Function at 0x100bcdc
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x102c034], 0
push edi
jne 0x100bd1a
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x102bf98
push edi
mov dword [0x102c034], ebx
mov dword [0x102bf98], 0x9c
call esi
test eax, eax
jne 0x100bd1a
push edi
mov dword [0x102bf98], 0x94
call esi
mov eax, dword [esp + 0x10]
cmp eax, 0x23
ja case.0x100bd27.31
jmp dword [eax*4 + 0x100c07c]
push 0x1000
jmp 0x100c071
test byte [0x102c030], 0x10
je case.0x100bd27.31
cmp dword [0x102bf9c], 5
jb case.0x100bd27.31
mov eax, ebx
jmp 0x100be06
mov eax, dword [0x102c030]
test al, 0x10
je case.0x100bd27.31
test ah, 1
jmp 0x100c056
mov eax, dword [0x102c030]
test al, 0x10
je case.0x100bd27.31
test ah, 1
jmp 0x100bff7
mov eax, dword [0x102c030]
test ah, 1
je case.0x100bd27.31
test al, 0x10
jmp 0x100c056
test word [0x102c030], 0x110
je case.0x100bd27.31
push 0x1002d8c
push 0x1002d50
push 0x1002d18
push 0x80000002
call fcn.0100baa2
test eax, eax
jmp 0x100bff7
call fcn.0100bc2d
test eax, eax
jne case.0x100bd27.31
push 0x1002d10
mov edi, 0x1002d18
push edi
mov esi, 0x80000002
push esi
call fcn.0100bb4e
test eax, eax
jne case.0x100bd27.31
push 0x1002d04
push 0x1002d50
push edi
push esi
jmp 0x100bdb3
call fcn.0100bc2d
jmp 0x100be06
cmp dword [0x102bfa8], 2
je 0x100bd45
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
cmp byte [0x102c032], bl
jne case.0x100bd27.31
cmp dword [0x102bf9c], 5
jmp 0x100c056
mov al, byte [0x102c032]
cmp al, 3
je 0x100be2d
cmp al, 2
jne case.0x100bd27.31
cmp dword [0x102bf9c], 5
jmp 0x100c00d
mov al, byte [0x102c032]
cmp al, 3
je 0x100be46
cmp al, 2
jne case.0x100bd27.31
cmp dword [0x102bf9c], 5
jmp 0x100bfea
mov al, byte [0x102c032]
cmp al, 3
je 0x100be5f
cmp al, 2
jne case.0x100bd27.31
test byte [0x102c030], 0x82
jmp 0x100be12
mov eax, dword [0x102c030]
and eax, 0x40
jmp 0x100be06
xor eax, eax
cmp dword [0x102bfa8], ebx
jmp 0x100be85
xor eax, eax
cmp dword [0x102bfa8], 2
sete al
jmp 0x100be06
cmp dword [0x102bfa8], ebx
jmp 0x100bf5a
cmp dword [0x102bfa8], ebx
jne case.0x100bd27.31
cmp dword [0x102bf9c], 4
jne case.0x100bd27.31
cmp dword [0x102bfa0], 0
jne case.0x100bd27.31
cmp word [0x102bfa4], 0x3b6
jmp 0x100c056
cmp dword [0x102bfa8], ebx
jne case.0x100bd27.31
mov eax, dword [0x102bf9c]
cmp eax, 4
ja 0x100bd52
jne case.0x100bd27.31
cmp dword [0x102bfa0], 0xa
jmp 0x100bd4c
cmp dword [0x102bfa8], ebx
jne case.0x100bd27.31
cmp dword [0x102bf9c], 4
jne case.0x100bd27.31
cmp dword [0x102bfa0], 0xa
jne case.0x100bd27.31
cmp word [0x102bfa4], 0x7ce
jmp 0x100c056
cmp dword [0x102bfa8], ebx
jne case.0x100bd27.31
mov eax, dword [0x102bf9c]
cmp eax, 4
jne 0x100bfa9
cmp dword [0x102bfa0], 0x5a
jae 0x100bd52
cmp eax, eax
jmp 0x100bfa9
cmp dword [0x102bfa8], 2
jne case.0x100bd27.31
cmp dword [0x102bf9c], 4
jmp 0x100bd4c
cmp dword [0x102bfa8], 2
jne case.0x100bd27.31
mov eax, dword [0x102bf9c]
cmp eax, 5
ja 0x100bd52
jne case.0x100bd27.31
mov eax, dword [0x102bfa0]
test eax, eax
ja 0x100bd52
jne case.0x100bd27.31
cmp word [0x102bfa4], 0x893
jbe case.0x100bd27.31
jmp 0x100bd52
cmp dword [0x102bfa8], 2
jne case.0x100bd27.31
test byte [0x102c031], 2
jmp 0x100bff7
cmp dword [0x102bfa8], 2
jne case.0x100bd27.31
cmp byte [0x102c032], bl
jmp 0x100c056
mov al, byte [0x102c032]
cmp al, 3
je 0x100bff0
cmp al, 2
jne case.0x100bd27.31
test byte [0x102c030], 0x80
je case.0x100bd27.31
jmp 0x100bd52
mov al, byte [0x102c032]
cmp al, 3
je 0x100c013
cmp al, 2
jne case.0x100bd27.31
mov al, byte [0x102c030]
test al, 2
je case.0x100bd27.31
test al, al
js case.0x100bd27.31
jmp 0x100bd52
mov al, byte [0x102c032]
cmp al, 3
je 0x100c03e
cmp al, 2
jne case.0x100bd27.31
test byte [0x102c030], 0x82
jmp 0x100c056
mov al, byte [0x102c032]
cmp al, 3
je 0x100bd52
cmp al, 2
jne case.0x100bd27.31
jmp 0x100bd52
call fcn.0100bc84
jmp 0x100be06
push 0x56
jmp 0x100c071
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x100be06