Function at 0x1025524
Capabilities:
Check os version
Persist via ginadll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x10277b4], 0
push edi
jne 0x1025567
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x1027718
push edi
mov dword [0x10277b4], ebx
mov dword [0x1027718], 0x9c
call esi
test eax, eax
jne 0x1025567
push edi
mov dword [0x1027718], 0x94
call esi
mov eax, dword [ebp + 8]
cmp eax, 0x29
ja case.default.0x1025573
jmp dword [eax*4 + 0x1025968]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1025960
test byte [0x10277b0], 0x10
je case.default.0x1025573
cmp dword [0x102771c], 5
jb case.default.0x1025573
jmp 0x10258e6
mov eax, dword [0x10277b0]
test al, 0x10
je case.default.0x1025573
test eax, 0x100
jmp 0x10258e4
mov eax, dword [0x10277b0]
test al, 0x10
je case.default.0x1025573
test eax, 0x100
je case.default.0x1025573
jmp 0x10258e6
mov eax, dword [0x10277b0]
test eax, 0x100
je case.default.0x1025573
test al, 0x10
jmp 0x10258e4
test dword [0x10277b0], 0x110
je case.default.0x1025573
push 0x101cacc
push 0x101ca90
push 0x101ca58
push 0x80000002
call fcn.01025167
test eax, eax
jmp 0x10255d2
push 0x25
call fcn.01025524
test eax, eax
jne case.default.0x1025573
cmp byte [0x10277b2], bl
jne case.default.0x1025573
push 0x101ca50
mov edi, 0x101ca58
push edi
mov esi, 0x80000002
push esi
call fcn.0102521a
test eax, eax
jne case.default.0x1025573
push 0x101ca44
push 0x101ca90
push edi
push esi
jmp 0x1025618
call fcn.01025343
jmp 0x1025960
cmp dword [0x1027728], 2
jne case.default.0x1025573
jmp 0x1025597
cmp byte [0x10277b2], bl
jne case.default.0x1025573
cmp dword [0x102771c], 5
jmp 0x10258e4
mov al, byte [0x10277b2]
cmp al, 3
je 0x10256ad
cmp al, 2
jne case.default.0x1025573
cmp dword [0x102771c], 5
jne case.default.0x1025573
mov al, byte [0x10277b0]
test al, 2
je case.default.0x1025573
test al, al
js case.default.0x1025573
jmp 0x10258e6
mov al, byte [0x10277b2]
cmp al, 3
je 0x10256e5
cmp al, 2
jne case.default.0x1025573
cmp dword [0x102771c], 5
jne case.default.0x1025573
test byte [0x10277b0], 0x80
jmp 0x10255d2
mov al, byte [0x10277b2]
cmp al, 3
je 0x102570f
cmp al, 2
jne case.default.0x1025573
test byte [0x10277b0], 0x82
jmp 0x102568a
mov eax, dword [0x10277b0]
and eax, 0x40
jmp 0x1025960
xor eax, eax
cmp dword [0x1027728], ebx
sete al
jmp 0x1025960
xor eax, eax
cmp dword [0x1027728], 2
jmp 0x1025730
cmp dword [0x1027728], ebx
jne case.default.0x1025573
cmp dword [0x102771c], 4
jmp 0x102559e
cmp dword [0x1027728], ebx
jne case.default.0x1025573
cmp dword [0x102771c], 4
jne case.default.0x1025573
cmp dword [0x1027720], 0
jne case.default.0x1025573
mov eax, 0x3b6
cmp word [0x1027724], ax
jmp 0x10258e4
cmp dword [0x1027728], ebx
jne case.default.0x1025573
mov eax, dword [0x102771c]
cmp eax, 4
ja 0x10258e6
jne case.default.0x1025573
cmp dword [0x1027720], 0xa
jmp 0x102559e
cmp dword [0x1027728], ebx
jne case.default.0x1025573
cmp dword [0x102771c], 4
jne case.default.0x1025573
cmp dword [0x1027720], 0xa
jne case.default.0x1025573
mov eax, 0x7ce
jmp 0x1025786
cmp dword [0x1027728], ebx
jne case.default.0x1025573
mov eax, dword [0x102771c]
cmp eax, 4
jne 0x102595c
cmp dword [0x1027720], 0x5a
jae 0x10258e6
cmp eax, eax
jmp 0x102595c
cmp dword [0x1027728], 2
jmp 0x1025749
cmp dword [0x1027728], 2
jne case.default.0x1025573
mov eax, dword [0x102771c]
cmp eax, 5
jmp 0x1025951
cmp dword [0x1027728], 2
jne case.default.0x1025573
test dword [0x10277b0], 0x200
jmp 0x10255d2
cmp dword [0x1027728], 2
jne case.default.0x1025573
cmp byte [0x10277b2], bl
jmp 0x10258e4
mov al, byte [0x10277b2]
cmp al, 3
je 0x10256f2
cmp al, 2
jmp 0x10256ec
mov al, byte [0x10277b2]
cmp al, 3
je 0x10256ba
cmp al, 2
jmp 0x10256b4
mov al, byte [0x10277b2]
cmp al, 3
je 0x10258a9
cmp al, 2
jne case.default.0x1025573
mov eax, dword [0x10277b0]
test al, 0xa3
jne case.default.0x1025573
test eax, 0x400
jmp 0x10258e4
mov eax, dword [0x10277b0]
and eax, 0x400
jmp 0x1025960
mov eax, dword [0x10277b0]
and eax, 0x20
jmp 0x1025960
mov al, byte [0x10277b2]
cmp al, 3
je 0x10258e6
cmp al, 2
jne case.default.0x1025573
mov eax, ebx
jmp 0x1025960
xor eax, eax
cmp byte [0x10277b2], 2
jmp 0x1025730
call fcn.010253a1
jmp 0x1025960
call fcn.0102545c
jmp 0x1025960
push 0x57
jmp 0x102557f
push 0x58
jmp 0x102557f
call fcn.01025499
jmp 0x1025960
call fcn.01025400
jmp 0x1025960
cmp dword [0x1027728], 2
jne case.default.0x1025573
cmp dword [0x102771c], 6
jmp 0x102559e
push 0x1e
call fcn.01025524
jmp 0x1025960
cmp dword [0x1027728], 2
jne case.default.0x1025573
mov eax, dword [0x102771c]
cmp eax, 6
ja 0x10258e6
jne case.default.0x1025573
cmp dword [0x1027720], 0
ja 0x10258e6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4