Function at 0x140002380
Capabilities:
Check os version
Encode data using xor
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9, qword [0x140020d00]
mov rsi, rdx
mov r15d, ecx
test r9, r9
jne 0x140002453
mov rax, qword gs:[0x60]
cmp dword [rax + 0x118], 0xa
jne 0x140002439
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x20]
mov rax, qword [r8]
mov r9, qword [rax + 0x20]
test r9, r9
je 0x140002439
movsxd rax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140002439
mov ecx, dword [rax + r9 + 0x88]
add rcx, r9
mov qword [0x140020d00], r9
mov ebp, dword [rcx + 0x18]
mov dword [0x140020cf8], ebp
mov r11d, dword [rcx + 0x20]
add r11, r9
mov qword [0x140020ce8], r11
mov r14d, dword [rcx + 0x1c]
add r14, r9
mov qword [0x140020ce0], r14
mov r10d, dword [rcx + 0x24]
add r10, r9
mov qword [0x140020cf0], r10
test ebp, ebp
je 0x140002439
test r11, r11
je 0x140002439
test r14, r14
je 0x140002439
test r10, r10
jne 0x14000246e
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov ebp, dword [0x140020cf8]
mov r10, qword [0x140020cf0]
mov r11, qword [0x140020ce8]
mov r14, qword [0x140020ce0]
xor ebx, ebx
mov qword [rsp + 0x50], rdi
mov edi, ebx
mov r13d, 1
mov r12d, 0xff
test ebp, ebp
je 0x140002704
nop dword [rax + rax]
mov r8d, dword [r11]
mov edx, 0xffffefff
movzx eax, word [r10]
add r8, r9
mov eax, dword [r14 + rax*4]
movzx ecx, byte [r8]
add rax, r9
test cl, cl
je 0x14000254f
movsx ecx, cl
lea r8, [r8 + 1]
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x1400024b2
not edx
cmp edx, r15d
je 0x14000256d
inc edi
add r11, 4
add r10, 2
cmp edi, ebp
jb 0x140002490
jmp 0x140002704
mov qword [rsi + 8], rax
movzx ecx, byte [rax]
cmp cl, 0x4c
jne 0x1400025bd
cmp byte [rax + 1], 0x8b
jne 0x140002663
cmp byte [rax + 2], 0xd1
jne 0x140002663
cmp byte [rax + 3], 0xb8
jne 0x140002663
cmp byte [rax + 6], bl
jne 0x140002663
cmp byte [rax + 7], bl
jne 0x140002663
movzx edx, byte [rax + 5]
movzx ecx, byte [rax + 4]
shl edx, 8
or edx, ecx
mov dword [rsi], edx
jmp 0x140002704
cmp cl, 0xe9
jne 0x140002663
movzx edx, r13w
nop word [rax + rax]
movzx r9d, dx
mov r8d, r9d
shl r8d, 5
add r8, rax
cmp byte [r8], 0x4c
jne 0x140002605
cmp byte [r8 + 1], 0x8b
jne 0x140002605
cmp byte [r8 + 2], 0xd1
jne 0x140002605
cmp byte [r8 + 3], 0xb8
jne 0x140002605
cmp byte [r8 + 6], bl
jne 0x140002605
cmp byte [r8 + 7], bl
je 0x140002645
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd r8, ecx
add r8, rax
cmp byte [r8], 0x4c
jne 0x14000263a
cmp byte [r8 + 1], 0x8b
jne 0x14000263a
cmp byte [r8 + 2], 0xd1
jne 0x14000263a
cmp byte [r8 + 3], 0xb8
jne 0x14000263a
cmp byte [r8 + 6], bl
jne 0x14000263a
cmp byte [r8 + 7], bl
je 0x14000264f
inc dx
cmp dx, r12w
jbe 0x1400025d0
jmp 0x140002663
movzx edx, byte [r8 + 4]
sub edx, r9d
jmp 0x140002657
movzx edx, byte [r8 + 4]
add edx, r9d
movzx ecx, byte [r8 + 5]
shl ecx, 8
or edx, ecx
mov dword [rsi], edx
cmp byte [rax + 3], 0xe9
jne 0x140002704
movzx r8d, r13w
nop dword [rax]
nop word [rax + rax]
movzx r9d, r8w
mov edx, r9d
shl edx, 5
add rdx, rax
cmp byte [rdx], 0x4c
jne 0x1400026ae
cmp byte [rdx + 1], 0x8b
jne 0x1400026ae
cmp byte [rdx + 2], 0xd1
jne 0x1400026ae
cmp byte [rdx + 3], 0xb8
jne 0x1400026ae
cmp byte [rdx + 6], bl
jne 0x1400026ae
cmp byte [rdx + 7], bl
je 0x1400026e9
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd rdx, ecx
add rdx, rax
cmp byte [rdx], 0x4c
jne 0x1400026dd
cmp byte [rdx + 1], 0x8b
jne 0x1400026dd
cmp byte [rdx + 2], 0xd1
jne 0x1400026dd
cmp byte [rdx + 3], 0xb8
jne 0x1400026dd
cmp byte [rdx + 6], bl
jne 0x1400026dd
cmp byte [rdx + 7], bl
je 0x1400026f2
inc r8w
cmp r8w, r12w
jbe 0x140002680
jmp 0x140002704
movzx ecx, byte [rdx + 4]
sub ecx, r9d
jmp 0x1400026f9
movzx ecx, byte [rdx + 4]
add ecx, r9d
movzx eax, byte [rdx + 5]
shl eax, 8
or ecx, eax
mov dword [rsi], ecx
mov rdi, qword [rsp + 0x50]
cmp qword [rsi + 8], rbx
je 0x140002439
cmp dword [rsi], ebx
je 0x140002439
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
movabs rax, 0x8080808080808081
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
mov rdx, qword [rsi + 8]
sub rcx, rax
add rdx, rcx
nop word [rax + rax]
mov ecx, ebx
add rcx, rdx
inc ebx
cmp byte [rcx], 0xf
jne 0x140002762
cmp byte [rbx + rdx], 5
je 0x14000276c
cmp ebx, r12d
jbe 0x140002750
jmp 0x140002439
mov qword [rsi + 0x10], rcx
mov eax, r13d
jmp 0x14000243b