Function at 0x42b990
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b5ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x62dc50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf8], 0
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
push 0x9c
push 0
lea ecx, [ebp - 0xf4]
push ecx
call fcn.0058c670
add esp, 0xc
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0xf4], 0x9c
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
setne cl
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
jne 0x42ba49
mov dword [ebp - 0xf4], 0x94
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
setne cl
mov byte [ebp - 0xd], cl
push 0x5f6d84
lea ecx, [ebp - 0x30]
call fcn.00404040
mov dword [ebp - 4], 0
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x42bcb7
lea eax, [ebp - 0x30]
push eax
mov edx, 0x5f6d94
call fcn.00409fc0
mov ecx, dword [ebp - 0xf0]
mov dword [ebp - 0x104], ecx
cmp dword [ebp - 0x104], 4
je 0x42baab
cmp dword [ebp - 0x104], 5
je 0x42bb29
cmp dword [ebp - 0x104], 6
je 0x42bbc3
jmp 0x42bca9
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0x108], edx
cmp dword [ebp - 0x108], 0
je 0x42bad4
cmp dword [ebp - 0x108], 1
je 0x42bb06
cmp dword [ebp - 0x108], 2
je 0x42bb16
jmp 0x42bb24
cmp dword [ebp - 0xe4], 2
jne 0x42baed
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_NT_4.0
call fcn.00409fc0
jmp 0x42bb04
cmp dword [ebp - 0xe4], 1
jne 0x42bb04
lea ecx, [ebp - 0x30]
push ecx
mov edx, str.Microsoft_Windows_95
call fcn.00409fc0
jmp 0x42bb24
lea edx, [ebp - 0x30]
push edx
mov edx, str.Microsoft_Windows_98
call fcn.00409fc0
jmp 0x42bb24
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_Me
call fcn.00409fc0
jmp 0x42bcb7
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0
je 0x42bb52
cmp dword [ebp - 0x10c], 1
je 0x42bb62
cmp dword [ebp - 0x10c], 2
je 0x42bb72
jmp 0x42bbbe
lea edx, [ebp - 0x30]
push edx
mov edx, str.Microsoft_Windows_2000
call fcn.00409fc0
jmp 0x42bbbe
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_XP
call fcn.00409fc0
jmp 0x42bbbe
movzx ecx, byte [ebp - 0x5a]
cmp ecx, 1
jne 0x42bb94
movzx edx, word [ebp - 0x54]
cmp edx, 9
jne 0x42bb94
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_XP_Professional_x64_Edition
call fcn.00409fc0
jmp 0x42bbbe
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x42bbb0
lea ecx, [ebp - 0x30]
push ecx
mov edx, str.Microsoft_Windows_Server_2003_R2
call fcn.00409fc0
jmp 0x42bbbe
lea edx, [ebp - 0x30]
push edx
mov edx, str.Microsoft_Windows_Server_2003
call fcn.00409fc0
jmp 0x42bcb7
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
ja case.default.0x42bbe2
mov ecx, dword [ebp - 0x110]
jmp dword [ecx*4 + 0x42bd00]
movzx edx, byte [ebp - 0x5a]
cmp edx, 1
jne 0x42bc02
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_Vista
call fcn.00409fc0
jmp 0x42bc10
lea ecx, [ebp - 0x30]
push ecx
mov edx, str.Microsoft_Windows_Server_2008
call fcn.00409fc0
jmp case.default.0x42bbe2
movzx edx, byte [ebp - 0x5a]
cmp edx, 1
jne 0x42bc2e
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_7
call fcn.00409fc0
jmp 0x42bc3c
lea ecx, [ebp - 0x30]
push ecx
mov edx, str.Microsoft_Windows_Server_2008_R2
call fcn.00409fc0
jmp case.default.0x42bbe2
movzx edx, byte [ebp - 0x5a]
cmp edx, 1
jne 0x42bc57
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_8
call fcn.00409fc0
jmp 0x42bc65
lea ecx, [ebp - 0x30]
push ecx
mov edx, str.Microsoft_Windows_Server_2012
call fcn.00409fc0
jmp case.default.0x42bbe2
movzx edx, byte [ebp - 0x5a]
cmp edx, 1
jne 0x42bc80
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_8.1
call fcn.00409fc0
jmp 0x42bc8e
lea ecx, [ebp - 0x30]
push ecx
mov edx, str.Microsoft_Windows_Server_2012_R2
call fcn.00409fc0
jmp case.default.0x42bbe2
movzx edx, byte [ebp - 0x5a]
cmp edx, 1
jne case.default.0x42bbe2
lea eax, [ebp - 0x30]
push eax
mov edx, str.Microsoft_Windows_10
call fcn.00409fc0
jmp 0x42bcb7
lea ecx, [ebp - 0x30]
push ecx
mov edx, str.Unknown_OS.
call fcn.00409fc0
lea edi, [ebp - 0x30]
mov eax, dword [ebp + 8]
call fcn.00404080
mov edx, dword [ebp - 0xf8]
or edx, 1
mov dword [ebp - 0xf8], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004040b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00587964
mov esp, ebp
pop ebp
ret