Function at 0x140001000
Capabilities:
Check os version
Encode data using xor
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r13
cmp qword [0x140004160], 0
mov rbx, rdx
mov esi, ecx
jne 0x1400010de
mov rax, qword gs:[0x60]
test rax, rax
je 0x140001450
cmp dword [rax + 0x118], 0xa
jne 0x140001450
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov rax, qword [rdx]
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x140001450
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140001450
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140001450
mov r8d, dword [rax + rdx + 0x88]
add r8, rdx
je 0x140001450
mov qword [0x140004160], rdx
mov ecx, dword [r8 + 0x18]
mov dword [0x140004158], ecx
mov r10d, dword [r8 + 0x20]
add r10, rdx
mov qword [0x140004148], r10
mov r9d, dword [r8 + 0x1c]
add r9, rdx
mov qword [0x140004140], r9
mov r8d, dword [r8 + 0x24]
add r8, rdx
mov qword [0x140004150], r8
test ecx, ecx
je 0x140001450
test r10, r10
je 0x140001450
test r9, r9
je 0x140001450
test r8, r8
je 0x140001450
test esi, esi
je 0x140001450
xor r11d, r11d
mov qword [rsp + 0x28], rbp
mov dword [rbx + 4], esi
mov r10d, r11d
mov ebp, dword [0x140004158]
mov r13d, 0xff
lea edi, [r11 + 1]
test rbp, rbp
je 0x140001228
mov rdi, qword [0x140004160]
mov qword [rsp + 0x30], r12
mov r12, qword [0x140004140]
mov qword [rsp + 0x38], r14
mov r14, qword [0x140004150]
mov qword [rsp + 0x40], r15
mov r15, qword [0x140004148]
nop dword [rax + rax]
movzx eax, word [r14 + r10*2]
mov edx, 0xffffffff
mov r9d, dword [r15 + r10*4]
add r9, rdi
mov r8d, dword [r12 + rax*4]
add r8, rdi
movsx eax, byte [r9]
test eax, eax
je 0x140001208
nop dword [rax]
nop dword [rax + rax]
xor edx, eax
lea r9, [r9 + 1]
mov ecx, edx
mov eax, edx
shl eax, 0x1f
sar eax, 0x1f
and eax, 0x77073096
shl ecx, 0x18
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, eax
mov eax, edx
shl eax, 0x1d
sar eax, 0x1f
and eax, 0x76dc419
xor ecx, eax
mov eax, edx
shl eax, 0x19
sar eax, 0x1f
and eax, 0x76dc4190
xor ecx, eax
mov eax, edx
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor ecx, eax
mov eax, edx
shl eax, 0x1e
sar eax, 0x1f
and eax, 0xee0e612c
xor ecx, eax
mov eax, edx
shl eax, 0x1b
sar eax, 0x1f
and eax, 0x1db71064
xor ecx, eax
mov eax, edx
shl eax, 0x1c
sar eax, 0x1f
and eax, 0xedb8832
xor ecx, eax
mov eax, edx
shr eax, 8
mov edx, ecx
xor edx, eax
movsx eax, byte [r9]
test eax, eax
jne 0x140001170
not edx
cmp edx, esi
je 0x14000126e
inc r10
cmp r10, rbp
jb 0x140001140
mov edi, 1
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
mov r15, qword [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rbp, qword [rsp + 0x28]
test r8, r8
je 0x140001450
nop word [rax + rax]
mov edx, r11d
lea ecx, [r11 + 1]
add rdx, r13
add rdx, r8
cmp byte [rdx], 0xf
jne 0x140001261
cmp byte [rcx + r8 + 0xff], 5
je 0x140001438
mov r11d, ecx
cmp ecx, r13d
jbe 0x140001240
jmp 0x14000143c
mov qword [rbx + 8], r8
movzx eax, byte [r8]
cmp al, 0x4c
jne 0x1400012ca
cmp byte [r8 + 1], 0x8b
jne 0x140001374
cmp byte [r8 + 2], 0xd1
jne 0x140001374
cmp byte [r8 + 3], 0xb8
jne 0x140001374
cmp byte [r8 + 6], r11b
jne 0x140001374
mov edi, 1
cmp byte [r8 + 7], r11b
jne 0x140001379
movzx ecx, byte [r8 + 5]
movzx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [rbx], ecx
jmp 0x140001219
mov edi, 1
cmp al, 0xe9
jne 0x140001379
movzx ecx, di
nop word [rax + rax]
movzx r9d, cx
mov edx, r9d
shl edx, 5
add rdx, r8
cmp byte [rdx], 0x4c
jne 0x140001310
cmp byte [rdx + 1], 0x8b
jne 0x140001310
cmp byte [rdx + 2], 0xd1
jne 0x140001310
cmp byte [rdx + 3], 0xb8
jne 0x140001310
cmp byte [rdx + 6], r11b
jne 0x140001310
cmp byte [rdx + 7], r11b
je 0x14000134c
mov eax, r9d
neg eax
shl eax, 5
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], 0x4c
jne 0x140001341
cmp byte [rdx + 1], 0x8b
jne 0x140001341
cmp byte [rdx + 2], 0xd1
jne 0x140001341
cmp byte [rdx + 3], 0xb8
jne 0x140001341
cmp byte [rdx + 6], r11b
jne 0x140001341
cmp byte [rdx + 7], r11b
je 0x140001360
inc cx
cmp cx, r13w
jbe 0x1400012e0
jmp 0x140001379
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
sub ecx, r9d
shl eax, 8
or ecx, eax
mov dword [rbx], ecx
jmp 0x140001379
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
add ecx, r9d
shl eax, 8
or ecx, eax
mov dword [rbx], ecx
jmp 0x140001379
mov edi, 1
cmp byte [r8 + 3], 0xe9
jne 0x140001219
movzx ecx, di
nop word [rax + rax]
movzx r9d, cx
mov eax, r9d
shl eax, 5
cmp byte [rax + r8], 0x4c
jne 0x1400013c7
cmp byte [rax + r8 + 1], 0x8b
jne 0x1400013c7
cmp byte [rax + r8 + 2], 0xd1
jne 0x1400013c7
cmp byte [rax + r8 + 3], 0xb8
jne 0x1400013c7
cmp byte [rax + r8 + 6], r11b
jne 0x1400013c7
cmp byte [rax + r8 + 7], r11b
je 0x140001406
mov eax, r9d
neg eax
shl eax, 5
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], 0x4c
jne 0x1400013f8
cmp byte [rdx + 1], 0x8b
jne 0x1400013f8
cmp byte [rdx + 2], 0xd1
jne 0x1400013f8
cmp byte [rdx + 3], 0xb8
jne 0x1400013f8
cmp byte [rdx + 6], r11b
jne 0x1400013f8
cmp byte [rdx + 7], r11b
je 0x140001421
inc cx
cmp cx, r13w
jbe 0x140001390
jmp 0x140001219
movzx edx, byte [rax + r8 + 5]
movzx ecx, byte [rax + r8 + 4]
shl edx, 8
sub ecx, r9d
or edx, ecx
mov dword [rbx], edx
jmp 0x140001219
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
add ecx, r9d
shl eax, 8
or ecx, eax
mov dword [rbx], ecx
jmp 0x140001219
mov qword [rbx + 0x10], rdx
cmp dword [rbx], 0
je 0x140001450
cmp qword [rbx + 0x10], 0
je 0x140001450
mov eax, edi
pop r13
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
pop r13
pop rdi
pop rsi
pop rbx
ret