Function at 0x140055e10
Capabilities:
Check os version
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0x138]
xor ebx, ebx
mov r15, qword [rbp + 0x148]
mov r13d, edx
mov esi, dword [rbp + 0x130]
mov r14, rcx
mov dword [rsp + 0x54], r8d
lea rcx, [rsp + 0x60]
lea r8d, [rbx + 0x58]
mov qword [rbp - 0x40], rax
xor edx, edx
mov qword [rbp - 0x38], r15
mov rdi, r9
mov dword [rsp + 0x44], ebx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea r8d, [rbx + 0x50]
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov dword [r15], ebx
cmp esi, 0x3a
jbe 0x140055e9c
mov eax, 0x1d10
jmp 0x140056334
mov ecx, dword [r14 + 0x2c]
test esi, esi
mov qword [rsp + 0x218], r12
lea r12, [rbp + 0x70]
cmovne r12, rdi
mov dword [rsp + 0x60], ecx
call fcn.1400564c0
test al, al
jne 0x14005632c
test byte [r14], 0x10
mov ecx, 0x22000c
mov eax, 0x220020
cmove eax, ecx
lea ecx, [rsi + 8]
shr ecx, 4
mov dword [rsp + 0x4c], eax
lea eax, [rsi - 8]
lea edi, [rcx + 1]
test al, 0xf
je 0x140055eed
cmp esi, 0x3a
jne 0x140055eef
mov edi, ecx
cmp edi, 4
ja 0x140056021
mov ecx, 3
cmp r13d, 0x33
jne 0x140055f08
lea eax, [rcx - 1]
jmp 0x140055f11
cmp r13d, 1
mov eax, edi
cmove eax, ecx
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x6e]
shl eax, 4
mov r15d, edi
add eax, 8
shl r15d, 4
add r15d, 8
mov dword [rsp + 0x48], eax
mov edx, 2
mov dword [rsp + 0x64], r15d
mov byte [rsp + 0x68], 8
call fcn.14004e230
mov eax, dword [rsp + 0x54]
lea rcx, [rsp + 0x76]
mov byte [rsp + 0x71], al
mov edx, 2
movzx eax, byte [r12]
mov byte [rsp + 0x72], al
movzx eax, byte [r12 + 1]
mov byte [rsp + 0x73], al
movzx eax, byte [r12 + 2]
mov byte [rsp + 0x74], al
movzx eax, byte [r12 + 3]
mov byte [rsp + 0x75], al
mov byte [rsp + 0x70], r13b
call fcn.14004e230
lea rcx, [rsp + 0x78]
cmp esi, 4
jbe 0x140055fb7
lea r8d, [rsi - 4]
lea rdx, [r12 + 4]
call sub.VCRUNTIME140.dll_memcpy
mov edx, r15d
sub edx, esi
sub edx, 0xf
test edx, edx
jle 0x140055fc0
lea ecx, [rsi + 0xc]
lea rax, [rsp + 0x68]
add rcx, rax
jmp 0x140055fbb
lea edx, [r15 - 0x13]
call fcn.14004e230
lea eax, [r15 - 4]
movzx eax, byte [rsp + rax + 0x68]
mov byte [rsp + 0x40], al
cmp esi, 4
jbe 0x140055fdc
sub sil, 4
movzx edx, sil
jmp 0x140055fde
mov edx, ebx
lea ecx, [r15 - 2]
lea eax, [r15 - 3]
mov byte [rsp + rax + 0x68], dl
movzx eax, byte [rsp + 0x76]
mov byte [rsp + rcx + 0x68], al
lea ecx, [r15 - 1]
movzx eax, byte [rsp + 0x77]
mov byte [rsp + rcx + 0x68], al
sub edi, 1
je 0x1400560e5
mov esi, 4
sub edi, 1
je 0x1400560a5
sub edi, 1
je 0x140056065
sub edi, 1
je 0x14005602b
mov eax, 0x1d10
jmp 0x14005632c
mov rcx, qword [r14 + 0x30]
lea rdx, [rbp - 0x60]
call fcn.140054400
lea rcx, [rbp - 0x60]
mov rdx, rsi
nop
movzx eax, byte [rcx - 0x10]
xor byte [rcx], al
movzx eax, byte [rcx - 0xf]
xor byte [rcx + 1], al
movzx eax, byte [rcx - 0xe]
xor byte [rcx + 2], al
movzx eax, byte [rcx - 0xd]
xor byte [rcx + 3], al
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140056040
mov rcx, qword [r14 + 0x30]
lea rdx, [rbp - 0x70]
call fcn.140054400
lea rcx, [rbp - 0x70]
mov rdx, rsi
nop dword [rax]
movzx eax, byte [rcx - 0x10]
xor byte [rcx], al
movzx eax, byte [rcx - 0xf]
xor byte [rcx + 1], al
movzx eax, byte [rcx - 0xe]
xor byte [rcx + 2], al
movzx eax, byte [rcx - 0xd]
xor byte [rcx + 3], al
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140056080
mov rcx, qword [r14 + 0x30]
lea rdx, [rbp - 0x80]
call fcn.140054400
lea rcx, [rbp - 0x80]
nop word [rax + rax]
movzx eax, byte [rcx - 0x10]
xor byte [rcx], al
movzx eax, byte [rcx - 0xf]
xor byte [rcx + 1], al
movzx eax, byte [rcx - 0xe]
xor byte [rcx + 2], al
movzx eax, byte [rcx - 0xd]
xor byte [rcx + 3], al
lea rcx, [rcx + 4]
sub rsi, 1
jne 0x1400560c0
mov rcx, qword [r14 + 0x30]
lea rdx, [rsp + 0x70]
call fcn.140054400
lea rcx, [rsp + 0x68]
call fcn.1400649b0
mov r13, qword [rbp - 0x40]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test r13, r13
jne 0x1400561e7
cmp dword [rbp - 0x20], 2
jne 0x140056133
cmp dword [rbp - 0x2c], 5
jne 0x140056133
lea rcx, str..GlobalSNTNLUSB
cmp dword [rbp - 0x28], ebx
je 0x14005613a
lea rcx, str..SNTNLUSB
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call fcn.140065100
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x14005616f
mov edi, Ordinal_7430
jmp 0x140056320
mov edx, dword [rsp + 0x4c]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r9d, 0x58
mov dword [rsp + 0x28], ebx
mov rcx, r15
mov qword [rsp + 0x20], rbx
call fcn.140065a30
test eax, eax
jne 0x1400561d7
call fcn.1400660f0
cmp eax, 6
jne 0x1400561c1
mov edi, 0x1d43
mov rcx, r15
movzx ebx, di
call fcn.140065350
jmp 0x140056320
call fcn.1400660f0
cmp eax, 0x39
mov ebx, 0x1d0d
mov edx, 0x1d6d
cmove bx, dx
mov rcx, r15
call fcn.140065350
movzx edi, bx
jmp 0x140056320
cmp dword [rbp - 0x20], 2
jne 0x1400561ff
cmp dword [rbp - 0x2c], 5
jne 0x1400561ff
lea rcx, str..GlobalSNTNLUSB
cmp dword [rbp - 0x28], ebx
je 0x140056206
lea rcx, str..SNTNLUSB
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call fcn.140065100
mov r12d, dword [rsp + 0x48]
mov r15, rax
mov esi, 0x1d0d
cmp rax, 0xffffffffffffffff
jne 0x140056240
lea edi, [rsi - 0xa]
jmp 0x1400562a9
mov edx, dword [rsp + 0x4c]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r9d, 0x58
lea rax, [rbp + 0x70]
mov dword [rsp + 0x28], r12d
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.140065a30
test eax, eax
je 0x14005627d
movzx edi, bx
jmp 0x1400562a1
call fcn.1400660f0
cmp eax, 6
jne 0x14005628e
mov edi, 0x1d43
jmp 0x1400562a1
call fcn.1400660f0
cmp eax, 0x39
mov edi, esi
mov edx, 0x1d6d
cmove di, dx
mov rcx, r15
call fcn.140065350
movzx eax, dil
test dil, dil
jne 0x140056320
cmp dword [rsp + 0x44], r12d
je 0x1400562c7
mov ecx, dword [r14 + 0x2c]
call fcn.140056a90
movzx eax, si
jmp 0x14005632c
movzx r9d, byte [rsp + 0x40]
lea rcx, [rbp + 0x70]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [r14 + 0x30]
call fcn.140056dd0
movzx edi, ax
test al, al
jne 0x140056320
mov rax, qword [rbp - 0x38]
mov r8, r13
mov edx, dword [rbp + 0x140]
mov dword [rax], edx
test edx, edx
je 0x140056310
lea eax, [rbx + 2]
dec edx
movzx eax, byte [rbp + rax + 0x70]
inc ebx
mov byte [r8], al
inc r8
cmp ebx, 4
jb 0x1400562f5
mov r8d, edx
lea rcx, [r13 + 4]
lea rdx, [rbp + 0x78]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [r14 + 0x2c]
call fcn.140056a90
movzx eax, di
mov r12, qword [rsp + 0x218]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140077b10
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret