Function at 0x1400019e0
Capabilities:
Check os version
Encode data using xor
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x10
cmp qword [0x140004230], 0
mov r11, rdx
mov edi, ecx
jne 0x140001ac2
mov rax, qword gs:[0x60]
test rax, rax
je 0x140001e15
cmp dword [rax + 0x118], 0xa
jne 0x140001e15
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov rax, qword [rdx]
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x140001e15
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140001e15
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140001e15
mov r8d, dword [rax + rdx + 0x88]
add r8, rdx
je 0x140001e15
mov qword [0x140004230], rdx
mov ecx, dword [r8 + 0x18]
mov dword [0x140004228], ecx
mov r10d, dword [r8 + 0x20]
add r10, rdx
mov qword [0x140004218], r10
mov r9d, dword [r8 + 0x1c]
add r9, rdx
mov qword [0x140004210], r9
mov r8d, dword [r8 + 0x24]
add r8, rdx
mov qword [0x140004220], r8
test ecx, ecx
je 0x140001e15
test r10, r10
je 0x140001e15
test r9, r9
je 0x140001e15
test r8, r8
je 0x140001e15
test edi, edi
je 0x140001e15
xor r10d, r10d
mov qword [rsp + 0x40], rsi
mov dword [r11 + 4], edi
mov r8d, r10d
mov esi, dword [0x140004228]
mov r12d, 0xff
lea r13d, [r10 + 1]
test rsi, rsi
je 0x140001dbc
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140004230]
mov qword [rsp + 0x38], rbp
mov rbp, qword [0x140004220]
mov qword [rsp + 8], r14
mov r14, qword [0x140004218]
mov qword [rsp], r15
mov r15, qword [0x140004210]
mov r9d, dword [r14 + r8*4]
mov edx, 0xffffffff
movzx eax, word [rbp + r8*2]
add r9, rbx
mov eax, dword [r15 + rax*4]
movzx ecx, byte [r9]
add rax, rbx
test cl, cl
je 0x140001bf3
nop word [rax + rax]
movsx ecx, cl
lea r9, [r9 + 1]
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
movzx ecx, byte [r9]
test cl, cl
jne 0x140001b50
not edx
cmp edx, edi
je 0x140001c04
inc r8
cmp r8, rsi
jb 0x140001b21
jmp 0x140001da9
mov qword [r11 + 8], rax
movzx ecx, byte [rax]
cmp cl, 0x4c
jne 0x140001c57
cmp byte [rax + 1], 0x8b
jne 0x140001d04
cmp byte [rax + 2], 0xd1
jne 0x140001d04
cmp byte [rax + 3], 0xb8
jne 0x140001d04
cmp byte [rax + 6], r10b
jne 0x140001d04
cmp byte [rax + 7], r10b
jne 0x140001d04
movzx edx, byte [rax + 5]
movzx ecx, byte [rax + 4]
shl edx, 8
or edx, ecx
mov dword [r11], edx
jmp 0x140001da9
cmp cl, 0xe9
jne 0x140001d04
movzx edx, r13w
nop dword [rax]
nop dword [rax + rax]
movzx r9d, dx
mov r8d, r9d
shl r8d, 5
add r8, rax
cmp byte [r8], 0x4c
jne 0x140001ca5
cmp byte [r8 + 1], 0x8b
jne 0x140001ca5
cmp byte [r8 + 2], 0xd1
jne 0x140001ca5
cmp byte [r8 + 3], 0xb8
jne 0x140001ca5
cmp byte [r8 + 6], r10b
jne 0x140001ca5
cmp byte [r8 + 7], r10b
je 0x140001ce5
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd r8, ecx
add r8, rax
cmp byte [r8], 0x4c
jne 0x140001cda
cmp byte [r8 + 1], 0x8b
jne 0x140001cda
cmp byte [r8 + 2], 0xd1
jne 0x140001cda
cmp byte [r8 + 3], 0xb8
jne 0x140001cda
cmp byte [r8 + 6], r10b
jne 0x140001cda
cmp byte [r8 + 7], r10b
je 0x140001cef
inc dx
cmp dx, r12w
jbe 0x140001c70
jmp 0x140001d04
movzx edx, byte [r8 + 4]
sub edx, r9d
jmp 0x140001cf7
movzx edx, byte [r8 + 4]
add edx, r9d
movzx ecx, byte [r8 + 5]
shl ecx, 8
or edx, ecx
mov dword [r11], edx
cmp byte [rax + 3], 0xe9
jne 0x140001da9
movzx r8d, r13w
nop dword [rax]
nop word [rax + rax]
movzx r9d, r8w
mov edx, r9d
shl edx, 5
add rdx, rax
cmp byte [rdx], 0x4c
jne 0x140001d50
cmp byte [rdx + 1], 0x8b
jne 0x140001d50
cmp byte [rdx + 2], 0xd1
jne 0x140001d50
cmp byte [rdx + 3], 0xb8
jne 0x140001d50
cmp byte [rdx + 6], r10b
jne 0x140001d50
cmp byte [rdx + 7], r10b
je 0x140001d8d
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd rdx, ecx
add rdx, rax
cmp byte [rdx], 0x4c
jne 0x140001d81
cmp byte [rdx + 1], 0x8b
jne 0x140001d81
cmp byte [rdx + 2], 0xd1
jne 0x140001d81
cmp byte [rdx + 3], 0xb8
jne 0x140001d81
cmp byte [rdx + 6], r10b
jne 0x140001d81
cmp byte [rdx + 7], r10b
je 0x140001d96
inc r8w
cmp r8w, r12w
jbe 0x140001d20
jmp 0x140001da9
movzx ecx, byte [rdx + 4]
sub ecx, r9d
jmp 0x140001d9d
movzx ecx, byte [rdx + 4]
add ecx, r9d
movzx eax, byte [rdx + 5]
shl eax, 8
or ecx, eax
mov dword [r11], ecx
mov r14, qword [rsp + 8]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov r8, qword [r11 + 8]
mov rsi, qword [rsp + 0x40]
test r8, r8
je 0x140001e15
nop word [rax + rax]
mov edx, r10d
lea ecx, [r10 + 1]
add rdx, r12
add rdx, r8
cmp byte [rdx], 0xf
jne 0x140001ded
cmp byte [rcx + r8 + 0xff], 5
je 0x140001df7
mov r10d, ecx
cmp ecx, r12d
jbe 0x140001dd0
jmp 0x140001dfb
mov qword [r11 + 0x10], rdx
cmp dword [r11], 0
je 0x140001e15
cmp qword [r11 + 0x10], 0
je 0x140001e15
mov eax, r13d
add rsp, 0x10
pop r13
pop r12
pop rdi
ret
xor eax, eax
add rsp, 0x10
pop r13
pop r12
pop rdi
ret