Function at 0x435c67
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
lea eax, [ebp - 0xc8]
push esi
mov esi, ecx
push eax
mov dword [ebp - 0xc8], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xc4]
mov dword [esi], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xbc]
mov dword [esi + 8], eax
lea eax, [ebp - 0xb4]
push eax
call fcn.004401c0
test eax, eax
pop ecx
jle 0x435cfa
dec eax
test eax, eax
jle 0x435cd0
cmp byte [ebp + eax - 0xb4], 0x20
lea ecx, [ebp + eax - 0xb4]
jne 0x435cd0
and byte [ecx], 0
jmp 0x435cb5
xor ecx, ecx
test eax, eax
jle 0x435ce5
cmp byte [ebp + ecx - 0xb4], 0x20
jne 0x435ce5
inc ecx
cmp ecx, eax
jl 0x435cd6
lea eax, [ebp + ecx - 0xb4]
push eax
lea eax, [esi + 0xc]
push eax
call fcn.00440a20
pop ecx
pop ecx
jmp 0x435cfe
and byte [esi + 0xc], 0
and byte [esi + 0x10c], 0
and byte [esi + 0x10d], 0
and byte [esi + 0x10e], 0
and byte [esi + 0x10f], 0
and byte [esi + 0x114], 0
and byte [esi + 0x115], 0
and byte [esi + 0x110], 0
and byte [esi + 0x111], 0
and byte [esi + 0x116], 0
and byte [esi + 0x117], 0
and byte [esi + 0x11a], 0
and byte [esi + 0x11b], 0
and byte [esi + 0x11c], 0
and byte [esi + 0x11d], 0
and byte [esi + 0x11e], 0
and byte [esi + 0x11f], 0
cmp dword [ebp - 0xb8], 2
jne 0x435e70
mov eax, dword [esi]
mov byte [esi + 0x10c], 1
sub eax, 4
je 0x435e60
dec eax
je 0x435df2
dec eax
jne 0x435ec7
mov eax, dword [esi + 4]
mov byte [esi + 0x10f], 1
test eax, eax
jne 0x435dc6
mov byte [esi + 0x115], 1
mov byte [esi + 0x111], 1
mov byte [esi + 0x119], 1
mov byte [esi + 0x118], 1
jmp 0x435ec7
cmp eax, 1
jne 0x435ec7
mov byte [esi + 0x111], al
mov byte [esi + 0x117], al
mov byte [esi + 0x115], al
mov byte [esi + 0x113], al
mov byte [esi + 0x112], al
jmp 0x435ec7
mov eax, dword [esi + 4]
mov byte [esi + 0x10f], 1
test eax, eax
jne 0x435e13
mov byte [esi + 0x115], 1
mov byte [esi + 0x114], 1
jmp 0x435ec7
cmp eax, 1
je 0x435e49
cmp eax, 2
jne 0x435e25
cmp byte [ebp - 0x2e], 1
je 0x435e49
cmp eax, eax
jb 0x435ec7
mov byte [esi + 0x115], 1
mov byte [esi + 0x111], 1
mov byte [esi + 0x117], 1
mov byte [esi + 0x116], 1
jmp 0x435ec7
mov byte [esi + 0x115], 1
mov byte [esi + 0x111], 1
mov byte [esi + 0x110], 1
jmp 0x435ec7
mov byte [esi + 0x10f], 1
mov byte [esi + 0x10e], 1
jmp 0x435ec7
movzx eax, word [ebp - 0xbc]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
mov byte [esi + 0x10d], 1
mov byte [esi + 0x11d], 1
je 0x435ec0
cmp eax, 0xa
je 0x435eb0
cmp eax, 0x5a
jne 0x435ec7
mov byte [esi + 0x11b], 1
mov byte [esi + 0x11f], 1
mov byte [esi + 0x11e], 1
jmp 0x435ec7
mov byte [esi + 0x11b], 1
mov byte [esi + 0x11a], 1
jmp 0x435ec7
mov byte [esi + 0x11c], 1
and dword [ebp - 4], 0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.IsWow64Process
push str.kernel32
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
mov dword [ebp - 8], eax
je 0x435f04
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 8]
test eax, eax
jne 0x435f04
and dword [ebp - 4], eax
and byte [esi + 0x120], 0
cmp dword [ebp - 4], 1
lea eax, [esi + 0x120]
jne 0x435f1a
mov byte [eax], 1
cmp byte [eax], 0
je 0x435f3a
push str.GetNativeSystemInfo
push str.kernel32
call edi
push eax
call ebx
test eax, eax
je 0x435f44
lea ecx, [ebp - 0x2c]
push ecx
call eax
jmp 0x435f44
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x2c]
pop edi
test ax, ax
pop ebx
jne 0x435f5b
mov dword [esi + 0x124], 1
jmp 0x435f8a
cmp ax, 6
jne 0x435f6d
mov dword [esi + 0x124], 2
jmp 0x435f8a
cmp ax, 9
jne 0x435f7f
mov dword [esi + 0x124], 3
jmp 0x435f8a
movzx eax, ax
neg eax
mov dword [esi + 0x124], eax
mov eax, esi
pop esi
leave
ret