Function at 0x14001d360
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x228]
sub rsp, 0x320
mov rax, qword [0x140061740]
xor rax, rsp
mov qword [rbp + 0x200], rax
cmp byte [0x140065326], 0
jne 0x14001d7ab
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
xor ecx, ecx
mov qword [r11 - 0x18], r15
lea r12, sym.NsGpuCNMiner.exe_8_e_FT___30Dcpnn_XO00j_y7o3WE34G6t9IPnCn
nop word [rax + rax]
movzx eax, byte [rcx + r12 + 0x66780]
lea rcx, [rcx + 1]
mov byte [rbp + rcx + 0xcf], al
test al, al
jne 0x14001d3b0
lea rcx, [rbp + 0xd0]
mov dword [rbp + 0x60], 0x2a2e2a
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14001d3e0
lea r8, [rbp + 0x60]
xor edx, edx
movzx eax, byte [r8 + rdx]
lea rdx, [rdx + 1]
mov byte [rcx + rdx - 1], al
test al, al
jne 0x14001d3f0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xd0]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14001d793
mov qword [rsp + 0x330], rbx
mov qword [rsp + 0x338], rsi
mov qword [rsp + 0x318], r14
nop word [rax + rax]
xor edx, edx
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rcx + r12 + 0x58538]
test dl, 1
je 0x14001d462
xor al, 1
jmp 0x14001d464
xor al, 3
inc edx
mov byte [rbp + rcx + 0x60], al
inc rcx
cmp edx, 0xd
jl 0x14001d450
lea rcx, [rsp + 0x4c]
mov byte [rbp + 0x6d], 0
xor ebx, ebx
call fcn.140031500
mov rsi, rax
test rax, rax
je 0x14001d4e3
lea rcx, [rbp + 0x60]
call fcn.140031500
mov r14, rax
test rax, rax
je 0x14001d4d4
mov rcx, rax
call fcn.140044440
mov rcx, rsi
mov rbx, rax
call fcn.140044440
mov rdx, rbx
mov rcx, rax
call fcn.14002ee68
mov rbx, rax
test rax, rax
je 0x14001d4cc
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002ed70
mov rcx, rsi
call fcn.14002ed70
test rbx, rbx
je 0x14001d4e3
inc edi
xor edx, edx
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rcx + r12 + 0x58548]
test dl, 1
je 0x14001d502
xor al, 1
jmp 0x14001d504
xor al, 3
inc edx
mov byte [rbp + rcx + 0x60], al
inc rcx
cmp edx, 0xf
jl 0x14001d4f0
lea rcx, [rsp + 0x4c]
mov byte [rbp + 0x6f], 0
xor ebx, ebx
call fcn.140031500
mov rsi, rax
test rax, rax
je 0x14001d583
lea rcx, [rbp + 0x60]
call fcn.140031500
mov r14, rax
test rax, rax
je 0x14001d574
mov rcx, rax
call fcn.140044440
mov rcx, rsi
mov rbx, rax
call fcn.140044440
mov rdx, rbx
mov rcx, rax
call fcn.14002ee68
mov rbx, rax
test rax, rax
je 0x14001d56c
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002ed70
mov rcx, rsi
call fcn.14002ed70
test rbx, rbx
je 0x14001d583
inc edi
lea rcx, [rsp + 0x4c]
mov dword [rbp + 0x60], 0x776f6843
mov dword [rbp + 0x64], 0x78652e6e
mov word [rbp + 0x68], 0x65
xor ebx, ebx
call fcn.140031500
mov rsi, rax
test rax, rax
je 0x14001d604
lea rcx, [rbp + 0x60]
call fcn.140031500
mov r14, rax
test rax, rax
je 0x14001d5f5
mov rcx, rax
call fcn.140044440
mov rcx, rsi
mov rbx, rax
call fcn.140044440
mov rdx, rbx
mov rcx, rax
call fcn.14002ee68
mov rbx, rax
test rax, rax
je 0x14001d5ed
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002ed70
mov rcx, rsi
call fcn.14002ed70
test rbx, rbx
je 0x14001d604
inc edi
xor edx, edx
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rcx + r12 + 0x58558]
test dl, 1
je 0x14001d622
xor al, 1
jmp 0x14001d624
xor al, 3
inc edx
mov byte [rbp + rcx + 0x60], al
inc rcx
cmp edx, 0x16
jl 0x14001d610
lea rcx, [rsp + 0x4c]
mov byte [rbp + 0x76], 0
xor ebx, ebx
call fcn.140031500
mov rsi, rax
test rax, rax
je 0x14001d6a3
lea rcx, [rbp + 0x60]
call fcn.140031500
mov r14, rax
test rax, rax
je 0x14001d694
mov rcx, rax
call fcn.140044440
mov rcx, rsi
mov rbx, rax
call fcn.140044440
mov rdx, rbx
mov rcx, rax
call fcn.14002ee68
mov rbx, rax
test rax, rax
je 0x14001d68c
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002ed70
mov rcx, rsi
call fcn.14002ed70
test rbx, rbx
je 0x14001d6a3
inc edi
xor edx, edx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [rax + r12 + 0x58570]
test dl, 1
je 0x14001d6c3
xor cl, 1
jmp 0x14001d6c6
xor cl, 3
inc edx
mov byte [rbp + rax + 0x60], cl
inc rax
cmp edx, 0xe
jl 0x14001d6b0
lea rcx, [rsp + 0x4c]
mov byte [rbp + 0x6e], 0
xor ebx, ebx
call fcn.140031500
mov rsi, rax
test rax, rax
je 0x14001d745
lea rcx, [rbp + 0x60]
call fcn.140031500
mov r14, rax
test rax, rax
je 0x14001d736
mov rcx, rax
call fcn.140044440
mov rcx, rsi
mov rbx, rax
call fcn.140044440
mov rdx, rbx
mov rcx, rax
call fcn.14002ee68
mov rbx, rax
test rax, rax
je 0x14001d72e
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002ed70
mov rcx, rsi
call fcn.14002ed70
test rbx, rbx
je 0x14001d745
inc edi
lea rdx, [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14001d440
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, byte [0x140065326]
mov r14, qword [rsp + 0x318]
mov rsi, qword [rsp + 0x338]
mov rbx, qword [rsp + 0x330]
mov ecx, 1
test edi, edi
cmovg eax, ecx
mov byte [0x140065326], al
mov r12, qword [rsp + 0x348]
mov rdi, qword [rsp + 0x340]
mov r15, qword [rsp + 0x310]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14002e450
add rsp, 0x320
pop rbp
ret