Function at 0x1400018d0
Capabilities:
Check os version
Encode data using xor
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r15
mov r11, qword [0x140005878]
mov rbx, rdx
mov r15d, ecx
test r11, r11
jne 0x1400019b8
mov rax, qword gs:[0x60]
test rax, rax
je 0x14000199f
cmp dword [rax + 0x118], 0xa
jne 0x14000199f
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov rax, qword [rdx]
mov r11, qword [rax + 0x20]
test r11, r11
je 0x14000199f
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x14000199f
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x14000199f
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
je 0x14000199f
mov edx, dword [rcx + 0x18]
mov ebp, dword [rcx + 0x20]
mov esi, dword [rcx + 0x1c]
add rbp, r11
mov edi, dword [rcx + 0x24]
add rsi, r11
add rdi, r11
mov qword [0x140005878], r11
mov dword [0x140005870], edx
mov qword [0x140005860], rbp
mov qword [0x140005858], rsi
mov qword [0x140005868], rdi
test edx, edx
je 0x14000199f
test rbp, rbp
je 0x14000199f
test rsi, rsi
je 0x14000199f
test rdi, rdi
jne 0x1400019d3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r15
pop r13
pop r12
pop rdi
ret
mov edx, dword [0x140005870]
mov rdi, qword [0x140005868]
mov rbp, qword [0x140005860]
mov rsi, qword [0x140005858]
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rbx + 4], r15d
mov r9d, r8d
mov r14d, edx
mov r12d, 0xff
lea r13d, [r8 + 1]
test edx, edx
je 0x140001c8b
nop word [rax + rax]
mov r10d, dword [rbp + r9*4]
mov edx, 0xffffffff
movzx eax, word [rdi + r9*2]
add r10, r11
mov eax, dword [rsi + rax*4]
movzx ecx, byte [r10]
add rax, r11
test cl, cl
je 0x140001acd
nop dword [rax]
nop dword [rax + rax]
movsx ecx, cl
lea r10, [r10 + 1]
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
movzx ecx, byte [r10]
test cl, cl
jne 0x140001a30
not edx
cmp edx, r15d
je 0x140001ae5
inc r9
cmp r9, r14
jb 0x140001a00
jmp 0x140001c8b
mov qword [rbx + 8], rax
movzx ecx, byte [rax]
cmp cl, 0x4c
jne 0x140001b33
cmp byte [rax + 1], 0x8b
jne 0x140001bdb
cmp byte [rax + 2], 0xd1
jne 0x140001bdb
cmp byte [rax + 3], 0xb8
jne 0x140001bdb
cmp byte [rax + 6], r8b
jne 0x140001bdb
cmp byte [rax + 7], r8b
jne 0x140001bdb
movzx edx, byte [rax + 5]
movzx ecx, byte [rax + 4]
shl edx, 8
jmp 0x140001c87
cmp cl, 0xe9
jne 0x140001bdb
movzx edx, r13w
movzx r9d, dx
mov ecx, r9d
shl ecx, 5
cmp byte [rcx + rax], 0x4c
jne 0x140001b73
cmp byte [rcx + rax + 1], 0x8b
jne 0x140001b73
cmp byte [rcx + rax + 2], 0xd1
jne 0x140001b73
cmp byte [rcx + rax + 3], 0xb8
jne 0x140001b73
cmp byte [rcx + rax + 6], r8b
jne 0x140001b73
cmp byte [rcx + rax + 7], r8b
je 0x140001bb6
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd r10, ecx
cmp byte [r10 + rax], 0x4c
jne 0x140001bab
cmp byte [r10 + rax + 1], 0x8b
jne 0x140001bab
cmp byte [r10 + rax + 2], 0xd1
jne 0x140001bab
cmp byte [r10 + rax + 3], 0xb8
jne 0x140001bab
cmp byte [r10 + rax + 6], r8b
jne 0x140001bab
cmp byte [r10 + rax + 7], r8b
je 0x140001bc5
inc dx
cmp dx, r12w
jbe 0x140001b40
jmp 0x140001bdb
movzx edx, byte [rcx + rax + 4]
movzx ecx, byte [rcx + rax + 5]
sub edx, r9d
jmp 0x140001bd4
movzx edx, byte [r10 + rax + 4]
movzx ecx, byte [r10 + rax + 5]
add edx, r9d
shl ecx, 8
or edx, ecx
mov dword [rbx], edx
cmp byte [rax + 3], 0xe9
jne 0x140001c8b
movzx edx, r13w
nop dword [rax]
movzx r9d, dx
mov ecx, r9d
shl ecx, 5
cmp byte [rcx + rax], 0x4c
jne 0x140001c23
cmp byte [rcx + rax + 1], 0x8b
jne 0x140001c23
cmp byte [rcx + rax + 2], 0xd1
jne 0x140001c23
cmp byte [rcx + rax + 3], 0xb8
jne 0x140001c23
cmp byte [rcx + rax + 6], r8b
jne 0x140001c23
cmp byte [rcx + rax + 7], r8b
je 0x140001c66
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd r10, ecx
cmp byte [r10 + rax], 0x4c
jne 0x140001c5b
cmp byte [r10 + rax + 1], 0x8b
jne 0x140001c5b
cmp byte [r10 + rax + 2], 0xd1
jne 0x140001c5b
cmp byte [r10 + rax + 3], 0xb8
jne 0x140001c5b
cmp byte [r10 + rax + 6], r8b
jne 0x140001c5b
cmp byte [r10 + rax + 7], r8b
je 0x140001c75
inc dx
cmp dx, r12w
jbe 0x140001bf0
jmp 0x140001c8b
movzx edx, byte [rcx + rax + 4]
movzx ecx, byte [rcx + rax + 5]
sub edx, r9d
jmp 0x140001c84
movzx edx, byte [r10 + rax + 4]
movzx ecx, byte [r10 + rax + 5]
add edx, r9d
shl ecx, 8
or edx, ecx
mov dword [rbx], edx
mov r9, qword [rbx + 8]
mov r14, qword [rsp + 0x28]
test r9, r9
je 0x14000199f
nop dword [rax]
mov eax, r8d
lea rdx, [r9 + 0xff]
add rdx, rax
cmp byte [rdx], 0xf
jne 0x140001cc1
lea eax, [r8 + 1]
cmp byte [rax + r9 + 0xff], 5
je 0x140001ccb
inc r8d
cmp r8d, r12d
jbe 0x140001ca0
jmp 0x140001ccf
mov qword [rbx + 0x10], rdx
cmp dword [rbx], 0
je 0x14000199f
cmp qword [rbx + 0x10], 0
je 0x14000199f
mov eax, r13d
jmp 0x1400019a1