Function at 0x100928b
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x100c874], 0
push edi
jne 0x10092ce
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x100c7d8
push edi
mov dword [0x100c874], ebx
mov dword [0x100c7d8], 0x9c
call esi
test eax, eax
jne 0x10092ce
push edi
mov dword [0x100c7d8], 0x94
call esi
mov eax, dword [ebp + 8]
cmp eax, 0x29
ja case.default.0x10092da
jmp dword [eax*4 + 0x10096cf]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x10096c7
test byte [0x100c870], 0x10
je case.default.0x10092da
cmp dword [0x100c7dc], 5
jb case.default.0x10092da
jmp 0x100964d
mov eax, dword [0x100c870]
test al, 0x10
je case.default.0x10092da
test eax, 0x100
jmp 0x100964b
mov eax, dword [0x100c870]
test al, 0x10
je case.default.0x10092da
test eax, 0x100
je case.default.0x10092da
jmp 0x100964d
mov eax, dword [0x100c870]
test eax, 0x100
je case.default.0x10092da
test al, 0x10
jmp 0x100964b
test dword [0x100c870], 0x110
je case.default.0x10092da
push 0x1002734
push 0x10026f8
push 0x10026c0
push 0x80000002
call fcn.01008ece
test eax, eax
jmp 0x1009339
push 0x25
call fcn.0100928b
test eax, eax
jne case.default.0x10092da
cmp byte [0x100c872], bl
jne case.default.0x10092da
push 0x10026b8
mov edi, 0x10026c0
push edi
mov esi, 0x80000002
push esi
call fcn.01008f81
test eax, eax
jne case.default.0x10092da
push 0x10026ac
push 0x10026f8
push edi
push esi
jmp 0x100937f
call fcn.010090aa
jmp 0x10096c7
cmp dword [0x100c7e8], 2
jne case.default.0x10092da
jmp 0x10092fe
cmp byte [0x100c872], bl
jne case.default.0x10092da
cmp dword [0x100c7dc], 5
jmp 0x100964b
mov al, byte [0x100c872]
cmp al, 3
je 0x1009414
cmp al, 2
jne case.default.0x10092da
cmp dword [0x100c7dc], 5
jne case.default.0x10092da
mov al, byte [0x100c870]
test al, 2
je case.default.0x10092da
test al, al
js case.default.0x10092da
jmp 0x100964d
mov al, byte [0x100c872]
cmp al, 3
je 0x100944c
cmp al, 2
jne case.default.0x10092da
cmp dword [0x100c7dc], 5
jne case.default.0x10092da
test byte [0x100c870], 0x80
jmp 0x1009339
mov al, byte [0x100c872]
cmp al, 3
je 0x1009476
cmp al, 2
jne case.default.0x10092da
test byte [0x100c870], 0x82
jmp 0x10093f1
mov eax, dword [0x100c870]
and eax, 0x40
jmp 0x10096c7
xor eax, eax
cmp dword [0x100c7e8], ebx
sete al
jmp 0x10096c7
xor eax, eax
cmp dword [0x100c7e8], 2
jmp 0x1009497
cmp dword [0x100c7e8], ebx
jne case.default.0x10092da
cmp dword [0x100c7dc], 4
jmp 0x1009305
cmp dword [0x100c7e8], ebx
jne case.default.0x10092da
cmp dword [0x100c7dc], 4
jne case.default.0x10092da
cmp dword [0x100c7e0], 0
jne case.default.0x10092da
mov eax, 0x3b6
cmp word [0x100c7e4], ax
jmp 0x100964b
cmp dword [0x100c7e8], ebx
jne case.default.0x10092da
mov eax, dword [0x100c7dc]
cmp eax, 4
ja 0x100964d
jne case.default.0x10092da
cmp dword [0x100c7e0], 0xa
jmp 0x1009305
cmp dword [0x100c7e8], ebx
jne case.default.0x10092da
cmp dword [0x100c7dc], 4
jne case.default.0x10092da
cmp dword [0x100c7e0], 0xa
jne case.default.0x10092da
mov eax, 0x7ce
jmp 0x10094ed
cmp dword [0x100c7e8], ebx
jne case.default.0x10092da
mov eax, dword [0x100c7dc]
cmp eax, 4
jne 0x10096c3
cmp dword [0x100c7e0], 0x5a
jae 0x100964d
cmp eax, eax
jmp 0x10096c3
cmp dword [0x100c7e8], 2
jmp 0x10094b0
cmp dword [0x100c7e8], 2
jne case.default.0x10092da
mov eax, dword [0x100c7dc]
cmp eax, 5
jmp 0x10096b8
cmp dword [0x100c7e8], 2
jne case.default.0x10092da
test dword [0x100c870], 0x200
jmp 0x1009339
cmp dword [0x100c7e8], 2
jne case.default.0x10092da
cmp byte [0x100c872], bl
jmp 0x100964b
mov al, byte [0x100c872]
cmp al, 3
je 0x1009459
cmp al, 2
jmp 0x1009453
mov al, byte [0x100c872]
cmp al, 3
je 0x1009421
cmp al, 2
jmp 0x100941b
mov al, byte [0x100c872]
cmp al, 3
je 0x1009610
cmp al, 2
jne case.default.0x10092da
mov eax, dword [0x100c870]
test al, 0xa3
jne case.default.0x10092da
test eax, 0x400
jmp 0x100964b
mov eax, dword [0x100c870]
and eax, 0x400
jmp 0x10096c7
mov eax, dword [0x100c870]
and eax, 0x20
jmp 0x10096c7
mov al, byte [0x100c872]
cmp al, 3
je 0x100964d
cmp al, 2
jne case.default.0x10092da
mov eax, ebx
jmp 0x10096c7
xor eax, eax
cmp byte [0x100c872], 2
jmp 0x1009497
call fcn.01009108
jmp 0x10096c7
call fcn.010091c3
jmp 0x10096c7
push 0x57
jmp 0x10092e6
push 0x58
jmp 0x10092e6
call fcn.01009200
jmp 0x10096c7
call fcn.01009167
jmp 0x10096c7
cmp dword [0x100c7e8], 2
jne case.default.0x10092da
cmp dword [0x100c7dc], 6
jmp 0x1009305
push 0x1e
call fcn.0100928b
jmp 0x10096c7
cmp dword [0x100c7e8], 2
jne case.default.0x10092da
mov eax, dword [0x100c7dc]
cmp eax, 6
ja 0x100964d
jne case.default.0x10092da
cmp dword [0x100c7e0], 0
ja 0x100964d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4