Function at 0x1400c9a60
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x220
mov rax, qword [0x14017c820]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rbx, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x9c
call fcn.1400f1600
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1400c9adf
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, DllRegisterServer
call fcn.1400f1600
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400c9fdf
movzx eax, word [rsp + 0x104]
mov r8d, dword [rsp + 0x80]
mov edx, dword [rsp + 0x74]
test r8d, r8d
mov ecx, dword [rsp + 0x78]
mov dword [rbx + 0x1c], eax
movzx eax, word [rsp + 0x106]
mov dword [rbx + 0x10], r8d
mov dword [rbx + 0x14], edx
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x18], ecx
je 0x1400c9fc5
sub r8d, 1
je 0x1400c9f33
cmp r8d, 1
jne 0x1400c9fda
cmp edx, 4
ja 0x1400c9b4b
lea r8, str.Microsoft_Windows_NT
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
call fcn.1400f27f0
jmp 0x1400c9cf0
cmp edx, 5
jne 0x1400c9c25
test ecx, ecx
jne 0x1400c9b61
lea r8, str.Microsoft_Windows_2000
jmp 0x1400c9b38
cmp ecx, 1
jne 0x1400c9bcc
mov rcx, qword [rbx + 0x28]
lea r8, str.Microsoft_Windows_XP
mov edx, 0x400
call fcn.1400f27f0
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400c9b9f
mov rcx, qword [rbx + 0x28]
lea r8, str.Media_Center_Edition
mov edx, 0x400
call fcn.14002c340
mov ecx, 0x56
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400c9cf0
mov rcx, qword [rbx + 0x28]
lea r8, str.Tablet_PC_Edition
mov edx, 0x400
call fcn.14002c340
jmp 0x1400c9cf0
cmp ecx, 2
jne 0x1400c9c1a
cmp byte [rsp + 0x10a], 1
jne 0x1400c9c0e
cmp word [rsp + 0x38], 6
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
jne 0x1400c9bfd
lea r8, str.Microsoft_Windows_XP_IA64
call fcn.1400f27f0
jmp 0x1400c9cf0
lea r8, str.Microsoft_Windows_XP_x64
call fcn.1400f27f0
jmp 0x1400c9cf0
lea r8, str.Microsoft_Windows_Server_2003
jmp 0x1400c9b38
mov r9d, 5
jmp 0x1400c9cd7
cmp edx, 6
jne 0x1400c9cd4
test ecx, ecx
jne 0x1400c9c6a
cmp byte [rsp + 0x10a], 1
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
jne 0x1400c9c61
lea r8, str.Microsoft_Windows_Vista___d._d_
mov r9d, 6
mov dword [rsp + 0x20], 0
call fcn.14002c260
jmp 0x1400c9caa
lea r8, str.Microsoft_Windows_Server_2008
jmp 0x1400c9ca5
cmp ecx, 1
jne 0x1400c9cb2
cmp byte [rsp + 0x10a], 1
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
jne 0x1400c9c9e
lea r8, str.Microsoft_Windows_7___d._d_
mov r9d, 6
mov dword [rsp + 0x20], 1
call fcn.14002c260
jmp 0x1400c9caa
lea r8, str.Microsoft_Windows_Server_2008_R2
call fcn.1400f27f0
mov edx, dword [rsp + 0x74]
mov ecx, dword [rsp + 0x78]
movzx eax, word [rsp + 0x106]
movzx r9d, word [rsp + 0x104]
mov r8d, ecx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.1400c9890
jmp 0x1400c9cf0
mov r9d, edx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbx + 0x28]
lea r8, str.Microsoft_Windows_NT_d._d
mov edx, 0x400
call fcn.14002c260
movzx eax, byte [rsp + 0x10a]
cmp al, 1
jne 0x1400c9d47
cmp dword [rsp + 0x74], 4
jne 0x1400c9d0f
lea r8, str.Workstation_4.0
jmp 0x1400c9e29
cmp dword [rsp + 0x74], 5
jne 0x1400c9e37
bt word [rsp + 0x108], 9
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
jae 0x1400c9d3b
lea r8, str.Home_Edition
jmp 0x1400c9e32
lea r8, str.Professional
jmp 0x1400c9e32
cmp al, 3
je 0x1400c9d53
cmp al, 2
jne 0x1400c9e37
cmp dword [rsp + 0x74], 5
jne 0x1400c9e06
mov eax, dword [rsp + 0x78]
cmp eax, 2
jne 0x1400c9dca
movzx eax, byte [rsp + 0x108]
test al, al
jns 0x1400c9d7f
lea r8, str.Datacenter_Edition
jmp 0x1400c9e29
test al, 2
je 0x1400c9d8f
lea r8, str.Enterprise_Edition
jmp 0x1400c9e29
movzx eax, word [rsp + 0x108]
cmp ax, 0x400
jne 0x1400c9da9
lea r8, str.Web_Edition
jmp 0x1400c9e29
cmp ax, 1
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
jne 0x1400c9dc1
lea r8, str.Small_Business_Edition
jmp 0x1400c9e32
lea r8, str.Standard_Edition
jmp 0x1400c9e32
test eax, eax
jne 0x1400c9eee
movzx eax, byte [rsp + 0x108]
test al, al
jns 0x1400c9de7
lea r8, str.Datacenter_Server
jmp 0x1400c9e29
test al, 2
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
je 0x1400c9dfd
lea r8, str.Advanced_Server
jmp 0x1400c9e32
lea r8, str.Server
jmp 0x1400c9e32
cmp dword [rsp + 0x74], 4
ja 0x1400c9eee
test byte [rsp + 0x108], 2
lea r8, str.Server_4.0__Enterprise_Edition
jne 0x1400c9e29
lea r8, str.Server_4.0
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
call fcn.14002c340
cmp dword [rsp + 0x74], 4
jne 0x1400c9eee
lea rdx, str.Service_Pack_6
lea rcx, [rsp + 0x84]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400c9eee
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, 0x100
lea rcx, [rsp + 0x110]
test eax, eax
jne 0x1400c9eab
movzx r9d, word [rsp + 0x7c]
lea r8, str.Service_Pack_6a__Build__d_
call fcn.14002c260
jmp 0x1400c9ec8
movzx eax, word [rsp + 0x7c]
lea r9, [rsp + 0x84]
lea r8, str._s__Build__d_
mov dword [rsp + 0x20], eax
call fcn.14002c260
mov rcx, qword [rbx + 0x30]
lea r8, [rsp + 0x110]
mov edx, 0x200
call fcn.14002c260
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c9fda
movzx eax, word [rsp + 0x7c]
lea r9, [rsp + 0x84]
lea r8, str._s__Build__d_
lea rcx, [rsp + 0x110]
mov edx, 0x100
mov dword [rsp + 0x20], eax
call fcn.14002c260
mov rcx, qword [rbx + 0x30]
lea r8, [rsp + 0x110]
mov edx, 0x200
call fcn.14002c260
jmp 0x1400c9fda
cmp edx, 4
jne 0x1400c9fbc
test ecx, ecx
jne 0x1400c9f73
mov rcx, qword [rbx + 0x28]
lea r8, str.Microsoft_Windows_95
mov edx, 0x400
call fcn.1400f27f0
movzx r11d, byte [rsp + 0x85]
cmp r11b, 0x43
je 0x1400c9f6a
cmp r11b, 0x42
jne 0x1400c9fda
lea r8, str._OSR2
jmp 0x1400c9f9e
cmp ecx, 0xa
jne 0x1400c9fae
mov rcx, qword [rbx + 0x28]
lea r8, str.Microsoft_Windows_98
mov edx, 0x400
call fcn.1400f27f0
cmp byte [rsp + 0x85], 0x41
jne 0x1400c9fda
lea r8, str._SE
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
call fcn.14002c340
jmp 0x1400c9fda
cmp ecx, 0x5a
jne 0x1400c9fda
lea r8, str.Microsoft_Windows_Millennium_Edition
jmp 0x1400c9fcc
lea r8, str.Microsoft_Windows_9x
jmp 0x1400c9fcc
lea r8, str.Microsoft_Win32s
mov rcx, qword [rbx + 0x28]
mov edx, 0x400
call fcn.1400f27f0
mov eax, 1
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1400efff0
add rsp, 0x220
pop rbx
ret