Function at 0x14000b020
Capabilities:
Check os version
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x140028058]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov rbx, rcx
lea rcx, [rsp + 0x44]
xor edi, edi
xor edx, edx
mov r8d, 0x118
mov dword [rsp + 0x40], edi
call fcn.140011a90
lea rcx, [rbp + 0x64]
xor edx, edx
mov r8d, 0x110
mov dword [rbp + 0x180], 0x6c64746e
mov dword [rbp + 0x184], 0x6c642e6c
mov word [rbp + 0x188], 0x6c
mov dword [rbp + 0x190], 0x476c7452
mov dword [rbp + 0x194], 0x65567465
mov dword [rbp + 0x198], 0x6f697372
mov word [rbp + 0x19c], 0x6e
mov dword [rbp + 0x60], edi
call fcn.140011a90
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000b0fc
lea rdx, [rbp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000b104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
jmp 0x14000b540
lea rcx, [rbp + 0x60]
call rax
test eax, eax
jne 0x14000b0fc
lea rcx, [rbp + 0x1c1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x1c0], al
call fcn.140011a90
cmp dword [rsp + 0x50], 2
mov r8d, dword [rbp + 0x64]
mov edx, dword [rbp + 0x68]
mov r10d, dword [rbp + 0x6c]
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x4c], r10d
mov dword [rbp + 0x1a0], 0x646e6977
mov dword [rbp + 0x1a4], 0x2073776f
mov dword [rbp + 0x1a8], 0x53207325
mov dword [rbp + 0x1ac], 0x20642550
mov dword [rbp + 0x1b0], 0x69754228
mov dword [rbp + 0x1b4], 0x2520646c
mov word [rbp + 0x1b8], 0x2964
mov byte [rbp + 0x1ba], 0
jne 0x14000b50f
cmp r8d, 4
ja 0x14000b1d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
mov word [rsp + 0x30], 0x544e
mov byte [rsp + 0x32], 0
xor ecx, ecx
lea r9, [rsp + 0x30]
movzx eax, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b1c0
cmp r8d, 5
jne 0x14000b2b4
test edx, edx
jne 0x14000b224
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
mov dword [rsp + 0x30], 0x76726573
mov dword [rsp + 0x34], 0x32207265
xor ecx, ecx
mov dword [rsp + 0x38], 0x303030
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b210
jmp 0x14000b50f
cmp edx, 1
jne 0x14000b264
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
mov word [rsp + 0x30], 0x5058
mov byte [rsp + 0x32], 0
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b250
jmp 0x14000b50f
cmp edx, 2
jne 0x14000b50f
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
mov dword [rsp + 0x30], 0x76726573
mov dword [rsp + 0x34], 0x32207265
xor ecx, ecx
mov dword [rsp + 0x38], 0x333030
lea rdx, [rsp + 0x30]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b2a0
jmp 0x14000b50f
cmp r8d, 6
jne 0x14000b491
test edx, edx
jne 0x14000b335
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
xor ecx, ecx
cmp byte [rbp + 0x5a], 1
jne 0x14000b304
mov dword [rsp + 0x30], 0x74736956
mov word [rsp + 0x34], 0x61
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b2f0
jmp 0x14000b50f
mov dword [rsp + 0x30], 0x76726573
mov dword [rsp + 0x34], 0x32207265
mov dword [rsp + 0x38], 0x383030
lea rdx, [rsp + 0x30]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b321
jmp 0x14000b50f
cmp edx, 1
jne 0x14000b3b4
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
xor ecx, ecx
cmp byte [rbp + 0x5a], dl
jne 0x14000b375
mov dword [rsp + 0x30], 0x376e6957
mov byte [rsp + 0x34], cl
lea rdx, [rsp + 0x30]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b361
jmp 0x14000b50f
mov dword [rsp + 0x30], 0x76726573
mov dword [rsp + 0x34], 0x32207265
mov dword [rsp + 0x38], 0x52383030
mov word [rsp + 0x3c], 0x32
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b3a0
jmp 0x14000b50f
cmp edx, 2
jne 0x14000b414
cmp byte [rbp + 0x5a], 1
jne 0x14000b3cb
mov byte [rbp + 0x1c0], 0x38
jmp 0x14000b50f
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
mov dword [rsp + 0x30], 0x76726573
mov dword [rsp + 0x34], 0x32207265
xor ecx, ecx
mov dword [rsp + 0x38], 0x323130
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b400
jmp 0x14000b50f
cmp edx, 3
jne 0x14000b50f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
xor ecx, ecx
cmp byte [rbp + 0x5a], 1
jne 0x14000b455
mov dword [rsp + 0x30], 0x312e38
lea rdx, [rsp + 0x30]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b441
jmp 0x14000b50f
mov dword [rsp + 0x30], 0x76726573
mov dword [rsp + 0x34], 0x32207265
mov dword [rsp + 0x38], 0x52323130
mov word [rsp + 0x3c], 0x32
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b480
jmp 0x14000b50f
cmp r8d, 0xa
jne 0x14000b50f
test edx, edx
jne 0x14000b50f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
xor ecx, ecx
cmp byte [rbp + 0x5a], 1
jne 0x14000b4e1
mov word [rsp + 0x30], 0x3031
mov byte [rsp + 0x32], cl
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b4d0
jmp 0x14000b50f
mov dword [rsp + 0x30], 0x76726573
mov dword [rsp + 0x34], 0x32207265
mov dword [rsp + 0x38], 0x363130
lea rdx, [rsp + 0x30]
nop
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000b500
movzx r9d, word [rbp + 0x54]
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
mov dword [rsp + 0x20], r10d
call fcn.14000f8e0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea eax, [rcx - 1]
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14000f440
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret