Function at 0x4e0870
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
push str.RtlGetVersion
push 0x549d68
mov dword [ebp - 0x220], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x110
mov esi, eax
lea eax, [ebp - 0x330]
push 0
push eax
call fcn.004fb430
add esp, 0xc
mov dword [ebp - 0x334], 0x114
lea eax, [ebp - 0x334]
push eax
call esi
push 0x18
push str.unknown_OperatingSystem.
mov ecx, edi
mov esi, eax
call fcn.0040c552
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je case.0x4e095e.7
test esi, esi
jne case.0x4e095e.7
push 0x100
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.004fb430
push dword [ebp - 0x218]
lea eax, [ebp - 0x104]
push dword [ebp - 0x21c]
push str._d__d
push eax
call fcn.00402be8
lea eax, [ebp - 0x104]
push eax
call fcn.00428378
mov eax, dword [ebp - 0x330]
add esp, 0x20
add eax, 0xfffffffc
cmp eax, 6
ja case.0x4e095e.7
jmp dword [eax*4 + 0x4e0b28]
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x4e0991
cmp eax, 0xa
je 0x4e0987
cmp eax, 0x5a
jne case.0x4e095e.7
push str.Microsoft_Windows_Me
jmp 0x4e0b0d
push str.Microsoft_Windows_98
jmp 0x4e0b0d
mov eax, dword [ebp - 0x210]
cmp eax, 2
jne 0x4e09a6
push str.Microsoft_Windows_NT_4.0
jmp 0x4e0b0d
cmp eax, 1
jne case.0x4e095e.7
push str.Microsoft_Windows_95
jmp 0x4e0b0d
mov eax, dword [ebp - 0x32c]
sub eax, 0
je 0x4e0a27
sub eax, 1
je 0x4e0a1d
sub eax, 1
jne case.0x4e095e.7
cmp byte [ebp - 0x106], 1
jne 0x4e09ef
cmp word [ebp - 0x358], 9
jne 0x4e09ef
push str.Windows_XP_Professional_x64_Edition
jmp 0x4e0b0d
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x4e0a07
push str.Windows_Server_2003
jmp 0x4e0b0d
push 0x59
call esi
test eax, eax
je case.0x4e095e.7
push str.Windows_Server_2003_R2
jmp 0x4e0b0d
push str.Windows_XP
jmp 0x4e0b0d
push str.Windows_2000
jmp 0x4e0b0d
mov eax, dword [ebp - 0x32c]
cmp eax, 3
ja case.default.0x4e0a40
jmp dword [eax*4 + 0x4e0b44]
cmp byte [ebp - 0x106], 1
mov ecx, edi
jne 0x4e0a59
push str.Windows_Vista
jmp 0x4e0ad5
push str.Windows_Server_2008
jmp 0x4e0ad5
cmp byte [ebp - 0x106], 1
mov ecx, edi
jne 0x4e0a72
push str.Windows_7
jmp 0x4e0ad5
push str.Windows_Server_2008_R2
jmp 0x4e0ad5
cmp byte [ebp - 0x106], 1
jne 0x4e0ab7
push 0
push 0
push 0xa
call fcn.004e0e70
add esp, 0xc
test al, al
je 0x4e0ab0
cmp dword [ebp - 0x328], 0x55f0
mov ecx, edi
jb 0x4e0aa9
push str.Windows_11
jmp 0x4e0ad5
push str.Windows_10
jmp 0x4e0ad5
push str.Windows_8
jmp 0x4e0ad3
push str.Windows_Server_2012
jmp 0x4e0ad3
cmp byte [ebp - 0x106], 1
jne 0x4e0ace
push str.Windows_8.1
jmp 0x4e0ad3
push str.Windows_Server_2012_R2
mov ecx, edi
call fcn.00409b92
cmp dword [ebp - 0x32c], 0
jne case.0x4e095e.7
cmp byte [ebp - 0x106], 1
jne 0x4e0b08
cmp dword [ebp - 0x328], 0x55f0
mov ecx, edi
jb 0x4e0b01
push str.Windows_11
jmp 0x4e0b0f
push str.Windows_10
jmp 0x4e0b0f
push str.Windows_Server_2016_Technical_Preview
mov ecx, edi
call fcn.00409b92
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e1d28
mov esp, ebp
pop ebp
ret 4