Function at 0x14000f300
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x248]
sub rsp, 0x320
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rsi, rcx
mov ebx, 0x270f
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000f365
mov eax, 0x1f40
jmp 0x14000f588
mov dword [rbp - 0x30], 0x238
lea rdx, [rbp - 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000f586
mov r8d, 0x2d
xor r14d, r14d
nop dword [rax]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov dword [rbp - 0x80], 0x14002d
mov dword [rbp - 0x7c], 0x1c0018
mov dword [rbp - 0x78], 0x80053
mov dword [rbp - 0x74], 0x40053
mov dword [rbp - 0x70], 0x530003
mov dword [rbp - 0x6c], 0x54
mov dword [rbp - 0x68], 0x5c000a
mov dword [rbp - 0x64], 0xf000e
mov dword [rbp - 0x60], 0xf0004
mov dword [rbp - 0x5c], 0x5d000e
mov dword [rbp - 0x58], 0x700078
mov dword [rbp - 0x54], 0x720074
mov dword [rbp - 0x50], 0x710025
mov dword [rbp - 0x4c], 0x77007f
mov dword [rbp - 0x48], 0x71007b
mov dword [rbp - 0x44], 0x7d0079
mov dword [rbp - 0x40], 0x79
mov eax, r14d
nop
lea edx, [rax + 1]
movsxd rcx, edx
add ax, r8w
xor word [rbp + rcx*2 - 0x80], ax
movsxd rax, edx
cmp rax, 0x20
jae 0x14000f43f
movzx r8d, word [rbp - 0x80]
jmp 0x14000f420
mov word [rbp - 0x3e], r14w
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r14
mov word [rsp + 0x48], r14w
cmp word [rbp - 0x7e], 0
jne 0x14000f464
mov r8, r14
jmp 0x14000f47b
lea rax, [rbp - 0x7e]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000f470
lea rdx, [rbp - 0x7e]
lea rcx, [rsp + 0x48]
call fcn.140007090
nop
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r14
mov word [rsp + 0x20], r14w
cmp word [rbp - 4], 0
jne 0x14000f4aa
mov r8, r14
jmp 0x14000f4bd
lea rax, [rbp - 4]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000f4b2
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x20]
call fcn.140007090
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140010c30
test eax, eax
jne 0x14000f57f
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r14
mov word [rsp + 0x20], r14w
cmp word [rbp - 4], 0
jne 0x14000f510
mov r8, r14
jmp 0x14000f52b
lea rax, [rbp - 4]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000f520
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x20]
call fcn.140007090
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140010090
cmp eax, 0x270f
je 0x14000f55a
cmp ebx, 0x270f
cmove ebx, eax
lea rdx, [rbp - 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
mov r8d, 0x2d
jne 0x14000f390
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f586
mov eax, 0x15b3
jmp 0x14000f588
mov eax, ebx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14012a1e0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret