Function at 0x1402448b0
Capabilities:
Check os version
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov eax, dword [0x1415a8428]
sub eax, dword [0x1415a842c]
mov qword [rbp - 8], rcx
imul rcx, rax, 0x202fe919
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
not eax
and eax, 0x21804d0b
mov ecx, 0xc0303094
sub ecx, eax
cmp ecx, 0xd6c41ce
jae 0x140244910
mov eax, 0x120
call fcn.14020e090
sub rsp, rax
nop dword [rax]
mov eax, dword [0x1415a8430]
add eax, dword [0x1415a8434]
imul ecx, eax, 0x28d5271
add ecx, 0x757a4c38
mov eax, ecx
not eax
mov edx, ecx
and edx, 0x5053c5c9
and eax, 0xafac3a36
imul eax, edx
mov edx, ecx
and edx, 0xafac3a36
or ecx, 0xafac3a36
imul ecx, edx
add ecx, eax
mov eax, 0x120
call fcn.14020e090
sub rsp, rax
mov rdi, rsp
cmp ecx, 0x7861cce9
jb 0x140244910
mov qword [rbp - 0x10], rdi
xor r12d, r12d
mov esi, 0xa9ef5adb
lea r14, [0x1415acbc0]
lea r15, [rbp + 4]
mov r13, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
mov eax, dword [0x1415a8438]
or eax, dword [0x1415a843c]
imul eax, eax, 0xdc3aaad1
add eax, 0x1f7f3ff6
and eax, 0x45497be7
cmp eax, 0x6c1deb0d
jbe 0x1402449ae
mov eax, dword [0x1415acbc0]
mov r9d, 2
mov r10d, 3
nop word [rax + rax]
mov ecx, dword [0x1415acbc0]
test r12b, r12b
jne 0x1402449c0
jmp 0x1402449fd
mov eax, dword [0x1415a84e0]
sub eax, dword [0x1415a84e4]
mov edx, eax
and edx, 0xc4105742
xor edx, 0x4105300
and eax, 0x4105300
or eax, edx
add eax, 0x5036e54b
cmp eax, 0x5d7f169e
jae 0x1402449d0
cmp ecx, 3
jge 0x140244b10
cmp ecx, 1
jg 0x140244ab0
test ecx, ecx
js 0x140244d85
mov eax, ecx
lock cmpxchg dword [0x1415acbc0], r9d
sete r8b
mov ecx, eax
nop dword [rax + rax]
mov eax, dword [0x1415a8450]
xor edx, edx
div dword [0x1415a8454]
imul rax, rax, 0x2c8123b9
shr rax, 0x3c
mov edx, eax
xor edx, 0x9d7e5e61
and eax, 0xfffffffe
add eax, eax
sub eax, edx
or eax, 0x635c26ee
cmp eax, 0xd278fba0
ja 0x140244a30
nop word cs:[rax + rax]
mov eax, dword [0x1415a8458]
xor edx, edx
div dword [0x1415a845c]
not eax
or eax, 0x84010
and eax, 0x48d954
xor eax, 0x29418040
or eax, 0xd63626a3
cmp eax, 0x9b27e045
jb 0x140244a70
test r8b, r8b
je 0x1402449d0
jmp 0x140244cf8
mov eax, 2
lock cmpxchg dword [0x1415acbc0], r10d
mov ecx, eax
sete al
nop word cs:[rax + rax]
mov edx, dword [0x1415a84d8]
or edx, dword [0x1415a84dc]
and edx, 0x9f73410b
imul rdx, rsi
shr rdx, 0x3e
add edx, 0xbe12adf7
cmp edx, 0x75804e69
jb 0x140244ad0
test al, al
je 0x1402449d0
jmp 0x140244b19
cmp ecx, 4
jge 0x140244d7f
mov eax, dword [0x1415a84e8]
xor edx, edx
div dword [0x1415a84ec]
mov ecx, eax
and ecx, 0x1168cbaa
xor eax, 0x1168cbaa
lea eax, [rax + rcx*2]
imul eax, eax, 0xbc2d3986
cmp eax, 0x3f2bcf90
jne 0x140244b50
mov dword [rbp + 4], 3
nop dword [rax + rax]
mov eax, dword [0x1415a84f0]
xor eax, dword [0x1415a84f4]
imul eax, eax, 0x362beb31
add eax, 0x2cef62a0
mov ecx, eax
and ecx, 0x4078851
add ecx, ecx
sub eax, ecx
add eax, 0x84078851
mov dword [rbp + 4], 3
cmp eax, 0x43c48d47
jb 0x140244b50
mov eax, dword [0x1415a84f8]
or eax, dword [0x1415a84fc]
mov ecx, 0x996f7f8f
imul rax, rcx
shr rax, 0x3f
or eax, 0x431caa0c
cmp eax, 0x8de1de6
jae 0x140244bd0
sub rsp, 0x20
mov r8d, 4
mov rcx, r14
mov rdx, r15
