Function at 0x4a94c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x5ed5b2
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x704dd8]
xor eax, esp
mov dword [esp + 0x148], eax
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov esi, dword [esp + 0x168]
lea eax, [esp + 0x14]
xor edi, edi
push eax
mov dword [esp + 0x164], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea ecx, [esp + 0x3c]
push edi
push ecx
call fcn.004e9ba0
add esp, 0xc
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0x5fd0cc
mov ecx, esi
mov word [esi + 4], ax
call fcn.00401c70
mov eax, dword [esp + 0x3c]
add eax, 0xfffffffc
mov ecx, 1
mov dword [esp + 0x160], edi
mov dword [esp + 0xc], ecx
cmp eax, 6
ja case.0x4a957f.7
jmp dword [eax*4 + 0x4a9758]
mov eax, dword [esp + 0x40]
cmp eax, edi
je 0x4a95be
cmp eax, 0xa
je 0x4a95ad
cmp eax, 0x5a
jne 0x4a9730
push str.Microsoft_Windows_Me
mov ecx, esi
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_98
mov ecx, esi
call fcn.00402960
jmp 0x4a9730
mov eax, dword [esp + 0x48]
cmp eax, 2
jne 0x4a95d8
push str.Microsoft_Windows_NT_4.0
mov ecx, esi
call fcn.00402960
jmp 0x4a9730
cmp eax, ecx
jne 0x4a9730
push str.Microsoft_Windows_95
mov ecx, esi
call fcn.00402960
jmp 0x4a9730
mov eax, dword [esp + 0x40]
sub eax, edi
je 0x4a9649
sub eax, ecx
je 0x4a9638
sub eax, ecx
jne 0x4a9730
cmp byte [esp + 0x152], cl
jne 0x4a9627
cmp word [esp + 0x14], 9
jne 0x4a9627
push str.Microsoft_Windows_XP_Professional_x64_Edition
mov ecx, esi
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_Server_2003
mov ecx, esi
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_XP
mov ecx, esi
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_2000
mov ecx, esi
call fcn.00402960
jmp 0x4a9730
mov eax, dword [esp + 0x40]
sub eax, edi
je 0x4a96dc
sub eax, ecx
je 0x4a96b9
sub eax, ecx
je 0x4a9693
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x4a9684
push str.Microsoft_Windows_8.1
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_Server_2012_R2
call fcn.00402960
jmp 0x4a9730
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x4a96ad
push str.Microsoft_Windows_8
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_Server_2012
call fcn.00402960
jmp 0x4a9730
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x4a96d0
push str.Microsoft_Windows_7
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_Server_2008_R2
call fcn.00402960
jmp 0x4a9730
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x4a96f3
push str.Microsoft_Windows_Vista
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_Server_2008
call fcn.00402960
jmp 0x4a9730
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x4a9716
push str.Microsoft_Windows_10_Insider_Preview
call fcn.00402960
jmp 0x4a9730
push str.Microsoft_Windows_Server_Technical_Preview
call fcn.00402960
jmp 0x4a9730
push 0x18
push 0x614a40
mov ecx, esi
call fcn.00401c70
mov eax, esi
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.004e8c89
add esp, 0x158
ret