Function at 0x4e2220
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x57a734]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
push str.RtlGetVersion
push 0x54bc6c
mov dword [ebp - 0x220], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x110
mov esi, eax
lea eax, [ebp - 0x330]
push 0
push eax
call fcn.004fce20
add esp, 0xc
mov dword [ebp - 0x334], 0x114
lea eax, [ebp - 0x334]
push eax
call esi
push 0x18
push str.unknown_OperatingSystem.
mov ecx, edi
mov esi, eax
call fcn.004df530
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je case.0x4e2318.7
test esi, esi
jne case.0x4e2318.7
push 0x100
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.004fce20
push dword [ebp - 0x218]
lea eax, [ebp - 0x104]
push dword [ebp - 0x21c]
push str._d__d
push eax
call fcn.00402b87
lea eax, [ebp - 0x104]
push eax
call fcn.00427d77
mov eax, dword [ebp - 0x330]
add esp, 0x20
add eax, 0xfffffffc
cmp eax, 6
ja case.0x4e2318.7
mov esi, 0x54bdb4
mov ecx, 0x54bdc0
jmp dword [eax*4 + 0x4e2570]
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x4e234f
cmp eax, 0xa
je 0x4e2343
cmp eax, 0x5a
jne case.0x4e2318.7
push 0x14
push 0x54bce8
jmp 0x4e2557
push 0x14
push str.Microsoft_Windows_98
jmp 0x4e2557
mov eax, dword [ebp - 0x210]
cmp eax, 2
jne 0x4e2366
push 0x18
push str.Microsoft_Windows_NT_4.0
jmp 0x4e2557
cmp eax, 1
jne case.0x4e2318.7
push 0x14
push str.Microsoft_Windows_95
jmp 0x4e2557
mov eax, dword [ebp - 0x32c]
sub eax, 0
je 0x4e23f1
sub eax, 1
je 0x4e23e5
sub eax, 1
jne case.0x4e2318.7
cmp byte [ebp - 0x106], 1
jne 0x4e23b3
cmp word [ebp - 0x474], 9
jne 0x4e23b3
push 0x23
push 0x54bd1c
jmp 0x4e2557
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x4e23cd
push 0x13
push 0x54bd40
jmp 0x4e2557
push 0x59
call esi
test eax, eax
je case.0x4e2318.7
push 0x16
push 0x54bd54
jmp 0x4e2557
push 0xa
push 0x54bd10
jmp 0x4e2557
push 0xc
push 0x54bd00
jmp 0x4e2557
mov eax, dword [ebp - 0x32c]
cmp eax, 3
ja case.default.0x4e240c
jmp dword [eax*4 + 0x4e258c]
cmp byte [ebp - 0x106], 1
jne 0x4e242d
mov ecx, 0xd
mov eax, 0x54bd6c
push ecx
push eax
jmp 0x4e2520
mov ecx, 0x13
mov eax, 0x54bd7c
push ecx
push eax
jmp 0x4e2520
cmp byte [ebp - 0x106], 1
jne 0x4e2458
mov ecx, 9
mov eax, 0x54bd90
push ecx
push eax
jmp 0x4e2520
mov ecx, 0x16
mov eax, 0x54bd9c
push ecx
push eax
jmp 0x4e2520
cmp byte [ebp - 0x106], 1
jne 0x4e24f9
push 0x118
lea eax, [ebp - 0x44c]
push 0
push eax
call fcn.004fce20
add esp, 0xc
mov dword [ebp - 0x450], 0x11c
push str.RtlGetVersion
push 0x54bc58
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x57fd3c], eax
test eax, eax
je 0x4e24eb
lea ecx, [ebp - 0x450]
push ecx
call eax
test eax, eax
jne 0x4e24eb
cmp dword [ebp - 0x44c], 0xa
ja 0x4e24ce
jb 0x4e24eb
cmp dword [ebp - 0x328], 0x55f0
mov ecx, 0x54bdc0
mov eax, esi
cmovb eax, ecx
mov ecx, 0xa
push ecx
push eax
jmp 0x4e2520
mov ecx, 9
mov eax, 0x54bdcc
push ecx
push eax
jmp 0x4e2520
mov ecx, 0x13
mov eax, 0x54bdd8
push ecx
push eax
jmp 0x4e2520
cmp byte [ebp - 0x106], 1
jne 0x4e2519
push 0xb
push 0x54bdec
jmp 0x4e2520
push 0x16
push str.Windows_Server_2012_R2
mov ecx, edi
call fcn.004df530
mov ecx, 0x54bdc0
cmp dword [ebp - 0x32c], 0
jne case.0x4e2318.7
cmp byte [ebp - 0x106], 1
jne 0x4e2550
cmp dword [ebp - 0x328], 0x55f0
push 0xa
cmovb esi, ecx
push esi
jmp 0x4e2557
push 0x25
push str.Windows_Server_2016_Technical_Preview
mov ecx, edi
call fcn.004df530
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e36f8
mov esp, ebp
pop ebp
ret 4