Function at 0x140001000
Capabilities:
Check os version
Encode data using xor
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r13
cmp qword [0x140004170], 0
mov rbx, rdx
mov esi, ecx
jne 0x1400010de
mov rax, qword gs:[0x60]
test rax, rax
je 0x14000143f
cmp dword [rax + 0x118], 0xa
jne 0x14000143f
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov rax, qword [rdx]
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x14000143f
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000143f
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000143f
mov r8d, dword [rax + rdx + 0x88]
add r8, rdx
je 0x14000143f
mov qword [0x140004170], rdx
mov ecx, dword [r8 + 0x18]
mov dword [0x140004168], ecx
mov r10d, dword [r8 + 0x20]
add r10, rdx
mov qword [0x140004158], r10
mov r9d, dword [r8 + 0x1c]
add r9, rdx
mov qword [0x140004150], r9
mov r8d, dword [r8 + 0x24]
add r8, rdx
mov qword [0x140004160], r8
test ecx, ecx
je 0x14000143f
test r10, r10
je 0x14000143f
test r9, r9
je 0x14000143f
test r8, r8
je 0x14000143f
test esi, esi
je 0x14000143f
xor r11d, r11d
mov qword [rsp + 0x28], rbp
mov dword [rbx + 4], esi
mov r10d, r11d
mov ebp, dword [0x140004168]
mov r13d, 0xff
lea edi, [r11 + 1]
test rbp, rbp
je 0x1400013ec
mov rdi, qword [0x140004170]
mov qword [rsp + 0x30], r12
mov r12, qword [0x140004150]
mov qword [rsp + 0x38], r14
mov r14, qword [0x140004160]
mov qword [rsp + 0x40], r15
mov r15, qword [0x140004158]
nop dword [rax + rax]
movzx eax, word [r14 + r10*2]
mov edx, 0xfffffaaa
mov r9d, dword [r15 + r10*4]
add r9, rdi
mov r8d, dword [r12 + rax*4]
add r8, rdi
movsx eax, byte [r9]
test eax, eax
je 0x140001202
nop dword [rax]
nop dword [rax + rax]
xor edx, eax
lea r9, [r9 + 1]
mov ecx, edx
mov eax, edx
shl eax, 0x1f
sar eax, 0x1f
and eax, 0x77073096
shl ecx, 0x18
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, eax
mov eax, edx
shl eax, 0x1d
sar eax, 0x1f
and eax, 0x76dc419
xor ecx, eax
mov eax, edx
shl eax, 0x19
sar eax, 0x1f
and eax, 0x76dc4190
xor ecx, eax
mov eax, edx
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor ecx, eax
mov eax, edx
shl eax, 0x1e
sar eax, 0x1f
and eax, 0xee0e612c
xor ecx, eax
mov eax, edx
shl eax, 0x1b
sar eax, 0x1f
and eax, 0x1db71064
xor ecx, eax
mov eax, edx
shl eax, 0x1c
sar eax, 0x1f
and eax, 0xedb8832
xor ecx, eax
mov eax, edx
shr eax, 8
mov edx, ecx
xor edx, eax
movsx eax, byte [r9]
test eax, eax
jne 0x140001170
not edx
cmp edx, esi
je 0x14000121e
inc r10
cmp r10, rbp
jb 0x140001140
mov edi, 1
jmp 0x1400013dd
mov qword [rbx + 8], r8
movzx eax, byte [r8]
cmp al, 0x4c
jne 0x140001276
cmp byte [r8 + 1], 0x8b
jne 0x140001324
cmp byte [r8 + 2], 0xd1
jne 0x140001324
cmp byte [r8 + 3], 0xb8
jne 0x140001324
cmp byte [r8 + 6], r11b
jne 0x140001324
mov edi, 1
cmp byte [r8 + 7], r11b
jne 0x140001329
movzx ecx, byte [r8 + 5]
movzx eax, byte [r8 + 4]
shl ecx, 8
jmp 0x1400013d9
mov edi, 1
cmp al, 0xe9
jne 0x140001329
movzx ecx, di
nop word [rax + rax]
movzx r9d, cx
mov edx, r9d
shl edx, 5
add rdx, r8
cmp byte [rdx], 0x4c
jne 0x1400012c0
cmp byte [rdx + 1], 0x8b
jne 0x1400012c0
cmp byte [rdx + 2], 0xd1
jne 0x1400012c0
cmp byte [rdx + 3], 0xb8
jne 0x1400012c0
cmp byte [rdx + 6], r11b
jne 0x1400012c0
cmp byte [rdx + 7], r11b
je 0x1400012fc
mov eax, r9d
neg eax
shl eax, 5
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], 0x4c
jne 0x1400012f1
cmp byte [rdx + 1], 0x8b
jne 0x1400012f1
cmp byte [rdx + 2], 0xd1
jne 0x1400012f1
cmp byte [rdx + 3], 0xb8
jne 0x1400012f1
cmp byte [rdx + 6], r11b
jne 0x1400012f1
cmp byte [rdx + 7], r11b
je 0x140001310
inc cx
cmp cx, r13w
jbe 0x140001290
jmp 0x140001329
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
sub ecx, r9d
shl eax, 8
or ecx, eax
mov dword [rbx], ecx
jmp 0x140001329
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
add ecx, r9d
shl eax, 8
or ecx, eax
mov dword [rbx], ecx
jmp 0x140001329
mov edi, 1
cmp byte [r8 + 3], 0xe9
jne 0x1400013dd
movzx ecx, di
nop word [rax + rax]
movzx r9d, cx
mov eax, r9d
shl eax, 5
cmp byte [rax + r8], 0x4c
jne 0x140001377
cmp byte [rax + r8 + 1], 0x8b
jne 0x140001377
cmp byte [rax + r8 + 2], 0xd1
jne 0x140001377
cmp byte [rax + r8 + 3], 0xb8
jne 0x140001377
cmp byte [rax + r8 + 6], r11b
jne 0x140001377
cmp byte [rax + r8 + 7], r11b
je 0x1400013b3
mov eax, r9d
neg eax
shl eax, 5
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], 0x4c
jne 0x1400013a8
cmp byte [rdx + 1], 0x8b
jne 0x1400013a8
cmp byte [rdx + 2], 0xd1
jne 0x1400013a8
cmp byte [rdx + 3], 0xb8
jne 0x1400013a8
cmp byte [rdx + 6], r11b
jne 0x1400013a8
cmp byte [rdx + 7], r11b
je 0x1400013cb
inc cx
cmp cx, r13w
jbe 0x140001340
jmp 0x1400013dd
movzx edx, byte [rax + r8 + 5]
movzx ecx, byte [rax + r8 + 4]
shl edx, 8
sub ecx, r9d
or edx, ecx
mov dword [rbx], edx
jmp 0x1400013dd
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
add ecx, r9d
shl eax, 8
or ecx, eax
mov dword [rbx], ecx
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
mov r15, qword [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rbp, qword [rsp + 0x28]
test r8, r8
je 0x14000143f
nop word [rax + rax]
mov edx, r11d
lea ecx, [r11 + 1]
add rdx, r13
add rdx, r8
cmp byte [rdx], 0xf
jne 0x14000141d
cmp byte [rcx + r8 + 0xff], 5
je 0x140001427
mov r11d, ecx
cmp ecx, r13d
jbe 0x140001400
jmp 0x14000142b
mov qword [rbx + 0x10], rdx
cmp dword [rbx], 0
je 0x14000143f
cmp qword [rbx + 0x10], 0
je 0x14000143f
mov eax, edi
pop r13
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
pop r13
pop rdi
pop rsi
pop rbx
ret