Function at 0x1400022f0
Capabilities:
Check os version
Encode data using xor
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9, qword [0x140007810]
mov rsi, rdx
mov r15d, ecx
test r9, r9
jne 0x1400023c3
mov rax, qword gs:[0x60]
cmp dword [rax + 0x118], 0xa
jne 0x1400023a9
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x20]
mov rax, qword [r8]
mov r9, qword [rax + 0x20]
test r9, r9
je 0x1400023a9
movsxd rax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400023a9
mov ecx, dword [rax + r9 + 0x88]
add rcx, r9
mov qword [0x140007810], r9
mov ebp, dword [rcx + 0x18]
mov dword [0x140007808], ebp
mov r11d, dword [rcx + 0x20]
add r11, r9
mov qword [0x1400077f8], r11
mov r14d, dword [rcx + 0x1c]
add r14, r9
mov qword [0x1400077f0], r14
mov r10d, dword [rcx + 0x24]
add r10, r9
mov qword [0x140007800], r10
test ebp, ebp
je 0x1400023a9
test r11, r11
je 0x1400023a9
test r14, r14
je 0x1400023a9
test r10, r10
jne 0x1400023de
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov ebp, dword [0x140007808]
mov r10, qword [0x140007800]
mov r11, qword [0x1400077f8]
mov r14, qword [0x1400077f0]
xor ebx, ebx
mov qword [rsp + 0x50], rdi
mov edi, ebx
mov r12d, 0xff
lea r13d, [rbx + 1]
test ebp, ebp
je 0x140002674
nop dword [rax]
mov r8d, dword [r11]
mov edx, 0xffffefff
movzx eax, word [r10]
add r8, r9
mov eax, dword [r14 + rax*4]
movzx ecx, byte [r8]
add rax, r9
test cl, cl
je 0x1400024bf
movsx ecx, cl
lea r8, [r8 + 1]
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140002422
not edx
cmp edx, r15d
je 0x1400024dd
inc edi
add r11, 4
add r10, 2
cmp edi, ebp
jb 0x140002400
jmp 0x140002674
mov qword [rsi + 8], rax
movzx ecx, byte [rax]
cmp cl, 0x4c
jne 0x14000252d
cmp byte [rax + 1], 0x8b
jne 0x1400025d3
cmp byte [rax + 2], 0xd1
jne 0x1400025d3
cmp byte [rax + 3], 0xb8
jne 0x1400025d3
cmp byte [rax + 6], bl
jne 0x1400025d3
cmp byte [rax + 7], bl
jne 0x1400025d3
movzx edx, byte [rax + 5]
movzx ecx, byte [rax + 4]
shl edx, 8
or edx, ecx
mov dword [rsi], edx
jmp 0x140002674
cmp cl, 0xe9
jne 0x1400025d3
movzx edx, r13w
nop word [rax + rax]
movzx r9d, dx
mov r8d, r9d
shl r8d, 5
add r8, rax
cmp byte [r8], 0x4c
jne 0x140002575
cmp byte [r8 + 1], 0x8b
jne 0x140002575
cmp byte [r8 + 2], 0xd1
jne 0x140002575
cmp byte [r8 + 3], 0xb8
jne 0x140002575
cmp byte [r8 + 6], bl
jne 0x140002575
cmp byte [r8 + 7], bl
je 0x1400025b5
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd r8, ecx
add r8, rax
cmp byte [r8], 0x4c
jne 0x1400025aa
cmp byte [r8 + 1], 0x8b
jne 0x1400025aa
cmp byte [r8 + 2], 0xd1
jne 0x1400025aa
cmp byte [r8 + 3], 0xb8
jne 0x1400025aa
cmp byte [r8 + 6], bl
jne 0x1400025aa
cmp byte [r8 + 7], bl
je 0x1400025bf
inc dx
cmp dx, r12w
jbe 0x140002540
jmp 0x1400025d3
movzx edx, byte [r8 + 4]
sub edx, r9d
jmp 0x1400025c7
movzx edx, byte [r8 + 4]
add edx, r9d
movzx ecx, byte [r8 + 5]
shl ecx, 8
or edx, ecx
mov dword [rsi], edx
cmp byte [rax + 3], 0xe9
jne 0x140002674
movzx r8d, r13w
nop dword [rax]
nop word [rax + rax]
movzx r9d, r8w
mov edx, r9d
shl edx, 5
add rdx, rax
cmp byte [rdx], 0x4c
jne 0x14000261e
cmp byte [rdx + 1], 0x8b
jne 0x14000261e
cmp byte [rdx + 2], 0xd1
jne 0x14000261e
cmp byte [rdx + 3], 0xb8
jne 0x14000261e
cmp byte [rdx + 6], bl
jne 0x14000261e
cmp byte [rdx + 7], bl
je 0x140002659
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd rdx, ecx
add rdx, rax
cmp byte [rdx], 0x4c
jne 0x14000264d
cmp byte [rdx + 1], 0x8b
jne 0x14000264d
cmp byte [rdx + 2], 0xd1
jne 0x14000264d
cmp byte [rdx + 3], 0xb8
jne 0x14000264d
cmp byte [rdx + 6], bl
jne 0x14000264d
cmp byte [rdx + 7], bl
je 0x140002662
inc r8w
cmp r8w, r12w
jbe 0x1400025f0
jmp 0x140002674
movzx ecx, byte [rdx + 4]
sub ecx, r9d
jmp 0x140002669
movzx ecx, byte [rdx + 4]
add ecx, r9d
movzx eax, byte [rdx + 5]
shl eax, 8
or ecx, eax
mov dword [rsi], ecx
mov rdi, qword [rsp + 0x50]
cmp qword [rsi + 8], rbx
je 0x1400023a9
cmp dword [rsi], ebx
je 0x1400023a9
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
movabs rax, 0x8080808080808081
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
mov rdx, qword [rsi + 8]
sub rcx, rax
add rdx, rcx
nop word [rax + rax]
mov ecx, ebx
add rcx, rdx
inc ebx
cmp byte [rcx], 0xf
jne 0x1400026d2
cmp byte [rbx + rdx], 5
je 0x1400026dc
cmp ebx, r12d
jbe 0x1400026c0
jmp 0x1400023a9
mov qword [rsi + 0x10], rcx
mov eax, r13d
jmp 0x1400023ab