Function at 0x1400a7770
Capabilities:
Check os version
Get session user name
Get system information on windows

Disassembly:
sub rsp, 0x168
movzx eax, word [section..data]
mov word [rsp + 0x30], ax
mov dword [rsp + 0x38], 0x6426
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x3425
je 0x1400a77e4
cmp dword [rsp + 0x78], 0x5672
je 0x1400a77ac
jmp 0x1400a782f
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0xc8], eax
mov edx, 0xae
mov rcx, qword [rsp + 0xa8]
call sub.WINSPOOL.DRV_ScheduleJob
mov dword [rsp + 0xd8], eax
jmp 0x1400a782f
lea r9, [rsp + 0x38]
mov r8d, 0x63
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xb0]
call sub.WINSPOOL.DRV_WritePrinter
mov dword [rsp + 0x8c], eax
call fcn.1400a7770
movsx eax, word [section..data]
sub eax, 0x9a
mov word [rsp + 0x30], ax
movsx eax, word [section..data]
add eax, 0x7dc
mov word [rsp + 0x30], ax
movsx eax, word [rsp + 0x30]
and eax, 0x438
movsx ecx, word [section..data]
cmp eax, ecx
jl 0x1400a7897
mov edx, 0x55
mov ecx, 0x98
call fcn.1400a8950
mov eax, dword [rsp + 0x38]
shl eax, 2
mov dword [rsp + 0x38], eax
lea r9, [rsp + 0x30]
mov r8d, 0xa
mov edx, 0x44
mov rcx, qword [rsp + 0xe8]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0xe8], rax
call fcn.1400a7770
movsx eax, word [section..data]
sar eax, 0xa
mov word [rsp + 0x30], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x30]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0x388
je 0x1400a78f8
cmp dword [rsp + 0x7c], 0x708
je 0x1400a78c3
jmp 0x1400a79c1
movsx eax, word [rsp + 0x30]
or eax, 0x5cf
movsx ecx, word [section..data]
cmp eax, ecx
jl 0x1400a78f3
movsx eax, word [section..data]
xor eax, 0x772
mov word [rsp + 0x30], ax
movzx ecx, word [rsp + 0x30]
call fcn.1400a7ed0
jmp 0x1400a79c1
movsx eax, word [rsp + 0x30]
mov dword [rsp + 0x9c], eax
cmp dword [rsp + 0x9c], 0x77a
je 0x1400a7916
jmp 0x1400a799a
movsx eax, word [rsp + 0x30]
sub eax, 0x338
movsx ecx, word [section..data]
cmp eax, ecx
jg 0x1400a7972
movsx eax, word [section..data]
and eax, 0x1a0
mov word [rsp + 0x30], ax
lea r9, [rsp + 0x30]
mov r8d, 0x23
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
call sub.WINSPOOL.DRV_WritePrinter
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x38]
add eax, 0x67ba
mov dword [rsp + 0x38], eax
jmp 0x1400a7998
movsx eax, word [rsp + 0x30]
add eax, 0x35d
movsx ecx, word [section..data]
cmp eax, ecx
jg 0x1400a7998
movsx eax, word [section..data]
sub eax, 0x510
mov word [rsp + 0x30], ax
jmp 0x1400a79c1
lea r9, [rsp + 0x8c]
mov r8d, 0xf7
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xb0]
call sub.WINSPOOL.DRV_WritePrinter
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 0x3979
je 0x1400a79db
jmp 0x1400a79ee
movsx eax, word [section..data]
sub eax, 0x618
mov word [rsp + 0x30], ax
jmp 0x1400a7a58
mov byte [rsp + 0x34], 0x44
movsx eax, word [rsp + 0x30]
add eax, 0x591
movsx ecx, word [section..data]
cmp eax, ecx
je 0x1400a7a3a
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x60], eax
movabs rax, 0x781ebde5fa9d07
mov qword [rsp + 0x48], rax
movabs rax, 0x75f8646dfe6a89
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x58], rax
jmp 0x1400a7a58
cmp dword [rsp + 0x38], 0x382a
jg 0x1400a7a58
mov eax, dword [rsp + 0x38]
movzx ecx, al
mov eax, dword [rsp + 0x60]
shl eax, cl
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xb8], rax
movabs rax, 0x77c5ff2e20cbd3
cmp qword [rsp + 0xb8], rax
je 0x1400a7aa1
movabs rax, 0x7cce4ee38f80fc
cmp qword [rsp + 0xb8], rax
je 0x1400a7a92
jmp 0x1400a7b4c
movzx ecx, word [rsp + 0x30]
call fcn.1400a7ed0
jmp 0x1400a7b4c
movabs rax, 0x77cc15f5457d1e
mov rcx, qword [rsp + 0x48]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
movsx eax, byte [rsp + 0x34]
cmp eax, 0x74
jl 0x1400a7b4c
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0xa8]
call sub.WINSPOOL.DRV_FindNextPrinterChangeNotification
mov dword [rsp + 0xcc], eax
