Function at 0x4a40c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x1e8
push ebp
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x47
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4a4105
pop edi
mov eax, 1
pop ebp
add esp, 0x1e8
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x4a412d
lea ecx, [esp + 0x10]
push ecx
call eax
jmp 0x4a4138
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x44], 2
jne 0x4a4536
cmp dword [esp + 0x38], 4
jbe 0x4a4536
push ebx
push esi
mov esi, dword [esp + 0x1fc]
push str.Microsoft
push pe_nt_image_headers32
push esi
call fcn.004a4620
mov eax, dword [esp + 0x40]
mov ebx, 1
cmp eax, 6
jne case.0x4a4203.5
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4a41a1
cmp byte [esp + 0x156], bl
jne 0x4a4191
push str.Windows_Vista
jmp 0x4a4196
push str.Windows_Server_2008
push pe_nt_image_headers32
push esi
call fcn.004a4680
cmp dword [esp + 0x44], ebx
jne 0x4a41c7
cmp byte [esp + 0x156], bl
jne 0x4a41b7
push str.Windows_7
jmp 0x4a41bc
push str.Windows_Server_2008_R2
push pe_nt_image_headers32
push esi
call fcn.004a4680
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebp
test eax, eax
je case.0x4a4203.5
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x44]
push 0
push 0
push edx
push ecx
call eax
mov edx, dword [esp + 0x14]
lea eax, [edx - 1]
cmp eax, 0x18
ja case.0x4a4203.5
jmp dword [eax*4 + 0x4a4544]
push str.Ultimate_Edition
jmp 0x4a4278
push str.Home_Premium_Edition
jmp 0x4a4278
push str.Home_Basic_Edition
jmp 0x4a4278
push str.Business_Edition
jmp 0x4a4278
push str.Starter_Edition
jmp 0x4a4278
push str.Cluster_Server_Edition
jmp 0x4a4278
push str.Datacenter_Edition
jmp 0x4a4278
push str.Datacenter_Edition__core_installation_
jmp 0x4a4278
push str.Enterprise_Edition
jmp 0x4a4278
push str.Enterprise_Edition__core_installation_
jmp 0x4a4278
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4a4278
push str.Small_Business_Server
jmp 0x4a4278
push str.Small_Business_Server_Premium_Edition
jmp 0x4a4278
push str.Standard_Edition
jmp 0x4a4278
push str.Standard_Edition__core_installation_
jmp 0x4a4278
push str.Web_Server_Edition
push pe_nt_image_headers32
push esi
call fcn.004a4680
mov eax, dword [esp + 0x40]
mov edi, 5
cmp eax, edi
jne 0x4a4466
cmp dword [esp + 0x44], 2
jne 0x4a43a9
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4a42b2
push str.Windows_Server_2003_R2_
jmp 0x4a42f0
mov eax, dword [esp + 0x154]
cmp ax, 0x2000
jne 0x4a42c6
push str.Windows_Storage_Server_2003
jmp 0x4a42f0
cmp ax, 0x8000
jne 0x4a42d3
push str.Windows_Home_Server
jmp 0x4a42f0
cmp byte [esp + 0x156], bl
jne 0x4a42eb
cmp word [esp + 0x18], 9
jne 0x4a42eb
push str.Windows_XP_Professional_x64_Edition
jmp 0x4a42f0
push str.Windows_Server_2003_
push pe_nt_image_headers32
push esi
call fcn.004a4680
cmp byte [esp + 0x156], bl
je 0x4a439f
mov ax, word [esp + 0x18]
cmp ax, 6
jne 0x4a4330
mov al, byte [esp + 0x154]
test al, 0x80
je 0x4a4325
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x4a4394
test al, 2
je 0x4a439f
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4a4394
cmp ax, 9
jne 0x4a435a
mov al, byte [esp + 0x154]
test al, 0x80
je 0x4a4348
push str.Datacenter_x64_Edition
jmp 0x4a4394
test al, 2
je 0x4a4353
push str.Enterprise_x64_Edition
jmp 0x4a4394
push str.Standard_x64_Edition
jmp 0x4a4394
mov eax, dword [esp + 0x154]
test ah, 0x40
je 0x4a436d
push str.Compute_Cluster_Edition
jmp 0x4a4394
test al, 0x80
je 0x4a4378
push str.Datacenter_Edition
jmp 0x4a4394
test al, 2
je 0x4a4383
push str.Enterprise_Edition
jmp 0x4a4394
test ah, 4
je 0x4a438f
push str.Web_Edition
jmp 0x4a4394
push str.Standard_Edition
push pe_nt_image_headers32
push esi
call fcn.004a4680
cmp dword [esp + 0x40], edi
jne 0x4a4466
cmp dword [esp + 0x44], ebx
jne 0x4a43e8
push str.Windows_XP
push pe_nt_image_headers32
push esi
call fcn.004a4680
mov eax, dword [esp + 0x154]
test ah, 2
je 0x4a43d2
push str.Home_Edition
jmp 0x4a43d7
push str.Professional
push pe_nt_image_headers32
push esi
call fcn.004a4680
cmp dword [esp + 0x40], edi
jne 0x4a4466
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4a4466
push str.Windows_2000
push pe_nt_image_headers32
push esi
call fcn.004a4680
cmp byte [esp + 0x156], bl
jne 0x4a4439
lea eax, [esp + 0x10]
push eax
push pe_nt_image_headers32
push esi
call fcn.004a4730
test eax, eax
jl 0x4a4466
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Professional
lea edx, [esi + eax*2]
push ecx
push edx
call fcn.004a4620
jmp 0x4a4466
mov al, byte [esp + 0x154]
test al, 0x80
je 0x4a444b
push str.Datacenter_Server
jmp 0x4a445b
test al, 2
je 0x4a4456
push str.Advanced_Server
jmp 0x4a445b
push str.Server
push pe_nt_image_headers32
push esi
call fcn.004a4680
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x4a44b6
lea ecx, [esp + 0x10]
push ecx
push pe_nt_image_headers32
push esi
call fcn.004a4730
test eax, eax
jl 0x4a44a6
mov eax, dword [esp + 0x10]
mov edx, pe_nt_image_headers32
sub edx, eax
push 0x4cb958
lea eax, [esi + eax*2]
push edx
push eax
call fcn.004a4620
lea ecx, [esp + 0x50]
push ecx
push pe_nt_image_headers32
push esi
call fcn.004a4680
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x158]
push edx
push str.__build__d_
push 0x50
push eax
call fcn.004a45b0
add esp, 0x10
lea ecx, [esp + 0x158]
push ecx
push pe_nt_image_headers32
push esi
call fcn.004a4680
cmp dword [esp + 0x40], 6
jb 0x4a4529
mov ax, word [esp + 0x18]
cmp ax, 9
jne 0x4a4514
push str.__64_bit
push pe_nt_image_headers32
push esi
call fcn.004a4680
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x1e8
ret
test ax, ax
jne 0x4a4529
push str.__32_bit
push pe_nt_image_headers32
push esi
call fcn.004a4680
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x1e8
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x1e8
ret