Function at 0x140026a70
Capabilities:
Check os version
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov cl, 0xeb
mov byte [rsp + 0x24], 0xdc
mov dword [rsp + 0xa0], ecx
mov edi, 0xb0
call qword [sym.imp.USER32.dll_CloseClipboard]
movsx ecx, byte [0x140042b88]
lea r8d, [rdi - 0x32]
mov r10d, dword [0x140042a88]
movzx eax, cl
sar al, 1
mov r11d, ecx
movsx r9d, al
nop dword [rax + rax]
mov ecx, r11d
mov eax, 0xaaaaaaab
imul ecx, edi
and r10d, r9d
mul ecx
mov edi, edx
shr edi, 1
sub r8, 1
jne 0x140026ac0
movsx eax, byte [0x140042b64]
mov edx, dword [0x140042b34]
mov ecx, eax
mov r9d, dword [0x140042b78]
xor ecx, 0xffffffdf
mov r8d, dword [0x140042b60]
mov dword [rsp + 0x90], eax
mov eax, 0x145
mov dword [rsp + 0x98], edx
xor edx, 0x74
mov dword [rsp + 0xa8], edi
nop word [rax + rax]
or r9d, ecx
or r8d, edx
sub rax, 1
jne 0x140026b20
mov ecx, dword [0x140042b28]
mov eax, 0x1ae
mov r11d, dword [0x140042b7c]
add ecx, 0x6c
mov dword [rsp + 0x38], r9d
xor r11d, ecx
sub rax, 1
jne 0x140026b46
movzx ecx, byte [0x140042a86]
xor ebx, ebx
mov ebp, dword [0x140042a8c]
test ebp, ebp
movzx r12d, byte [0x140042b40]
mov esi, dword [0x140042b2c]
setne al
xor byte [0x140042a63], al
lea r15d, [rbx + 0x41]
movsx eax, byte [0x140042b67]
add esi, 0x7d
imul edx, eax, 0x2a
mov eax, ecx
and eax, 0x1d5
mov dword [rsp + 0x34], r11d
xor eax, 0x60
mov byte [0x140042b88], bl
or eax, dword [0x140042b68]
mov dword [rsp + 0x3c], eax
shr edx, 2
add r12b, dl
mov dword [rsp + 0x30], edx
imul edx, ecx, 0xffffff9f
or r12b, 0x3c
mov dword [0x140042b84], ebx
and edx, 0x80000003
jge 0x140026bcd
dec edx
or edx, 0xfffffffc
inc edx
cmp dword [0x140042b6c], ebx
mov eax, ebx
mov r13d, dword [0x140042b58]
mov r11d, 0xdc
movzx r14d, byte [0x140042b66]
sete al
mov edi, dword [rsp + 0x90]
sub eax, ebp
movzx ebp, byte [0x140042b80]
sub eax, 0x36
movsx r9d, byte [0x140042b67]
mov bl, 0x6c
imul eax, eax, 0x41
add dword [0x140042b38], eax
mov ecx, esi
mov eax, r11d
shl eax, cl
sub bpl, r12b
xor eax, 5
movzx ecx, bl
add eax, r9d
xor r14b, 1
and r13d, eax
movzx ebx, dl
mov eax, edi
sar eax, cl
and eax, 5
add r8d, eax
sub r15d, 1
jne 0x140026c13
movzx r12d, byte [rsp + 0x30]
mov ebx, r15d
mov edi, dword [rsp + 0xa8]
mov ecx, r12d
imul ecx, dword [0x140042b30]
mov eax, r12d
mov r9d, dword [rsp + 0x38]
or eax, 0xffffffca
mov r11d, dword [rsp + 0x34]
and r10d, eax
mov byte [rsp + 0x90], dl
mov eax, 0xcccccccd
mov dword [0x140042b60], r8d
mul ecx
mov byte [0x140042b80], bpl
shr edx, 2
mov byte [0x140042b66], r14b
mov dword [0x140042a88], r10d
lea eax, [rdx + rdx*4]
sub ecx, eax
movzx eax, byte [0x140042b57]
mov dword [rsp + 0x28], ecx
test al, al
je 0x140026cb6
lea r14d, [r15 + 1]
test esi, esi
js 0x140026cb9
mov r14d, ebx
mov r15d, dword [rsp + 0x98]
mov ebp, dword [0x140042a64]
add r15b, 0x7d
mov dword [rsp + 0x98], r15d
movzx r13d, r15b
mov byte [0x140042b81], bl
test esi, esi
je 0x140026cf4
mov r10d, ebp
and r10d, 0x1f4
mov dword [0x140042b44], r10d
jmp 0x140026cfb
mov r10d, dword [0x140042b44]
movzx eax, al
imul edx, eax, 0x3c
mov eax, 0xaaaaaaab
mov dword [rsp + 0x20], edx
mul edx
shr edx, 1
lea eax, [rdx + rdx*2]
sub dword [rsp + 0x20], eax
movzx eax, byte [0x140042a86]
shr al, cl
test al, al
jne 0x140026d2c
cmp dword [0x140042b68], ebx
mov eax, ebx
je 0x140026d31
mov eax, 1
movsx ecx, byte [rsp + 0x90]
or r11d, eax
mov eax, ecx
mov dword [0x140042b7c], r11d
add eax, 0x3c
mov dword [rsp + 0x2c], ecx
xor eax, edi
and eax, dword [0x140042b38]
add r14d, eax
movzx eax, byte [0x140042b54]
shl al, 5
add byte [0x140042b64], al
mov eax, r12d
and eax, 0x140
mov dword [0x140042b58], r14d
sub r9d, eax
lea eax, [r8 - 0x6c]
or r9d, eax
cmp byte [0x140042b65], bl
mov dword [0x140042b78], r9d
je 0x140026d9f
cmp cl, 5
je 0x140026d9f
mov eax, 1
cmp r10d, 0x2a
je 0x140026da1
mov eax, ebx
mov r8d, dword [rsp + 0x3c]
or ebp, eax
imul edx, r8d, 0xffffffeb
mov eax, 0xcccccccd
mov dword [0x140042a64], ebp
mul edx
mov r12d, edx
shr r12d, 2
mov dword [rsp + 0xa8], r12d
test r10d, r10d
je 0x140026de1
mov ecx, r9d
mov eax, 0xc7
shl eax, cl
cmp eax, 2
mov eax, 1
jne 0x140026de3
mov eax, ebx
or r8d, eax
mov dword [0x140042b28], r8d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call qword [sym.imp.KERNEL32.dll_GetVersion]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, byte [0x140042a86]
cmp r15b, 0xca
movsx r14d, byte [0x140042b88]
mov r9d, ebx
sete r9b
imul r8d, eax, 0xffffffeb
or r9d, r14d
and r8d, 0x80000003
mov dword [rsp + 0x34], r8d
jge 0x140026e3d
dec r8d
or r8d, 0xfffffffc
inc r8d
mov dword [rsp + 0x34], r8d
mov r11d, dword [0x140042b48]
mov ebp, 0x224
mov edi, dword [0x140042b2c]
mov r8b, 0x94
movzx r14d, byte [0x140042a62]
mov ecx, dword [0x140042b60]
mov r12d, dword [0x140042b38]
movsx edx, r15b
mov r15d, dword [0x140042b68]
mov dword [rsp + 0x38], edx
cmp r13b, 2
je 0x140026eac
mov eax, 0x55555556
movzx r8d, sil
imul esi
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dl
add al, al
add dl, al
sub r8b, dl
mov edx, dword [rsp + 0x38]
add r8b, byte [0x140042b82]
test r12d, r12d
setne al
add r14b, al
test r11d, r11d
mov r10d, ebx
setne r10b
mov dword [0x140042b4c], r10d
test r9d, r9d
jne 0x140026ecf
mov eax, 5
shl eax, cl
test eax, eax
mov eax, ebx
je 0x140026ed4
mov eax, 1
add r11d, eax
mov eax, edx
xor eax, r15d
or edi, eax
sub rbp, 1
jne 0x140026e76
movzx edx, byte [0x140042a86]
mov eax, ebx
cmp dword [rsp + 0x28], edx
mov ecx, ebx
mov dword [0x140042b48], r11d
sete al
mov byte [0x140042a62], r14b
cmp eax, 0xfffffff3
mov byte [rsp + 0x90], r8b
mov eax, ebx
mov byte [0x140042b54], 1
seta cl
cmp dword [0x140042b58], 0x3c
sete al
cmp eax, ecx
je 0x140026f5c
test r11d, r11d
je 0x140026f49
movzx eax, byte [rsp + 0x30]
movsx ecx, r8b
and ecx, eax
movsx eax, byte [0x140042b67]
or ecx, eax
or ecx, esi
lea ecx, [rbp + 1]
jne 0x140026f4b
mov ecx, ebx
movzx eax, byte [0x140042b80]
or al, cl
mov byte [0x140042b80], al
jmp 0x140026f63
movzx eax, byte [0x140042b80]
mov r13d, dword [rsp + 0x2c]
mov r12d, dword [rsp + 0xa8]
mov r9d, dword [0x140042b30]
mov r8d, dword [rsp + 0x34]
movzx r14d, byte [0x140042b88]
movzx ebp, al
lea ecx, [r12 - 0x37]
imul r13d, ebp
mov eax, 0x55555556
shl r9d, cl
mov dword [rsp + 0x3c], ebp
imul r13d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub r13d, eax
test r10d, r10d
jne 0x140026fb7
mov eax, ebx
test esi, esi
jns 0x140026fbc
mov eax, 1
movzx ecx, byte [0x140042b64]
or edi, eax
cmp byte [0x140042a63], bl
mov eax, ebx
mov edx, dword [rsp + 0x20]
sete r15b
mov dword [0x140042b2c], edi
cmp dword [0x140042b34], ebx
mov byte [0x140042a63], r15b
setne al
test r8d, r8d
mov dword [rsp + 0x34], eax
mov dword [0x140042b7c], eax
sete al
xor al, cl
add cl, al
mov byte [0x140042b64], cl
mov ecx, dword [0x140042b3c]
add ecx, 0xd
add ecx, ebp
mov dword [0x140042b3c], ecx
test edx, edx
je 0x140027026
mov ecx, 1
cmp r12d, dword [rsp + 0x38]
je 0x140027028
mov ecx, ebx
movzx r12d, byte [0x140042b57]
mov r8d, dword [0x140042b78]
mov ebp, dword [0x140042a64]
movzx eax, bpl
xor al, cl
movzx r13d, r13b
sub r12b, al
mov ecx, r13d
movsx eax, byte [0x140042b55]
shr ecx, 2
add ecx, eax
mov byte [0x140042b57], r12b
mov dword [rsp + 0x38], ecx
mov eax, 0xcccccccd
lea ecx, [rdx + r8*4]
add ecx, r8d
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
je 0x14002716f
sub ecx, 1
je 0x140027138
sub ecx, 1
je 0x140027189
cmp ecx, 1
je 0x140027106
mov ecx, r9d
mov eax, 0xaaaaaaab
imul ecx, dword [rsp + 0xa8]
mul ecx
mov edi, edx
shr edi, 1
mov dword [rsp + 0xa0], edi
and esi, 0x80000003
jge 0x1400270c3
dec esi
or esi, 0xfffffffc
inc esi
add sil, byte [0x140042a62]
movzx edx, byte [0x140042b83]
movzx r10d, sil
movsx ecx, dil
add ecx, 0x140
shl edx, cl
test edx, edx
jne 0x1400270f9
movzx ecx, byte [0x140042b60]
mov edx, 0xdc
shr dl, cl
mov eax, ebx
test dl, dl
je 0x1400270fe
mov eax, 1
or r9d, eax
jmp 0x140027198
xor edi, dword [rsp + 0xa8]
jne 0x14002712c
movzx eax, byte [0x140042a86]
add eax, dword [rsp + 0x2c]
add eax, dword [rsp + 0x28]
jne 0x14002712c
xor r14b, r14b
mov byte [0x140042b88], r14b
jmp 0x140027189
mov r14b, 1
mov byte [0x140042b88], r14b
jmp 0x140027189
and r10d, dword [rsp + 0x28]
mov eax, 0xcccccccd
