Function at 0x4a6360
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x56a260]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
xor eax, eax
push esi
push edi
push 0x11c
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x3c]
push eax
xor ebp, ebp
call fcn.004f5b00
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0xc
push str.RtlGetVersion
push str.ntdll.dll
mov dword [esp + 0x3c], 0x11c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x4a63e5
lea ecx, [esp + 0x34]
push ecx
call eax
test eax, eax
je 0x4a640d
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [esp + 0x34]
push edx
call ebx
test eax, eax
jne 0x4a640d
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x114
call ebx
test eax, eax
je 0x4a66c9
push str.GetNativeSystemInfo
push 0x54d944
call esi
push eax
call edi
test eax, eax
je 0x4a6429
lea ecx, [esp + 0x10]
push ecx
call eax
jmp 0x4a6434
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x44]
sub eax, 0
je 0x4a66ae
mov ebx, 1
sub eax, ebx
je 0x4a65d9
sub eax, ebx
jne 0x4a66c7
mov eax, dword [esp + 0x38]
cmp eax, 0xa
jne 0x4a647f
cmp dword [esp + 0x3c], ebp
jne 0x4a66c7
xor eax, eax
cmp byte [esp + 0x14e], bl
setne al
add eax, 0x11
mov ebp, eax
jmp 0x4a66c7
cmp eax, 6
jne 0x4a64f6
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4a64a2
xor ecx, ecx
cmp byte [esp + 0x14e], bl
setne cl
add ecx, 9
mov ebp, ecx
jmp 0x4a66c7
cmp eax, ebx
jne 0x4a64bc
xor edx, edx
cmp byte [esp + 0x14e], bl
setne dl
add edx, 0xb
mov ebp, edx
jmp 0x4a66c7
cmp eax, 2
jne 0x4a64d7
xor eax, eax
cmp byte [esp + 0x14e], bl
setne al
add eax, 0xd
mov ebp, eax
jmp 0x4a66c7
cmp eax, 3
jne 0x4a66c7
xor ecx, ecx
cmp byte [esp + 0x14e], bl
setne cl
add ecx, 0xf
mov ebp, ecx
jmp 0x4a66c7
cmp eax, 5
jne 0x4a65ac
cmp dword [esp + 0x3c], 2
jne 0x4a6552
cmp byte [esp + 0x14e], bl
jne 0x4a652b
cmp word [esp + 0x10], 9
jne 0x4a652b
lea ebp, [eax + 3]
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a6549
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x4a653f
mov ebp, 6
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a6549
push str.Microsoft_Windows_Server_2003_
push 0
call fcn.00430060
add esp, 8
mov eax, dword [esp + 0x38]
cmp eax, 5
jne 0x4a65ac
cmp dword [esp + 0x3c], ebx
jne 0x4a657f
mov ebp, 7
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a6576
push str.Microsoft_Windows_XP
push 0
call fcn.00430060
add esp, 8
mov eax, dword [esp + 0x38]
cmp eax, 5
jne 0x4a65ac
cmp dword [esp + 0x3c], 0
jne 0x4a66c7
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a65a3
push str.Microsoft_Windows_2000
push 0
call fcn.00430060
add esp, 8
mov eax, dword [esp + 0x38]
mov ebp, 5
mov esi, 4
cmp eax, esi
ja 0x4a66c7
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a65d2
push str.Microsoft_Windows_NT
push 0
call fcn.00430060
add esp, 8
mov ebp, esi
jmp 0x4a66c7
mov esi, 4
cmp dword [esp + 0x38], esi
jne 0x4a66c7
cmp dword [esp + 0x3c], ebp
jne 0x4a663d
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a6607
push str.Microsoft_Windows_95
push 0
call fcn.00430060
add esp, 8
mov ax, word [esp + 0x4a]
cmp ax, 0x43
je 0x4a6618
cmp ax, 0x42
jne 0x4a6633
mov ebp, ebx
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a6633
push str.OSR2
push 0
call fcn.00430060
add esp, 8
cmp dword [esp + 0x38], esi
jne 0x4a66c7
cmp dword [esp + 0x3c], 0xa
jne 0x4a6691
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a665d
push str.Microsoft_Windows_98
push 0
call fcn.00430060
add esp, 8
mov ax, word [esp + 0x4a]
cmp ax, 0x41
mov ebp, 2
je 0x4a6673
cmp ax, 0x42
jne 0x4a668b
call fcn.0042fd50
cmp dword [eax], ebp
jl 0x4a668b
push 0x532c7c
push 0
call fcn.00430060
add esp, 8
cmp dword [esp + 0x38], esi
jne 0x4a66c7
cmp dword [esp + 0x3c], 0x5a
jne 0x4a66c7
mov ebp, 3
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a66c7
push str.Microsoft_Windows_Millennium_Edition_n
jmp 0x4a66bd
call fcn.0042fd50
cmp dword [eax], 2
jl 0x4a66c7
push str.Microsoft_Win32s_n
push 0
call fcn.00430060
add esp, 8
mov eax, ebp
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f2ac1
add esp, 0x144
ret