mov r9d, 0xffffffff
call r13
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x1415a8500]
mov ecx, dword [0x1415a8504]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
lea ebx, [rax + rdx]
add ebx, 0x7e1ed125
or ebx, 0xe01969bc
sub rsp, 0x20
mov r8d, 4
mov rcx, r14
mov rdx, r15
mov r9d, 0xffffffff
call r13
add rsp, 0x20
cmp ebx, 0xf3892e08
je 0x140244bd0
cmp eax, 1
je 0x140244985
mov eax, dword [0x1415a8508]
xor edx, edx
div dword [0x1415a850c]
mov ecx, eax
and ecx, 0x950f199
xor eax, 0x950f199
lea eax, [rax + rcx*2]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xc0ce5373
and ecx, 0x3f31ac8c
imul ecx, edx
mov edx, eax
and edx, 0x3f31ac8c
or eax, 0x3f31ac8c
imul eax, edx
add eax, ecx
add eax, 0x8f62bb61
cmp eax, 0x3fd663d0
jb 0x140244ce9
nop dword [rax + rax]
mov eax, dword [str._bZtU]
imul eax, dword [0x1415a8514]
add eax, 0x58226705
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xd4e47a37
and ecx, 0x2b1b85c8
imul ecx, edx
mov edx, eax
and edx, 0x2b1b85c8
or eax, 0x2b1b85c8
imul eax, edx
lea ebx, [rax + rcx]
add ebx, 0xa8ecc553
sub rsp, 0x20
call fcn.14020b260
add rsp, 0x20
cmp ebx, 0x3d19489e
jae 0x140244985
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
jmp 0x140244c90
mov eax, dword [str.o_r]
xor edx, edx
div dword [0x1415a846c]
nop word cs:[rax + rax]
mov eax, dword [0x1415a8470]
add eax, dword [0x1415a8474]
mov ecx, eax
xor ecx, 0x460cf3bc
and ecx, eax
add ecx, 0x28dc747f
xor ecx, 0x4b980430
cmp ecx, 0xafdcbaca
je 0x140244d10
mov rax, qword [rbp - 8]
mov rcx, qword [rax]
mov rsi, qword [rcx]
mov eax, dword [0x1415a8478]
xor edx, edx
div dword [0x1415a847c]
add eax, 0xe407b81f
mov edx, 0xef203155
imul rdx, rax
shr rdx, 0x37
add edx, 0xdc1aafb4
cmp edx, 0x541089dd
mov rbx, qword [rbp - 0x10]
jae 0x140244e6e
jmp 0x140244eac
je 0x140244e10
mov eax, dword [0x1415a8444]
add eax, dword [0x1415a8440]
xor eax, 0x242501
or eax, 0x37c34aae
mov ecx, eax
not ecx
or ecx, 0x29a97832
add ecx, eax
cmp ecx, 0xe8b49007
jne 0x140244db1
ud2
xor eax, eax
nop word cs:[rax + rax]
ud2
mov eax, dword [0x1415a8460]
mov ecx, dword [0x1415a8464]
mov r8d, 0xe7ed9e87
sub r8d, eax
sub r8d, ecx
add eax, ecx
add eax, 0x18126178
and r8d, 0xd2ece2f8
mov ecx, eax
and ecx, 0x2d131d07
imul ecx, r8d
mov edx, eax
and edx, 0xd2ece2f8
or eax, 0xd2ece2f8
imul eax, edx
add eax, ecx
cmp eax, 0xc5ed7ada
ja 0x140244e10
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x1415a8480]
mov edx, dword [0x1415a8484]
mov r8d, eax
and r8d, edx
add r8d, r8d
add eax, edx
sub eax, r8d
and eax, 0x7fffffff
xor eax, 0x13dc3210
add eax, 0xd8a10215
not eax
or eax, 0xbc7e9fc1
mov qword [rcx], 0
cmp eax, 0xedbdaa5d
jae 0x140244eb5
mov qword [rcx], 0
jmp 0x140244e6e
test rsi, rsi
je 0x1402451e2
add rdi, 4
sub rsp, 0x20
mov r8d, 0x118
mov rcx, rdi
xor edx, edx
call fcn.14021c2d0
add rsp, 0x20
mov dword [rbx], 0x11c
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlGetVersion]
add rsp, 0x20
test eax, eax
js 0x140245040
nop dword [rax]
mov eax, dword [0x1415a8498]
xor eax, dword [0x1415a849c]
imul eax, eax, 0x63e31b21
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x62051bf8
and ecx, 0x9dfae407
imul ecx, edx
mov edx, eax
and edx, 0x9dfae407
or eax, 0x9dfae407
imul eax, edx
add eax, ecx
cmp eax, 0x90431acf
je 0x140244f00
mov eax, dword [rdi]
nop word cs:[rax + rax]
mov ecx, dword [0x1415a84a0]
mov edx, dword [0x1415a84a4]
mov r8d, ecx
not r8d
or ecx, edx
not edx
and edx, r8d
not ecx
or ecx, edx
not ecx
add ecx, 0xafbabd81
mov edx, ecx
xor edx, 0x10db4844
and edx, ecx
and edx, 0x11db5e66
cmp edx, 0xd3193524
ja 0x140244f50
mov cl, 1
cmp eax, 6
ja 0x140245083
nop dword [rax + rax]
mov ecx, dword [0x1415a84b0]
xor ecx, dword [str.Ko]
mov edx, ecx
and edx, 0x232bfe0d
mov r8d, edx
not r8d
and r8d, 0x80c6c5d5
mov r9d, ecx
and r9d, 0x23293a08
imul r9d, r8d
and ecx, 0x2c405
or edx, 0x80c6c5d5
imul edx, ecx
lea ecx, [rdx + r9]
add ecx, 0xf6d295fd
cmp ecx, 0x7df96da3
jb 0x140244fa0
cmp eax, 6
jne 0x140245081
mov eax, dword [rbx + 8]
nop dword [rax]
mov ecx, dword [0x1415a84b8]
mov edx, dword [0x1415a84bc]
mov r8d, edx
not r8d
and r8d, ecx
xor edx, ecx
add edx, ecx
sub edx, r8d
or edx, 0x2488730
and edx, 0x524bcf30
imul edx, edx, 0xf8938c84
cmp eax, 3
setae cl
cmp edx, 0x614f21e2
ja 0x140245000
jmp 0x140245083
mov eax, dword [0x1415a84a8]
mov ecx, dword [0x1415a84ac]
not ecx
mov edx, eax
or edx, ecx
and ecx, eax
not edx
or edx, ecx
mov eax, edx
not eax
or eax, 0xb65e8397
or edx, 0x4743dec1
and edx, eax
and edx, 0xf75fdfd7
add edx, 0x7fb36e2f
cmp edx, 0x96a412ad
jbe 0x140245040
mov cl, 1
jmp 0x140245094
xor ecx, ecx
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140245090
mov byte [rsi], cl
mov eax, 4
xchg dword [0x1415acbc0], eax
cmp eax, 3
jne 0x140244e10
mov eax, dword [0x1415a84c0]
mov ecx, dword [0x1415a84c4]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, 0x9d99d4b7
imul rcx, rax
shr rcx, 0x3f
mov eax, ecx
xor eax, 0x53ca9f87
lea eax, [rax + rcx*2]
and eax, 0x4000118f
cmp eax, 0xa5547cb2
jbe 0x14024510e
sub rsp, 0x20
lea rcx, [0x1415acbc0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressAll]
add rsp, 0x20
mov edi, 0xcc7e1317
lea rsi, [0x1415acbc0]
nop word [rax + rax]
mov eax, dword [0x1415a84c8]
mov ecx, dword [0x1415a84cc]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
or eax, 0xaca54f8f
imul ebx, eax, 0x25489f05
imul rbx, rdi
shr rbx, 0x3e
sub rsp, 0x20
mov rcx, rsi
call fcn.14020ca40
add rsp, 0x20
cmp ebx, 0x2331b7ee
ja 0x140245120
nop word cs:[rax + rax]
mov eax, dword [0x1415a84d0]
mov ecx, dword [0x1415a84d4]
mov edx, ecx
and edx, eax
add eax, ecx
sub eax, edx
mov ecx, eax
and ecx, 0x5de711da
mov edx, ecx
not edx
mov r8d, eax
and r8d, 0xd851110
and edx, 0xf072a6cb
imul edx, r8d
and eax, 0x506200ca
or ecx, 0xf072a6cb
imul ecx, eax
add ecx, edx
mov eax, ecx
not eax
and eax, 0xa6dfdec7
and ecx, 0x59202138
sub ecx, eax
cmp ecx, 0x639457ef
je 0x140245180
jmp 0x140244e10
mov eax, dword [0x1415a8488]
xor eax, dword [0x1415a848c]
mov ecx, eax
xor ecx, 0x3c30aff8
xor eax, 0x8283b504
add eax, ecx
and ecx, 0x414ce503
sub eax, ecx
cmp eax, 0x1b8b4592
jne 0x140245210
ud2
mov eax, dword [0x1415a8490]
or eax, dword [0x1415a8494]
or eax, 0x78761366
mov ecx, eax
and ecx, 0x3733bdbd
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0xb733bdbd
mov ecx, eax
not ecx
or eax, 0x1039e213
or ecx, 0xefc61dec
and ecx, eax
ud2