Function at 0x140001000
Capabilities:
Check os version
Encode data using xor
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r15
mov r11, qword [0x140005660]
mov rbx, rdx
mov r15d, ecx
test r11, r11
jne 0x1400010e8
mov rax, qword gs:[0x60]
test rax, rax
je 0x1400010cf
cmp dword [rax + 0x118], 0xa
jne 0x1400010cf
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov rax, qword [rdx]
mov r11, qword [rax + 0x20]
test r11, r11
je 0x1400010cf
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x1400010cf
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x1400010cf
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
je 0x1400010cf
mov edx, dword [rcx + 0x18]
mov ebp, dword [rcx + 0x20]
mov esi, dword [rcx + 0x1c]
add rbp, r11
mov edi, dword [rcx + 0x24]
add rsi, r11
add rdi, r11
mov qword [0x140005660], r11
mov dword [0x140005658], edx
mov qword [0x140005648], rbp
mov qword [0x140005640], rsi
mov qword [0x140005650], rdi
test edx, edx
je 0x1400010cf
test rbp, rbp
je 0x1400010cf
test rsi, rsi
je 0x1400010cf
test rdi, rdi
jne 0x140001103
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r15
pop r13
pop r12
pop rdi
ret
mov edx, dword [0x140005658]
mov rdi, qword [0x140005650]
mov rbp, qword [0x140005648]
mov rsi, qword [0x140005640]
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rbx + 4], r15d
mov r9d, r8d
mov r14d, edx
mov r12d, 0xff
lea r13d, [r8 + 1]
test edx, edx
je 0x1400013bb
nop word [rax + rax]
mov r10d, dword [rbp + r9*4]
mov edx, 0xffffffff
movzx eax, word [rdi + r9*2]
add r10, r11
mov eax, dword [rsi + rax*4]
movzx ecx, byte [r10]
add rax, r11
test cl, cl
je 0x1400011fd
nop dword [rax]
nop dword [rax + rax]
movsx ecx, cl
lea r10, [r10 + 1]
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
movzx ecx, byte [r10]
test cl, cl
jne 0x140001160
not edx
cmp edx, r15d
je 0x140001215
inc r9
cmp r9, r14
jb 0x140001130
jmp 0x1400013bb
mov qword [rbx + 8], rax
movzx ecx, byte [rax]
cmp cl, 0x4c
jne 0x140001263
cmp byte [rax + 1], 0x8b
jne 0x14000130b
cmp byte [rax + 2], 0xd1
jne 0x14000130b
cmp byte [rax + 3], 0xb8
jne 0x14000130b
cmp byte [rax + 6], r8b
jne 0x14000130b
cmp byte [rax + 7], r8b
jne 0x14000130b
movzx edx, byte [rax + 5]
movzx ecx, byte [rax + 4]
shl edx, 8
jmp 0x1400013b7
cmp cl, 0xe9
jne 0x14000130b
movzx edx, r13w
movzx r9d, dx
mov ecx, r9d
shl ecx, 5
cmp byte [rcx + rax], 0x4c
jne 0x1400012a3
cmp byte [rcx + rax + 1], 0x8b
jne 0x1400012a3
cmp byte [rcx + rax + 2], 0xd1
jne 0x1400012a3
cmp byte [rcx + rax + 3], 0xb8
jne 0x1400012a3
cmp byte [rcx + rax + 6], r8b
jne 0x1400012a3
cmp byte [rcx + rax + 7], r8b
je 0x1400012e6
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd r10, ecx
cmp byte [r10 + rax], 0x4c
jne 0x1400012db
cmp byte [r10 + rax + 1], 0x8b
jne 0x1400012db
cmp byte [r10 + rax + 2], 0xd1
jne 0x1400012db
cmp byte [r10 + rax + 3], 0xb8
jne 0x1400012db
cmp byte [r10 + rax + 6], r8b
jne 0x1400012db
cmp byte [r10 + rax + 7], r8b
je 0x1400012f5
inc dx
cmp dx, r12w
jbe 0x140001270
jmp 0x14000130b
movzx edx, byte [rcx + rax + 4]
movzx ecx, byte [rcx + rax + 5]
sub edx, r9d
jmp 0x140001304
movzx edx, byte [r10 + rax + 4]
movzx ecx, byte [r10 + rax + 5]
add edx, r9d
shl ecx, 8
or edx, ecx
mov dword [rbx], edx
cmp byte [rax + 3], 0xe9
jne 0x1400013bb
movzx edx, r13w
nop dword [rax]
movzx r9d, dx
mov ecx, r9d
shl ecx, 5
cmp byte [rcx + rax], 0x4c
jne 0x140001353
cmp byte [rcx + rax + 1], 0x8b
jne 0x140001353
cmp byte [rcx + rax + 2], 0xd1
jne 0x140001353
cmp byte [rcx + rax + 3], 0xb8
jne 0x140001353
cmp byte [rcx + rax + 6], r8b
jne 0x140001353
cmp byte [rcx + rax + 7], r8b
je 0x140001396
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd r10, ecx
cmp byte [r10 + rax], 0x4c
jne 0x14000138b
cmp byte [r10 + rax + 1], 0x8b
jne 0x14000138b
cmp byte [r10 + rax + 2], 0xd1
jne 0x14000138b
cmp byte [r10 + rax + 3], 0xb8
jne 0x14000138b
cmp byte [r10 + rax + 6], r8b
jne 0x14000138b
cmp byte [r10 + rax + 7], r8b
je 0x1400013a5
inc dx
cmp dx, r12w
jbe 0x140001320
jmp 0x1400013bb
movzx edx, byte [rcx + rax + 4]
movzx ecx, byte [rcx + rax + 5]
sub edx, r9d
jmp 0x1400013b4
movzx edx, byte [r10 + rax + 4]
movzx ecx, byte [r10 + rax + 5]
add edx, r9d
shl ecx, 8
or edx, ecx
mov dword [rbx], edx
mov r9, qword [rbx + 8]
mov r14, qword [rsp + 0x28]
test r9, r9
je 0x1400010cf
nop dword [rax]
mov eax, r8d
lea rdx, [r9 + 0xff]
add rdx, rax
cmp byte [rdx], 0xf
jne 0x1400013f1
lea eax, [r8 + 1]
cmp byte [rax + r9 + 0xff], 5
je 0x1400013fb
inc r8d
cmp r8d, r12d
jbe 0x1400013d0
jmp 0x1400013ff
mov qword [rbx + 0x10], rdx
cmp dword [rbx], 0
je 0x1400010cf
cmp qword [rbx + 0x10], 0
je 0x1400010cf
mov eax, r13d
jmp 0x1400010d1