020e50]
and eax, 0x2000
jmp 0x101af2b
mov eax, dword [0x1020e50]
and eax, 0x4000
jmp 0x101af2b
mov eax, dword [0x1020e50]
and eax, 0x8000
jmp 0x101af2b
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
jmp 0x101af2b