movzx ecx, byte [0x140042b82]
add ebp, r10d
imul ecx, dword [rsp + 0x20]
mov r10d, dword [rsp + 0x98]
mov edi, dword [rsp + 0xa0]
mov dword [0x140042a64], ebp
mul ecx
mov esi, edx
shr esi, 2
jmp 0x14002719c
movzx eax, byte [0x140042b81]
lea ecx, [r13 - 0x3c]
mov edx, 0xdc
shl edx, cl
xor edx, eax
sub dword [0x140042b84], edx
mov edi, dword [rsp + 0xa0]
mov r10d, dword [rsp + 0x98]
mov esi, dword [rsp + 0x24]
cmp dword [rsp + 0xa8], 5
jbe 0x1400271be
test r11d, r11d
je 0x1400271be
movsx r8d, r10b
add r8d, r13d
add r8d, dword [rsp + 0x3c]
mov dword [0x140042b78], r8d
test r8d, r8d
jne 0x1400271ce
not r10b
mov eax, ebx
test r10b, 0x9f
je 0x1400271d3
mov eax, 1
movzx ecx, byte [rsp + 0x38]
sub r9d, eax
movzx edx, r15b
mov dword [0x140042b28], r9d
sar dl, cl
mov ecx, 0xffffff9f
sub cl, dil
sar dl, cl
test dl, dl
je 0x140027203
cmp byte [0x140042b56], bl
je 0x140027203
mov r10b, 1
jmp 0x140027206
xor r10b, r10b
mov edi, dword [0x140042a8c]
lea eax, [r9 - 0xd]
movzx ebp, byte [0x140042b66]
mov byte [0x140042b83], al
mov eax, dword [0x140042b44]
movzx esi, sil
mov edx, esi
mov byte [0x140042b55], r10b
lea ecx, [rax + rax*2]
sub edx, ecx
and edx, 7
je 0x140027314
sub edx, 1
je 0x1400272e8
sub edx, 1
je 0x1400272bd
cmp edx, 1
je 0x14002726e
movzx eax, byte [0x140042b65]
sub eax, dword [rsp + 0xa8]
add r8d, eax
mov dword [0x140042b78], r8d
jmp 0x140027314
mov ecx, dword [rsp + 0xa0]
movzx eax, r12b
sub cl, byte [rsp + 0xa8]
shr al, cl
or r14b, al
mov byte [0x140042b88], r14b
test r15b, r15b
jne 0x1400272b0
movzx ecx, byte [rsp + 0x90]
mov eax, 0x3c
shr eax, cl
mov ecx, ebx
cmp eax, 0x3c
movsx eax, bpl
sete cl
or ecx, eax
je 0x1400272b5
mov ebx, 1
sub byte [0x140042a86], bl
jmp 0x140027314
movsx eax, r10b
add eax, dword [rsp + 0xa8]
and r9d, eax
cmp r8d, dword [rsp + 0x2c]
mov dword [0x140042b28], r9d
sete al
and al, 0x3c
sub r15b, al
mov byte [0x140042a63], r15b
jmp 0x140027314
mov eax, ebx
lea ecx, [rbp + 2]
shr r13d, cl
mov ecx, ebx
cmp edi, 0xffffffca
sete cl
cmp ecx, r13d
sete al
test r11d, r11d
mov dword [0x140042a88], eax
setne bl
or r12b, bl
mov byte [0x140042b57], r12b
mov r8d, dword [0x140042b58]
mov ecx, dword [rsp + 0x20]
test r8d, r8d
je 0x140027353
test ecx, ecx
je 0x140027353
movzx eax, byte [0x140042b6c]
or edi, dword [0x140042b34]
and al, 0x3c
or r14b, al
mov dword [0x140042a8c], edi
mov eax, dword [rsp + 0x34]
and eax, ecx
mov byte [0x140042b88], r14b
sub dword [0x140042b60], eax
movzx edx, r12b
inc r8d
shr edx, cl
movsx ecx, bpl
xor edx, 5
sub dword [0x140042b38], edx
xor ecx, 0x140
or ecx, 0x3c
mov dword [0x140042b58], r8d
and dword [0x140042b40], ecx
call fcn.140026290
and esi, 0xffffffca
mov eax, esi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret