Function at 0x436ef7
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
lea eax, [ebp - 0xc8]
push esi
mov esi, ecx
push eax
mov dword [ebp - 0xc8], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xc4]
mov dword [esi], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xbc]
mov dword [esi + 8], eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00441580
test eax, eax
pop ecx
jle 0x436f8a
dec eax
test eax, eax
jle 0x436f60
cmp byte [ebp + eax - 0xb4], 0x20
lea ecx, [ebp + eax - 0xb4]
jne 0x436f60
and byte [ecx], 0
jmp 0x436f45
xor ecx, ecx
test eax, eax
jle 0x436f75
cmp byte [ebp + ecx - 0xb4], 0x20
jne 0x436f75
inc ecx
cmp ecx, eax
jl 0x436f66
lea eax, [ebp + ecx - 0xb4]
push eax
lea eax, [esi + 0xc]
push eax
call fcn.00441de0
pop ecx
pop ecx
jmp 0x436f8e
and byte [esi + 0xc], 0
and byte [esi + 0x10c], 0
and byte [esi + 0x10d], 0
and byte [esi + 0x10e], 0
and byte [esi + 0x10f], 0
and byte [esi + 0x114], 0
and byte [esi + 0x115], 0
and byte [esi + 0x110], 0
and byte [esi + 0x111], 0
and byte [esi + 0x116], 0
and byte [esi + 0x117], 0
and byte [esi + 0x11a], 0
and byte [esi + 0x11b], 0
and byte [esi + 0x11c], 0
and byte [esi + 0x11d], 0
and byte [esi + 0x11e], 0
and byte [esi + 0x11f], 0
cmp dword [ebp - 0xb8], 2
jne 0x437100
mov eax, dword [esi]
mov byte [esi + 0x10c], 1
sub eax, 4
je 0x4370f0
dec eax
je 0x437082
dec eax
jne 0x437157
mov eax, dword [esi + 4]
mov byte [esi + 0x10f], 1
test eax, eax
jne 0x437056
mov byte [esi + 0x115], 1
mov byte [esi + 0x111], 1
mov byte [esi + 0x119], 1
mov byte [esi + 0x118], 1
jmp 0x437157
cmp eax, 1
jne 0x437157
mov byte [esi + 0x111], al
mov byte [esi + 0x117], al
mov byte [esi + 0x115], al
mov byte [esi + 0x113], al
mov byte [esi + 0x112], al
jmp 0x437157
mov eax, dword [esi + 4]
mov byte [esi + 0x10f], 1
test eax, eax
jne 0x4370a3
mov byte [esi + 0x115], 1
mov byte [esi + 0x114], 1
jmp 0x437157
cmp eax, 1
je 0x4370d9
cmp eax, 2
jne 0x4370b5
cmp byte [ebp - 0x2e], 1
je 0x4370d9
cmp eax, eax
jb 0x437157
mov byte [esi + 0x115], 1
mov byte [esi + 0x111], 1
mov byte [esi + 0x117], 1
mov byte [esi + 0x116], 1
jmp 0x437157
mov byte [esi + 0x115], 1
mov byte [esi + 0x111], 1
mov byte [esi + 0x110], 1
jmp 0x437157
mov byte [esi + 0x10f], 1
mov byte [esi + 0x10e], 1
jmp 0x437157
movzx eax, word [ebp - 0xbc]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
mov byte [esi + 0x10d], 1
mov byte [esi + 0x11d], 1
je 0x437150
cmp eax, 0xa
je 0x437140
cmp eax, 0x5a
jne 0x437157
mov byte [esi + 0x11b], 1
mov byte [esi + 0x11f], 1
mov byte [esi + 0x11e], 1
jmp 0x437157
mov byte [esi + 0x11b], 1
mov byte [esi + 0x11a], 1
jmp 0x437157
mov byte [esi + 0x11c], 1
and dword [ebp - 4], 0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.IsWow64Process
push str.kernel32
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
mov dword [ebp - 8], eax
je 0x437194
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 8]
test eax, eax
jne 0x437194
and dword [ebp - 4], eax
and byte [esi + 0x120], 0
cmp dword [ebp - 4], 1
lea eax, [esi + 0x120]
jne 0x4371aa
mov byte [eax], 1
cmp byte [eax], 0
je 0x4371ca
push str.GetNativeSystemInfo
push str.kernel32
call edi
push eax
call ebx
test eax, eax
je 0x4371d4
lea ecx, [ebp - 0x2c]
push ecx
call eax
jmp 0x4371d4
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x2c]
pop edi
test ax, ax
pop ebx
jne 0x4371eb
mov dword [esi + 0x124], 1
jmp 0x43721a
cmp ax, 6
jne 0x4371fd
mov dword [esi + 0x124], 2
jmp 0x43721a
cmp ax, 9
jne 0x43720f
mov dword [esi + 0x124], 3
jmp 0x43721a
movzx eax, ax
neg eax
mov dword [esi + 0x124], eax
mov eax, esi
pop esi
leave
ret