Function at 0x100ea8c
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x103f484], 0
push edi
je 0x1012b46
mov eax, dword [esp + 0x10]
cmp eax, 0x1e
ja case.default.0x100eaac
jmp dword [eax*4 + 0x10183a8]
cmp dword [0x103f3f8], 2
jne case.default.0x100eaac
cmp dword [0x103f3ec], 5
jb case.default.0x100eaac
mov eax, ebx
pop edi
pop esi
pop ebx
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x103f3e8
push edi
mov dword [0x103f484], ebx
mov dword [0x103f3e8], 0x9c
call esi
test eax, eax
jne 0x100ea9f
jmp 0x102521d
xor eax, eax
jmp 0x100eacf
push edi
mov dword [0x103f3e8], 0x94
call esi
jmp 0x100ea9f
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x100eacf
test byte [0x103f480], 0x10
je case.default.0x100eaac
jmp 0x100eac0
mov eax, dword [0x103f480]
test al, 0x10
je case.default.0x100eaac
test ah, 1
jmp 0x102555f
mov eax, dword [0x103f480]
test al, 0x10
je case.default.0x100eaac
test ah, 1
jmp 0x1025500
mov eax, dword [0x103f480]
test ah, 1
je case.default.0x100eaac
test al, 0x10
jmp 0x102555f
test word [0x103f480], 0x110
je case.default.0x100eaac
push 0x10272f8
push 0x10272bc
push 0x1027284
push 0x80000002
call fcn.010352ad
test eax, eax
jmp 0x1025500
call fcn.01035438
test eax, eax
jne case.default.0x100eaac
push 0x102727c
mov edi, 0x1027284
push edi
mov esi, 0x80000002
push esi
call fcn.01035359
test eax, eax
jne case.default.0x100eaac
push 0x1027270
push 0x10272bc
push edi
push esi
jmp 0x10252b3
call fcn.01035438
jmp 0x100eacf
cmp byte [0x103f482], bl
jne case.default.0x100eaac
cmp dword [0x103f3ec], 5
jmp 0x102555f
mov al, byte [0x103f482]
cmp al, 3
je 0x102532b
cmp al, 2
jne case.default.0x100eaac
cmp dword [0x103f3ec], 5
jmp 0x1025516
mov al, byte [0x103f482]
cmp al, 3
je 0x1025348
cmp al, 2
jne case.default.0x100eaac
cmp dword [0x103f3ec], 5
jmp 0x10254f3
mov al, byte [0x103f482]
cmp al, 3
je 0x1025365
cmp al, 2
jne case.default.0x100eaac
test byte [0x103f480], 0x82
jmp 0x1025308
mov eax, dword [0x103f480]
and eax, 0x40
jmp 0x100eacf
xor eax, eax
cmp dword [0x103f3f8], ebx
jmp 0x102538e
xor eax, eax
cmp dword [0x103f3f8], 2
sete al
jmp 0x100eacf
cmp dword [0x103f3f8], ebx
jmp 0x1025463
cmp dword [0x103f3f8], ebx
jne case.default.0x100eaac
cmp dword [0x103f3ec], 4
jne case.default.0x100eaac
cmp dword [0x103f3f0], 0
jne case.default.0x100eaac
cmp word [0x103f3f4], 0x3b6
jmp 0x102555f
cmp dword [0x103f3f8], ebx
jne case.default.0x100eaac
mov eax, dword [0x103f3ec]
cmp eax, 4
ja 0x100eacd
jne case.default.0x100eaac
cmp dword [0x103f3f0], 0xa
jmp 0x100eac7
cmp dword [0x103f3f8], ebx
jne case.default.0x100eaac
cmp dword [0x103f3ec], 4
jne case.default.0x100eaac
cmp dword [0x103f3f0], 0xa
jne case.default.0x100eaac
cmp word [0x103f3f4], 0x7ce
jmp 0x102555f
cmp dword [0x103f3f8], ebx
jne case.default.0x100eaac
mov eax, dword [0x103f3ec]
cmp eax, 4
jne 0x10254b2
cmp dword [0x103f3f0], 0x5a
jae 0x100eacd
cmp eax, eax
jmp 0x10254b2
cmp dword [0x103f3f8], 2
jne case.default.0x100eaac
cmp dword [0x103f3ec], 4
jmp 0x100eac7
cmp dword [0x103f3f8], 2
jne case.default.0x100eaac
mov eax, dword [0x103f3ec]
cmp eax, 5
ja 0x100eacd
jne case.default.0x100eaac
mov eax, dword [0x103f3f0]
test eax, eax
ja 0x100eacd
jne case.default.0x100eaac
cmp word [0x103f3f4], 0x893
jbe case.default.0x100eaac
jmp 0x100eacd
cmp dword [0x103f3f8], 2
jne case.default.0x100eaac
test byte [0x103f481], 2
jmp 0x1025500
cmp dword [0x103f3f8], 2
jne case.default.0x100eaac
cmp byte [0x103f482], bl
jmp 0x102555f
mov al, byte [0x103f482]
cmp al, 3
je 0x10254f9
cmp al, 2
jne case.default.0x100eaac
test byte [0x103f480], 0x80
je case.default.0x100eaac
jmp 0x100eacd
mov al, byte [0x103f482]
cmp al, 3
je 0x102551c
cmp al, 2
jne case.default.0x100eaac
mov al, byte [0x103f480]
test al, 2
je case.default.0x100eaac
test al, al
js case.default.0x100eaac
jmp 0x100eacd
mov al, byte [0x103f482]
cmp al, 3
je 0x1025547
cmp al, 2
jne case.default.0x100eaac
test byte [0x103f480], 0x82
jmp 0x102555f
mov al, byte [0x103f482]
cmp al, 3
je 0x100eacd
cmp al, 2
jne case.default.0x100eaac
jmp 0x100eacd
call fcn.0103548f
jmp 0x100eacf