Function at 0x100305a
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x1004724], 0
push edi
jne 0x100309d
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1004688
push edi
mov dword [0x1004724], ebx
mov dword [0x1004688], 0x9c
call esi
test eax, eax
jne 0x100309d
push edi
mov dword [0x1004688], 0x94
call esi
mov eax, dword [ebp + 8]
cmp eax, 0x29
ja case.default.0x10030a9
jmp dword [eax*4 + 0x100349e]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1003496
test byte [0x1004720], 0x10
je case.default.0x10030a9
cmp dword [0x100468c], 5
jb case.default.0x10030a9
jmp 0x100341c
mov eax, dword [0x1004720]
test al, 0x10
je case.default.0x10030a9
test eax, 0x100
jmp 0x100341a
mov eax, dword [0x1004720]
test al, 0x10
je case.default.0x10030a9
test eax, 0x100
je case.default.0x10030a9
jmp 0x100341c
mov eax, dword [0x1004720]
test eax, 0x100
je case.default.0x10030a9
test al, 0x10
jmp 0x100341a
test dword [0x1004720], 0x110
je case.default.0x10030a9
push 0x10014d4
push 0x1001498
push 0x1001460
push 0x80000002
call fcn.01002c9d
test eax, eax
jmp 0x1003108
push 0x25
call fcn.0100305a
test eax, eax
jne case.default.0x10030a9
cmp byte [0x1004722], bl
jne case.default.0x10030a9
push 0x1001458
mov edi, 0x1001460
push edi
mov esi, 0x80000002
push esi
call fcn.01002d50
test eax, eax
jne case.default.0x10030a9
push 0x100144c
push 0x1001498
push edi
push esi
jmp 0x100314e
call fcn.01002e79
jmp 0x1003496
cmp dword [0x1004698], 2
jne case.default.0x10030a9
jmp 0x10030cd
cmp byte [0x1004722], bl
jne case.default.0x10030a9
cmp dword [0x100468c], 5
jmp 0x100341a
mov al, byte [0x1004722]
cmp al, 3
je 0x10031e3
cmp al, 2
jne case.default.0x10030a9
cmp dword [0x100468c], 5
jne case.default.0x10030a9
mov al, byte [0x1004720]
test al, 2
je case.default.0x10030a9
test al, al
js case.default.0x10030a9
jmp 0x100341c
mov al, byte [0x1004722]
cmp al, 3
je 0x100321b
cmp al, 2
jne case.default.0x10030a9
cmp dword [0x100468c], 5
jne case.default.0x10030a9
test byte [0x1004720], 0x80
jmp 0x1003108
mov al, byte [0x1004722]
cmp al, 3
je 0x1003245
cmp al, 2
jne case.default.0x10030a9
test byte [0x1004720], 0x82
jmp 0x10031c0
mov eax, dword [0x1004720]
and eax, 0x40
jmp 0x1003496
xor eax, eax
cmp dword [0x1004698], ebx
sete al
jmp 0x1003496
xor eax, eax
cmp dword [0x1004698], 2
jmp 0x1003266
cmp dword [0x1004698], ebx
jne case.default.0x10030a9
cmp dword [0x100468c], 4
jmp 0x10030d4
cmp dword [0x1004698], ebx
jne case.default.0x10030a9
cmp dword [0x100468c], 4
jne case.default.0x10030a9
cmp dword [0x1004690], 0
jne case.default.0x10030a9
mov eax, 0x3b6
cmp word [0x1004694], ax
jmp 0x100341a
cmp dword [0x1004698], ebx
jne case.default.0x10030a9
mov eax, dword [0x100468c]
cmp eax, 4
ja 0x100341c
jne case.default.0x10030a9
cmp dword [0x1004690], 0xa
jmp 0x10030d4
cmp dword [0x1004698], ebx
jne case.default.0x10030a9
cmp dword [0x100468c], 4
jne case.default.0x10030a9
cmp dword [0x1004690], 0xa
jne case.default.0x10030a9
mov eax, 0x7ce
jmp 0x10032bc
cmp dword [0x1004698], ebx
jne case.default.0x10030a9
mov eax, dword [0x100468c]
cmp eax, 4
jne 0x1003492
cmp dword [0x1004690], 0x5a
jae 0x100341c
cmp eax, eax
jmp 0x1003492
cmp dword [0x1004698], 2
jmp 0x100327f
cmp dword [0x1004698], 2
jne case.default.0x10030a9
mov eax, dword [0x100468c]
cmp eax, 5
jmp 0x1003487
cmp dword [0x1004698], 2
jne case.default.0x10030a9
test dword [0x1004720], 0x200
jmp 0x1003108
cmp dword [0x1004698], 2
jne case.default.0x10030a9
cmp byte [0x1004722], bl
jmp 0x100341a
mov al, byte [0x1004722]
cmp al, 3
je 0x1003228
cmp al, 2
jmp 0x1003222
mov al, byte [0x1004722]
cmp al, 3
je 0x10031f0
cmp al, 2
jmp 0x10031ea
mov al, byte [0x1004722]
cmp al, 3
je 0x10033df
cmp al, 2
jne case.default.0x10030a9
mov eax, dword [0x1004720]
test al, 0xa3
jne case.default.0x10030a9
test eax, 0x400
jmp 0x100341a
mov eax, dword [0x1004720]
and eax, 0x400
jmp 0x1003496
mov eax, dword [0x1004720]
and eax, 0x20
jmp 0x1003496
mov al, byte [0x1004722]
cmp al, 3
je 0x100341c
cmp al, 2
jne case.default.0x10030a9
mov eax, ebx
jmp 0x1003496
xor eax, eax
cmp byte [0x1004722], 2
jmp 0x1003266
call fcn.01002ed7
jmp 0x1003496
call fcn.01002f92
jmp 0x1003496
push 0x57
jmp 0x10030b5
push 0x58
jmp 0x10030b5
call fcn.01002fcf
jmp 0x1003496
call fcn.01002f36
jmp 0x1003496
cmp dword [0x1004698], 2
jne case.default.0x10030a9
cmp dword [0x100468c], 6
jmp 0x10030d4
push 0x1e
call fcn.0100305a
jmp 0x1003496
cmp dword [0x1004698], 2
jne case.default.0x10030a9
mov eax, dword [0x100468c]
cmp eax, 6
ja 0x100341c
jne case.default.0x10030a9
cmp dword [0x1004690], 0
ja 0x100341c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4