Function at 0x140001000
Capabilities:
Check os version
Encode data using xor
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x10
cmp qword [0x140003170], 0
mov r11, rdx
mov edi, ecx
jne 0x1400010e2
mov rax, qword gs:[0x60]
test rax, rax
je 0x140001435
cmp dword [rax + 0x118], 0xa
jne 0x140001435
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov rax, qword [rdx]
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x140001435
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140001435
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140001435
mov r8d, dword [rax + rdx + 0x88]
add r8, rdx
je 0x140001435
mov qword [0x140003170], rdx
mov ecx, dword [r8 + 0x18]
mov dword [0x140003168], ecx
mov r10d, dword [r8 + 0x20]
add r10, rdx
mov qword [0x140003158], r10
mov r9d, dword [r8 + 0x1c]
add r9, rdx
mov qword [0x140003150], r9
mov r8d, dword [r8 + 0x24]
add r8, rdx
mov qword [0x140003160], r8
test ecx, ecx
je 0x140001435
test r10, r10
je 0x140001435
test r9, r9
je 0x140001435
test r8, r8
je 0x140001435
test edi, edi
je 0x140001435
xor r10d, r10d
mov qword [rsp + 0x40], rsi
mov dword [r11 + 4], edi
mov r8d, r10d
mov esi, dword [0x140003168]
mov r12d, 0xff
lea r13d, [r10 + 1]
test rsi, rsi
je 0x1400013dc
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140003170]
mov qword [rsp + 0x38], rbp
mov rbp, qword [0x140003160]
mov qword [rsp + 8], r14
mov r14, qword [0x140003158]
mov qword [rsp], r15
mov r15, qword [0x140003150]
mov r9d, dword [r14 + r8*4]
mov edx, 0xffffffff
movzx eax, word [rbp + r8*2]
add r9, rbx
mov eax, dword [r15 + rax*4]
movzx ecx, byte [r9]
add rax, rbx
test cl, cl
je 0x140001213
nop word [rax + rax]
movsx ecx, cl
lea r9, [r9 + 1]
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, r13d
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, r13d
neg edx
and edx, 0xedb88320
xor edx, ecx
movzx ecx, byte [r9]
test cl, cl
jne 0x140001170
not edx
cmp edx, edi
je 0x140001224
inc r8
cmp r8, rsi
jb 0x140001141
jmp 0x1400013c9
mov qword [r11 + 8], rax
movzx ecx, byte [rax]
cmp cl, 0x4c
jne 0x140001277
cmp byte [rax + 1], 0x8b
jne 0x140001324
cmp byte [rax + 2], 0xd1
jne 0x140001324
cmp byte [rax + 3], 0xb8
jne 0x140001324
cmp byte [rax + 6], r10b
jne 0x140001324
cmp byte [rax + 7], r10b
jne 0x140001324
movzx edx, byte [rax + 5]
movzx ecx, byte [rax + 4]
shl edx, 8
or edx, ecx
mov dword [r11], edx
jmp 0x1400013c9
cmp cl, 0xe9
jne 0x140001324
movzx edx, r13w
nop dword [rax]
nop dword [rax + rax]
movzx r9d, dx
mov r8d, r9d
shl r8d, 5
add r8, rax
cmp byte [r8], 0x4c
jne 0x1400012c5
cmp byte [r8 + 1], 0x8b
jne 0x1400012c5
cmp byte [r8 + 2], 0xd1
jne 0x1400012c5
cmp byte [r8 + 3], 0xb8
jne 0x1400012c5
cmp byte [r8 + 6], r10b
jne 0x1400012c5
cmp byte [r8 + 7], r10b
je 0x140001305
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd r8, ecx
add r8, rax
cmp byte [r8], 0x4c
jne 0x1400012fa
cmp byte [r8 + 1], 0x8b
jne 0x1400012fa
cmp byte [r8 + 2], 0xd1
jne 0x1400012fa
cmp byte [r8 + 3], 0xb8
jne 0x1400012fa
cmp byte [r8 + 6], r10b
jne 0x1400012fa
cmp byte [r8 + 7], r10b
je 0x14000130f
inc dx
cmp dx, r12w
jbe 0x140001290
jmp 0x140001324
movzx edx, byte [r8 + 4]
sub edx, r9d
jmp 0x140001317
movzx edx, byte [r8 + 4]
add edx, r9d
movzx ecx, byte [r8 + 5]
shl ecx, 8
or edx, ecx
mov dword [r11], edx
cmp byte [rax + 3], 0xe9
jne 0x1400013c9
movzx r8d, r13w
nop dword [rax]
nop word [rax + rax]
movzx r9d, r8w
mov edx, r9d
shl edx, 5
add rdx, rax
cmp byte [rdx], 0x4c
jne 0x140001370
cmp byte [rdx + 1], 0x8b
jne 0x140001370
cmp byte [rdx + 2], 0xd1
jne 0x140001370
cmp byte [rdx + 3], 0xb8
jne 0x140001370
cmp byte [rdx + 6], r10b
jne 0x140001370
cmp byte [rdx + 7], r10b
je 0x1400013ad
mov ecx, r9d
neg ecx
shl ecx, 5
movsxd rdx, ecx
add rdx, rax
cmp byte [rdx], 0x4c
jne 0x1400013a1
cmp byte [rdx + 1], 0x8b
jne 0x1400013a1
cmp byte [rdx + 2], 0xd1
jne 0x1400013a1
cmp byte [rdx + 3], 0xb8
jne 0x1400013a1
cmp byte [rdx + 6], r10b
jne 0x1400013a1
cmp byte [rdx + 7], r10b
je 0x1400013b6
inc r8w
cmp r8w, r12w
jbe 0x140001340
jmp 0x1400013c9
movzx ecx, byte [rdx + 4]
sub ecx, r9d
jmp 0x1400013bd
movzx ecx, byte [rdx + 4]
add ecx, r9d
movzx eax, byte [rdx + 5]
shl eax, 8
or ecx, eax
mov dword [r11], ecx
mov r14, qword [rsp + 8]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov r8, qword [r11 + 8]
mov rsi, qword [rsp + 0x40]
test r8, r8
je 0x140001435
nop word [rax + rax]
mov edx, r10d
lea ecx, [r10 + 1]
add rdx, r12
add rdx, r8
cmp byte [rdx], 0xf
jne 0x14000140d
cmp byte [rcx + r8 + 0xff], 5
je 0x140001417
mov r10d, ecx
cmp ecx, r12d
jbe 0x1400013f0
jmp 0x14000141b
mov qword [r11 + 0x10], rdx
cmp dword [r11], 0
je 0x140001435
cmp qword [r11 + 0x10], 0
je 0x140001435
mov eax, r13d
add rsp, 0x10
pop r13
pop r12
pop rdi
ret
xor eax, eax
add rsp, 0x10
pop r13
pop r12
pop rdi
ret