movsx eax, byte [rsp + 0x34]
xor eax, 0x3a
cmp eax, 0x64
jge 0x1400a7b13
mov r9, qword [rsp + 0x70]
movzx r8d, byte [rsp + 0x34]
mov dx, 0x5e
mov cx, 0x96
call fcn.1400a8030
jmp 0x1400a7b4c
mov eax, dword [rsp + 0x60]
cdq
mov rcx, qword [rsp + 0x58]
idiv dword [rcx]
cmp eax, dword [rsp + 0x38]
jle 0x1400a7b4c
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0xf0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x80], al
cmp byte [rsp + 0x80], 0x24
je 0x1400a7ba4
cmp byte [rsp + 0x80], 0x7e
je 0x1400a7b85
jmp 0x1400a7c6f
movabs rax, 0x7a6dc09c542aca
mov rcx, qword [rsp + 0x48]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
jmp 0x1400a7c6f
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xf8], rax
movabs rax, 0x7a85fc227b715e
cmp qword [rsp + 0xf8], rax
je 0x1400a7bc7
jmp 0x1400a7c3f
movabs rax, 0x772d970f4e5671
cmp qword [rsp + 0x48], rax
jae 0x1400a7bf2
movabs rax, 0x7049c9f6c072bf
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x30]
add eax, ecx
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9w, 0x9e
mov r8w, 0x87
mov edx, dword [rsp + 0x38]
mov cl, 0x48
call fcn.1400a87f0
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_GetMenuContextHelpId]
mov dword [rsp + 0x98], eax
jmp 0x1400a7c6f
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov r8w, 0xd3
mov edx, 0x46
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.USER32.dll_SetClassWord]
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x3c]
mov word [rsp + 0x40], ax
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc0], rax
movabs rax, 0x781ebde5fa9d07
cmp qword [rsp + 0xc0], rax
je 0x1400a7cc0
movabs rax, 0x7b61933e47bfc2
cmp qword [rsp + 0xc0], rax
je 0x1400a7d89
jmp 0x1400a7e1f
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0xd0], eax
mov rax, qword [rsp + 0x68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x30]
xor eax, ecx
movsx ecx, word [section..data]
cmp eax, ecx
jne 0x1400a7d0b
mov r8d, 1
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_UserHandleGrantAccess]
mov dword [rsp + 0x84], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x3c]
sar eax, 0x12
movzx ecx, word [rsp + 0x40]
cmp eax, ecx
jg 0x1400a7d84
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0x98], 0x4497
je 0x1400a7d84
movzx eax, word [rsp + 0x40]
mov word [rsp + 0xa0], ax
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x90], ax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x110], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov byte [rsp + 0x51], 0xe5
jmp 0x1400a7e1f
movzx eax, word [rsp + 0x3c]
add eax, 0x78
movzx ecx, word [rsp + 0x40]
cmp eax, ecx
jge 0x1400a7dff
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x88], al
cmp byte [rsp + 0x88], 5
je 0x1400a7dbc
cmp byte [rsp + 0x88], 0x18
je 0x1400a7dd8
jmp 0x1400a7dff
movabs rax, 0x736d298a16acd3
mov rcx, qword [rsp + 0x70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
jmp 0x1400a7dff
mov r9d, 0x54
mov r8d, 0xe7
mov edx, 0x4f
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov qword [rsp + 0x120], rax
mov r8d, 1
mov edx, 0x27
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.USER32.dll_EnableScrollBar]
mov dword [rsp + 0x8c], eax
movabs rax, 0x7cf2d3aa0a6b19
cmp qword [rsp + 0x70], rax
jne 0x1400a7e7c
mov rax, qword [rsp + 0x68]
movsx eax, word [rax]
movsx ecx, word [section..data]
and eax, ecx
mov word [rsp + 0x30], ax
movabs rax, 0x795769ec894158
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
call fcn.1400a7770
mov rax, qword [rsp + 0x68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x30]
add eax, ecx
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
movsx eax, word [rsp + 0x30]
movsx ecx, word [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
mov r9, qword [rsp + 0x70]
movzx r8d, byte [rsp + 0x34]
movzx edx, word [rsp + 0x3c]
movzx ecx, word [rsp + 0x40]
call fcn.1400a8030
movsx eax, word [section..data]
add rsp, 0x168
ret