This function appears to truncate the service pack info for Windows 7 (6.1):
"Windows NT Version 6.1 (Build 7601) Service Pack 1 x86" became:
"Windows NT Version 6.1 (Build 7601) S x86"

Don't close the handle to ntdll.dll (hey, that's stupid filename, Microsoft!)
since the module could be unloaded from the address space and then a call to
the captured procedure address could/would crash. This handle will be closed
when the process terminates anyway.

While we're here, correct the Windows 6.1 -> 7.0 numbering. That looks better:
"Windows NT Version 7.0 (Build 7601) Service Pack 1 x86"

Something should probably be done for Windows 6.2 -> 8.0 numbering too, but I
don't have a VM handy. Is anyone actually still running Windows 8.x?