Function at 0x4a06e0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x1e8
push ebp
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x47
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4a0725
pop edi
mov eax, 1
pop ebp
add esp, 0x1e8
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x4a074d
lea ecx, [esp + 0x10]
push ecx
call eax
jmp 0x4a0758
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x44], 2
jne 0x4a0b56
cmp dword [esp + 0x38], 4
jbe 0x4a0b56
push ebx
push esi
mov esi, dword [esp + 0x1fc]
push str.Microsoft
push 0x100
push esi
call fcn.004a0c40
mov eax, dword [esp + 0x40]
mov ebx, 1
cmp eax, 6
jne case.0x4a0823.5
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4a07c1
cmp byte [esp + 0x156], bl
jne 0x4a07b1
push str.Windows_Vista
jmp 0x4a07b6
push str.Windows_Server_2008
push 0x100
push esi
call fcn.004a0ca0
cmp dword [esp + 0x44], ebx
jne 0x4a07e7
cmp byte [esp + 0x156], bl
jne 0x4a07d7
push str.Windows_7
jmp 0x4a07dc
push str.Windows_Server_2008_R2
push 0x100
push esi
call fcn.004a0ca0
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebp
test eax, eax
je case.0x4a0823.5
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x44]
push 0
push 0
push edx
push ecx
call eax
mov edx, dword [esp + 0x14]
lea eax, [edx - 1]
cmp eax, 0x18
ja case.0x4a0823.5
jmp dword [eax*4 + 0x4a0b64]
push str.Ultimate_Edition
jmp 0x4a0898
push str.Home_Premium_Edition
jmp 0x4a0898
push str.Home_Basic_Edition
jmp 0x4a0898
push str.Business_Edition
jmp 0x4a0898
push str.Starter_Edition
jmp 0x4a0898
push str.Cluster_Server_Edition
jmp 0x4a0898
push str.Datacenter_Edition
jmp 0x4a0898
push str.Datacenter_Edition__core_installation_
jmp 0x4a0898
push str.Enterprise_Edition
jmp 0x4a0898
push str.Enterprise_Edition__core_installation_
jmp 0x4a0898
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4a0898
push str.Small_Business_Server
jmp 0x4a0898
push str.Small_Business_Server_Premium_Edition
jmp 0x4a0898
push str.Standard_Edition
jmp 0x4a0898
push str.Standard_Edition__core_installation_
jmp 0x4a0898
push str.Web_Server_Edition
push 0x100
push esi
call fcn.004a0ca0
mov eax, dword [esp + 0x40]
mov edi, 5
cmp eax, edi
jne 0x4a0a86
cmp dword [esp + 0x44], 2
jne 0x4a09c9
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4a08d2
push str.Windows_Server_2003_R2_
jmp 0x4a0910
mov eax, dword [esp + 0x154]
cmp ax, 0x2000
jne 0x4a08e6
push str.Windows_Storage_Server_2003
jmp 0x4a0910
cmp ax, 0x8000
jne 0x4a08f3
push str.Windows_Home_Server
jmp 0x4a0910
cmp byte [esp + 0x156], bl
jne 0x4a090b
cmp word [esp + 0x18], 9
jne 0x4a090b
push str.Windows_XP_Professional_x64_Edition
jmp 0x4a0910
push str.Windows_Server_2003_
push 0x100
push esi
call fcn.004a0ca0
cmp byte [esp + 0x156], bl
je 0x4a09bf
mov ax, word [esp + 0x18]
cmp ax, 6
jne 0x4a0950
mov al, byte [esp + 0x154]
test al, 0x80
je 0x4a0945
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x4a09b4
test al, 2
je 0x4a09bf
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4a09b4
cmp ax, 9
jne 0x4a097a
mov al, byte [esp + 0x154]
test al, 0x80
je 0x4a0968
push str.Datacenter_x64_Edition
jmp 0x4a09b4
test al, 2
je 0x4a0973
push str.Enterprise_x64_Edition
jmp 0x4a09b4
push str.Standard_x64_Edition
jmp 0x4a09b4
mov eax, dword [esp + 0x154]
test ah, 0x40
je 0x4a098d
push str.Compute_Cluster_Edition
jmp 0x4a09b4
test al, 0x80
je 0x4a0998
push str.Datacenter_Edition
jmp 0x4a09b4
test al, 2
je 0x4a09a3
push str.Enterprise_Edition
jmp 0x4a09b4
test ah, 4
je 0x4a09af
push str.Web_Edition
jmp 0x4a09b4
push str.Standard_Edition
push 0x100
push esi
call fcn.004a0ca0
cmp dword [esp + 0x40], edi
jne 0x4a0a86
cmp dword [esp + 0x44], ebx
jne 0x4a0a08
push str.Windows_XP
push 0x100
push esi
call fcn.004a0ca0
mov eax, dword [esp + 0x154]
test ah, 2
je 0x4a09f2
push str.Home_Edition
jmp 0x4a09f7
push str.Professional
push 0x100
push esi
call fcn.004a0ca0
cmp dword [esp + 0x40], edi
jne 0x4a0a86
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4a0a86
push str.Windows_2000
push 0x100
push esi
call fcn.004a0ca0
cmp byte [esp + 0x156], bl
jne 0x4a0a59
lea eax, [esp + 0x10]
push eax
push 0x100
push esi
call fcn.004a0d50
test eax, eax
jl 0x4a0a86
mov eax, dword [esp + 0x10]
mov ecx, 0x100
sub ecx, eax
push str.Professional
lea edx, [esi + eax*2]
push ecx
push edx
call fcn.004a0c40
jmp 0x4a0a86
mov al, byte [esp + 0x154]
test al, 0x80
je 0x4a0a6b
push str.Datacenter_Server
jmp 0x4a0a7b
test al, 2
je 0x4a0a76
push str.Advanced_Server
jmp 0x4a0a7b
push str.Server
push 0x100
push esi
call fcn.004a0ca0
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x4a0ad6
lea ecx, [esp + 0x10]
push ecx
push 0x100
push esi
call fcn.004a0d50
test eax, eax
jl 0x4a0ac6
mov eax, dword [esp + 0x10]
mov edx, 0x100
sub edx, eax
push 0x4e61c4
lea eax, [esi + eax*2]
push edx
push eax
call fcn.004a0c40
lea ecx, [esp + 0x50]
push ecx
push 0x100
push esi
call fcn.004a0ca0
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x158]
push edx
push str.__build__d_
push 0x50
push eax
call fcn.004a0bd0
add esp, 0x10
lea ecx, [esp + 0x158]
push ecx
push 0x100
push esi
call fcn.004a0ca0
cmp dword [esp + 0x40], 6
jb 0x4a0b49
mov ax, word [esp + 0x18]
cmp ax, 9
jne 0x4a0b34
push str.__64_bit
push 0x100
push esi
call fcn.004a0ca0
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x1e8
ret
test ax, ax
jne 0x4a0b49
push str.__32_bit
push 0x100
push esi
call fcn.004a0ca0
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x1e8
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x1e8
ret