Function at 0x492e70
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x58a042
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x150], eax
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
xor edi, edi
lea eax, [esp + 0x18]
mov dword [esp + 0x168], edi
mov esi, ecx
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea ecx, [esp + 0x40]
push edi
push ecx
call fcn.0052e300
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0x59b2fc
mov word [esi + 4], ax
call fcn.00406150
mov dword [esp + 0x168], edi
mov eax, dword [esp + 0x40]
add eax, 0xfffffffc
mov ecx, 1
mov dword [esp + 0x10], ecx
cmp eax, 6
ja case.0x492f28.7
jmp dword [eax*4 + 0x49310c]
mov eax, dword [esp + 0x44]
cmp eax, edi
je 0x492f65
cmp eax, 0xa
je 0x492f55
cmp eax, 0x5a
jne 0x4930e4
push esi
mov edx, str.Microsoft_Windows_Me
call fcn.00403880
jmp 0x4930e4
push esi
mov edx, str.Microsoft_Windows_98
call fcn.00403880
jmp 0x4930e4
mov eax, dword [esp + 0x4c]
cmp eax, 2
jne 0x492f7e
push esi
mov edx, str.Microsoft_Windows_NT_4.0
call fcn.00403880
jmp 0x4930e4
cmp eax, ecx
jne 0x4930e4
push esi
mov edx, str.Microsoft_Windows_95
call fcn.00403880
jmp 0x4930e4
mov eax, dword [esp + 0x44]
sub eax, edi
je 0x492feb
sub eax, ecx
je 0x492fdb
sub eax, ecx
jne 0x4930e4
cmp byte [esp + 0x156], cl
jne 0x492fcb
cmp word [esp + 0x18], 9
jne 0x492fcb
push esi
mov edx, str.Microsoft_Windows_XP_Professional_x64_Edition
call fcn.00403880
jmp 0x4930e4
push esi
mov edx, str.Microsoft_Windows_Server_2003
call fcn.00403880
jmp 0x4930e4
push esi
mov edx, str.Microsoft_Windows_XP
call fcn.00403880
jmp 0x4930e4
push esi
mov edx, str.Microsoft_Windows_2000
call fcn.00403880
jmp 0x4930e4
mov eax, dword [esp + 0x44]
sub eax, edi
je 0x493094
sub eax, ecx
je 0x493072
sub eax, ecx
je 0x493037
push esi
cmp byte [esp + 0x15a], cl
jne 0x493028
mov edx, str.Microsoft_Windows_8.1
call fcn.00403880
jmp 0x4930e4
mov edx, str.Microsoft_Windows_Server_2012_R2
call fcn.00403880
jmp 0x4930e4
cmp byte [esp + 0x156], cl
jne 0x493065
call fcn.00493130
push esi
test eax, eax
je 0x493059
mov edx, str.Microsoft_Windows_10
call fcn.00403880
jmp 0x4930e4
mov edx, str.Microsoft_Windows_8
call fcn.00403880
jmp 0x4930e4
push esi
mov edx, str.Microsoft_Windows_Server_2012
call fcn.00403880
jmp 0x4930e4
push esi
cmp byte [esp + 0x15a], cl
jne 0x493088
mov edx, str.Microsoft_Windows_7
call fcn.00403880
jmp 0x4930e4
mov edx, str.Microsoft_Windows_Server_2008_R2
call fcn.00403880
jmp 0x4930e4
push esi
cmp byte [esp + 0x15a], cl
jne 0x4930aa
mov edx, str.Microsoft_Windows_Vista
call fcn.00403880
jmp 0x4930e4
mov edx, str.Microsoft_Windows_Server_2008
call fcn.00403880
jmp 0x4930e4
push esi
cmp byte [esp + 0x15a], cl
jne 0x4930cc
mov edx, str.Microsoft_Windows_10_Insider_Preview
call fcn.00403880
jmp 0x4930e4
mov edx, str.Microsoft_Windows_Server_Technical_Preview
call fcn.00403880
jmp 0x4930e4
push 0x18
push str.Unknown_Operating_System
call fcn.00406150
mov eax, esi
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.005273c3
add esp, 0x160
ret