Function at 0x100f8d1
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push edi
mov dword [0x10477f0], 0x94
call esi
jmp 0x100f8e9
push 0x1000
jmp 0x100f726
test byte [0x1047888], 0x10
jne 0x100f909
jmp case.0x100f8f5.37
mov eax, dword [0x1047888]
test al, 0x10
je case.0x100f8f5.37
test ah, 1
jmp 0x100f6fd
mov eax, dword [0x1047888]
test al, 0x10
je case.0x100f8f5.37
test ah, 1
jmp 0x100f679
mov eax, dword [0x1047888]
test ah, 1
je case.0x100f8f5.37
test al, 0x10
jmp 0x100f6fd
test word [0x1047888], 0x110
je case.0x100f8f5.37
push 0x100f8b4
push 0x100f878
push 0x100f840
push 0x80000002
call fcn.0103debe
test eax, eax
jmp 0x100f679
cmp byte [0x104788a], bl
jne case.0x100f8f5.37
call fcn.0103e0be
test eax, eax
jne case.0x100f8f5.37
push 0x100f838
mov edi, 0x100f840
push edi
mov esi, 0x80000002
push esi
call fcn.0103df71
test eax, eax
jne case.0x100f8f5.37
push 0x100f82c
push 0x100f878
push edi
push esi
jmp 0x100f41d
call fcn.0103e0be
jmp 0x100f918
cmp byte [0x104788a], bl
jne case.0x100f8f5.37
cmp dword [0x10477f4], 5
jmp 0x100f6fd
mov al, byte [0x104788a]
cmp al, 3
je 0x100f4a1
cmp al, 2
jne case.0x100f8f5.37
cmp dword [0x10477f4], 5
jmp 0x100f68f
mov al, byte [0x104788a]
cmp al, 3
je 0x100f4be
cmp al, 2
jne case.0x100f8f5.37
cmp dword [0x10477f4], 5
jmp 0x100f66c
mov al, byte [0x104788a]
cmp al, 3
je 0x100f4db
cmp al, 2
jne case.0x100f8f5.37
test byte [0x1047888], 0x82
jmp 0x100f47e
mov eax, dword [0x1047888]
and eax, 0x40
jmp 0x100f918
xor eax, eax
cmp dword [0x1047800], ebx
jmp 0x100f504
xor eax, eax
cmp dword [0x1047800], 2
sete al
jmp 0x100f918
cmp dword [0x1047800], ebx
jmp 0x100f5d9
cmp dword [0x1047800], ebx
jne case.0x100f8f5.37
cmp dword [0x10477f4], 4
jne case.0x100f8f5.37
cmp dword [0x10477f8], 0
jne case.0x100f8f5.37
cmp word [0x10477fc], 0x3b6
jmp 0x100f6fd
cmp dword [0x1047800], ebx
jne case.0x100f8f5.37
mov eax, dword [0x10477f4]
cmp eax, 4
ja 0x100f916
jne case.0x100f8f5.37
cmp dword [0x10477f8], 0xa
jmp 0x100f910
cmp dword [0x1047800], ebx
jne case.0x100f8f5.37
cmp dword [0x10477f4], 4
jne case.0x100f8f5.37
cmp dword [0x10477f8], 0xa
jne case.0x100f8f5.37
cmp word [0x10477fc], 0x7ce
jmp 0x100f6fd
cmp dword [0x1047800], ebx
jne case.0x100f8f5.37
mov eax, dword [0x10477f4]
cmp eax, 4
jne 0x100f628
cmp dword [0x10477f8], 0x5a
jae 0x100f916
cmp eax, eax
jmp 0x100f628
cmp dword [0x1047800], 2
jne case.0x100f8f5.37
cmp dword [0x10477f4], 4
jmp 0x100f910
cmp dword [0x1047800], 2
jne case.0x100f8f5.37
mov eax, dword [0x10477f4]
cmp eax, 5
ja 0x100f916
jne case.0x100f8f5.37
mov eax, dword [0x10477f8]
test eax, eax
ja 0x100f916
jne case.0x100f8f5.37
cmp word [0x10477fc], 0x893
ja 0x100f916
jmp case.0x100f8f5.37
cmp dword [0x1047800], 2
jne case.0x100f8f5.37
test byte [0x1047889], 2
jmp 0x100f679
cmp dword [0x1047800], 2
jne case.0x100f8f5.37
cmp byte [0x104788a], bl
jmp 0x100f6fd
mov al, byte [0x104788a]
cmp al, 3
je 0x100f672
cmp al, 2
jne case.0x100f8f5.37
test byte [0x1047888], 0x80
jne 0x100f916
jmp case.0x100f8f5.37
mov al, byte [0x104788a]
cmp al, 3
je 0x100f695
cmp al, 2
jne case.0x100f8f5.37
mov al, byte [0x1047888]
test al, 2
je case.0x100f8f5.37
test al, al
jns 0x100f916
jmp case.0x100f8f5.37
mov al, byte [0x104788a]
cmp al, 3
je 0x100f6c0
cmp al, 2
jne case.0x100f8f5.37
mov eax, dword [0x1047888]
test al, 0xa2
jne case.0x100f8f5.37
test ah, 4
jmp 0x100f6fd
mov eax, dword [0x1047888]
and eax, 0x400
jmp 0x100f918
mov eax, dword [0x1047888]
and eax, 0x20
jmp 0x100f918
mov al, byte [0x104788a]
cmp al, 3
je 0x100f916
cmp al, 2
je 0x100f916
jmp case.0x100f8f5.37
call fcn.0103e11c
jmp 0x100f918
push 0x56
jmp 0x100f726
push 0x57
jmp 0x100f726
call fcn.0103e207
jmp 0x100f918
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x100f918
call fcn.0103e1ab
jmp 0x100f918
mov eax, dword [0x1047888]
and eax, 0x2000
jmp 0x100f918
mov eax, dword [0x1047888]
and eax, 0x4000
jmp 0x100f918
mov eax, dword [0x1047888]
and eax, 0x8000
jmp 0x100f918
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
jmp 0x100f918
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x104788c], 0
push edi
je 0x10134ce
mov eax, dword [ebp + 8]
cmp eax, 0x2b
ja case.0x100f8f5.37
jmp dword [eax*4 + 0x100f77b]
cmp dword [0x1047800], 2
jne case.0x100f8f5.37
cmp dword [0x10477f4], 5
jb case.0x100f8f5.37
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x10477f0
push edi
mov dword [0x104788c], ebx
mov dword [0x10477f0], 0x9c
call esi
test eax, eax
jne 0x100f8e9
jmp 0x100f38d
xor eax, eax
jmp 0x100f918