Function at 0x140055970
Capabilities:
Check os version
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0x128]
xor ebx, ebx
mov rsi, qword [rbp + 0x138]
mov r12d, r8d
mov edi, dword [rbp + 0x120]
mov r13d, edx
mov r14, rcx
mov qword [rbp - 0x50], rax
lea r8d, [rbx + 0x58]
mov qword [rbp - 0x48], rsi
xor edx, edx
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x50]
mov r15, r9
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea r8d, [rbx + 0x50]
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov dword [rsi], ebx
cmp edi, 0x3a
jbe 0x1400559fe
mov eax, 0x1d10
jmp 0x140055ddf
mov ecx, dword [r14 + 0x2c]
lea rsi, [rbp + 0x60]
test edi, edi
mov dword [rsp + 0x50], ecx
cmovne rsi, r15
call fcn.1400564c0
test al, al
jne 0x140055ddf
test byte [r14], 0x10
mov eax, 0x220020
mov ecx, 0x22000c
mov dword [rsp + 0x54], 0x48
cmove eax, ecx
mov byte [rsp + 0x58], 7
lea rcx, [rsp + 0x5e]
mov dword [rsp + 0x44], eax
mov edx, 2
call fcn.14004e230
movzx eax, byte [rsi]
lea rcx, [rsp + 0x66]
mov byte [rsp + 0x62], al
mov edx, 2
movzx eax, byte [rsi + 1]
mov byte [rsp + 0x63], al
movzx eax, byte [rsi + 2]
mov byte [rsp + 0x64], al
movzx eax, byte [rsi + 3]
mov byte [rsp + 0x65], al
mov byte [rsp + 0x60], r13b
mov byte [rsp + 0x61], r12b
call fcn.14004e230
lea rcx, [rsp + 0x68]
cmp edi, 4
jbe 0x140055ab5
lea r8d, [rdi - 4]
lea rdx, [rsi + 4]
call sub.VCRUNTIME140.dll_memcpy
mov edx, reloc.WSOCK32.dll_gethostname
sub edx, edi
test edx, edx
jle 0x140055abf
lea ecx, [rdi + 0xc]
lea rax, [rsp + 0x58]
add rcx, rax
jmp 0x140055aba
mov edx, gethostname
call fcn.14004e230
cmp edi, 4
jbe 0x140055ace
sub dil, 4
movzx eax, dil
jmp 0x140055ad0
mov eax, ebx
mov rcx, qword [r14 + 0x30]
lea rdx, [rbp - 0x70]
mov byte [rbp - 0x63], al
movzx eax, byte [rsp + 0x66]
mov byte [rbp - 0x62], al
movzx eax, byte [rsp + 0x67]
mov byte [rbp - 0x61], al
call fcn.140054400
mov edi, 4
lea rcx, [rbp - 0x70]
mov edx, edi
nop dword [rax + rax]
movzx eax, byte [rcx - 0x10]
xor byte [rcx], al
movzx eax, byte [rcx - 0xf]
xor byte [rcx + 1], al
movzx eax, byte [rcx - 0xe]
xor byte [rcx + 2], al
movzx eax, byte [rcx - 0xd]
xor byte [rcx + 3], al
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140055b00
mov rcx, qword [r14 + 0x30]
lea rdx, [rbp - 0x80]
call fcn.140054400
lea rcx, [rbp - 0x80]
mov rdx, rdi
nop dword [rax]
movzx eax, byte [rcx - 0x10]
xor byte [rcx], al
movzx eax, byte [rcx - 0xf]
xor byte [rcx + 1], al
movzx eax, byte [rcx - 0xe]
xor byte [rcx + 2], al
movzx eax, byte [rcx - 0xd]
xor byte [rcx + 3], al
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140055b40
mov rcx, qword [r14 + 0x30]
lea rdx, [rsp + 0x70]
call fcn.140054400
lea rcx, [rsp + 0x70]
nop dword [rax + rax]
movzx eax, byte [rcx - 0x10]
xor byte [rcx], al
movzx eax, byte [rcx - 0xf]
xor byte [rcx + 1], al
movzx eax, byte [rcx - 0xe]
xor byte [rcx + 2], al
movzx eax, byte [rcx - 0xd]
xor byte [rcx + 3], al
lea rcx, [rcx + 4]
sub rdi, 1
jne 0x140055b80
mov rcx, qword [r14 + 0x30]
lea rdx, [rsp + 0x60]
call fcn.140054400
lea rcx, [rsp + 0x58]
call fcn.1400649b0
mov r13, qword [rbp - 0x50]
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test r13, r13
jne 0x140055ca7
cmp dword [rbp - 0x30], 2
jne 0x140055bf3
cmp dword [rbp - 0x3c], 5
jne 0x140055bf3
lea rcx, str..GlobalSNTNLUSB
cmp dword [rbp - 0x38], ebx
je 0x140055bfa
lea rcx, str..SNTNLUSB
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call fcn.140065100
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140055c2f
mov edi, Ordinal_7430
jmp 0x140055dd3
mov edx, dword [rsp + 0x44]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov r9d, 0x58
mov dword [rsp + 0x28], ebx
mov rcx, r15
mov qword [rsp + 0x20], rbx
call fcn.140065a30
test eax, eax
jne 0x140055c97
call fcn.1400660f0
cmp eax, 6
jne 0x140055c81
mov edi, 0x1d43
mov rcx, r15
movzx ebx, di
call fcn.140065350
jmp 0x140055dd3
call fcn.1400660f0
cmp eax, 0x39
mov ebx, 0x1d0d
mov edx, 0x1d6d
cmove bx, dx
mov rcx, r15
call fcn.140065350
movzx edi, bx
jmp 0x140055dd3
cmp dword [rbp - 0x30], 2
jne 0x140055cbf
cmp dword [rbp - 0x3c], 5
jne 0x140055cbf
lea rcx, str..GlobalSNTNLUSB
cmp dword [rbp - 0x38], ebx
je 0x140055cc6
lea rcx, str..SNTNLUSB
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call fcn.140065100
mov r15, rax
mov esi, 0x1d0d
cmp rax, 0xffffffffffffffff
jne 0x140055cfb
lea edi, [rsi - 0xa]
jmp 0x140055d67
mov edx, dword [rsp + 0x44]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov r9d, 0x58
lea rax, [rbp + 0x60]
mov dword [rsp + 0x28], 0x48
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.140065a30
test eax, eax
je 0x140055d3b
movzx edi, bx
jmp 0x140055d5f
call fcn.1400660f0
cmp eax, 6
jne 0x140055d4c
mov edi, 0x1d43
jmp 0x140055d5f
call fcn.1400660f0
cmp eax, 0x39
mov edi, esi
mov edx, 0x1d6d
cmove di, dx
mov rcx, r15
call fcn.140065350
movzx eax, dil
test dil, dil
jne 0x140055dd3
cmp dword [rsp + 0x40], 0x48
je 0x140055d85
mov ecx, dword [r14 + 0x2c]
call fcn.140056a90
movzx eax, si
jmp 0x140055ddf
mov rdx, qword [r14 + 0x30]
lea rcx, [rbp + 0x60]
call fcn.140056bd0
movzx edi, ax
test al, al
jne 0x140055dd3
mov rax, qword [rbp - 0x48]
mov r8, r13
mov edx, dword [rbp + 0x130]
mov dword [rax], edx
test edx, edx
je 0x140055dc3
lea eax, [rbx + 2]
dec edx
movzx eax, byte [rbp + rax + 0x60]
inc ebx
mov byte [r8], al
inc r8
cmp ebx, 4
jb 0x140055da8
mov r8d, edx
lea rcx, [r13 + 4]
lea rdx, [rbp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [r14 + 0x2c]
call fcn.140056a90
movzx eax, di
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140077b10
mov rbx, qword [rsp + 0x208]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret