Function at 0x140017e70
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x140061740]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
mov byte [rcx + 0x616], 0
add rcx, 0x300
lea rdi, [rbx + 0x716]
mov rdx, rdi
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140017eb0
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rcx + 0x515], al
test al, al
jne 0x140017ed0
cmp dword [0x140065dbc], 0
mov eax, dword [rbx + 0x500]
mov dword [rbx + 0x924], eax
mov eax, dword [rbx + 0x508]
mov dword [rbx + 0x91c], eax
mov eax, dword [rbx + 0x504]
mov dword [rbx + 0x918], eax
jne 0x140017f9e
lea rdx, str..minergate.com
mov rcx, rbx
nop dword [rax]
call fcn.14002ee68
test rax, rax
jne 0x1400182d9
lea rdx, str.suprnova.cc
mov rcx, rbx
call fcn.14002ee68
test rax, rax
jne 0x140018297
lea rdx, str.miningpoolhub.com
mov rcx, rbx
call fcn.14002ee68
test rax, rax
jne 0x140018297
lea rdx, str..nicehash.com
mov rcx, rbx
call fcn.14002ee68
test rax, rax
jne 0x140018237
cmp byte [rbx + 0x200], 0x34
je 0x14001807b
lea r8, str.Wrong_Monero_wallet_address____allpools_1__option_will_be_enabled_automatically__read_Readme_for_details._n
lea edx, [rax + 3]
xor ecx, ecx
call fcn.14000f050
mov dword [0x140065dbc], 1
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, rax
mov eax, 0xaaaaaaab
shr r8d, 0x10
mul r8d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub r8d, ecx
je 0x1400183c2
dec r8d
je 0x14001831b
dec r8d
jne 0x14001842d
mov rax, qword [str.cryptonight.usa.nicehash.com]
mov qword [rbx + 0x516], rax
mov rax, qword [0x140057428]
mov qword [rbx + 0x51e], rax
mov rax, qword [0x140057430]
mov qword [rbx + 0x526], rax
mov eax, dword [0x140057438]
mov dword [rbx + 0x52e], eax
movzx eax, byte [0x14005743c]
mov dword [rbx + 0x924], 0xd1b
mov byte [rbx + 0x532], al
mov rax, qword [str.1LmMNkiEvjapn5PRY8A9wypcWJveRrRGWr]
mov qword [rbx + 0x616], rax
mov rax, qword [0x140057448]
mov qword [rbx + 0x61e], rax
mov rax, qword [0x140057450]
mov qword [rbx + 0x626], rax
mov rax, qword [0x140057458]
mov qword [rbx + 0x62e], rax
movzx eax, word [0x140057460]
mov word [rbx + 0x636], ax
movzx eax, byte [0x140057462]
mov byte [rbx + 0x638], al
jmp 0x14001841d
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, rax
mov eax, 0xaaaaaaab
shr r8d, 0x14
mul r8d
xor eax, eax
shr edx, 1
lea ecx, [rdx + rdx*2]
lea rdx, sym.NsGpuCNMiner.exe_8_e_FT___30Dcpnn_XO00j_y7o3WE34G6t9IPnCn
sub r8d, ecx
je 0x1400181d7
dec r8d
je 0x140018177
dec r8d
mov r8d, eax
je 0x140018120
nop dword [rax + rax]
movzx ecx, byte [r8 + rdx + 0x575f0]
test al, 1
je 0x1400180d2
xor cl, 1
jmp 0x1400180d5
xor cl, 3
inc eax
mov byte [rsp + r8 + 0x20], cl
inc r8
cmp eax, 0x5f
jl 0x1400180c0
lea rax, [rsp + 0x20]
mov byte [rsp + 0x7f], 0
lea rcx, [rsp + 0x20]
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rbx + rcx + 0x615], al
test al, al
jne 0x140018100
jmp 0x14001842d
movzx ecx, byte [r8 + rdx + 0x57590]
test al, 1
je 0x140018132
xor cl, 1
jmp 0x140018135
xor cl, 3
inc eax
mov byte [rsp + r8 + 0x20], cl
inc r8
cmp eax, 0x5f
jl 0x140018120
lea rax, [rsp + 0x20]
mov byte [rsp + 0x7f], 0
lea rcx, [rsp + 0x20]
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rbx + rcx + 0x615], al
test al, al
jne 0x140018160
jmp 0x14001842d
mov r8, rax
nop word [rax + rax]
movzx ecx, byte [r8 + rdx + 0x57530]
test al, 1
je 0x140018192
xor cl, 1
jmp 0x140018195
xor cl, 3
inc eax
mov byte [rsp + r8 + 0x20], cl
inc r8
cmp eax, 0x5f
jl 0x140018180
lea rax, [rsp + 0x20]
mov byte [rsp + 0x7f], 0
lea rcx, [rsp + 0x20]
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rbx + rcx + 0x615], al
test al, al
jne 0x1400181c0
jmp 0x14001842d
mov r8, rax
nop word [rax + rax]
movzx ecx, byte [r8 + rdx + 0x574d0]
test al, 1
je 0x1400181f2
xor cl, 1
jmp 0x1400181f5
xor cl, 3
inc eax
mov byte [rsp + r8 + 0x20], cl
inc r8
cmp eax, 0x5f
jl 0x1400181e0
lea rax, [rsp + 0x20]
mov byte [rsp + 0x7f], 0
lea rcx, [rsp + 0x20]
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rbx + rcx + 0x615], al
test al, al
jne 0x140018220
jmp 0x14001842d
mov rax, qword [str.1LmMNkiEvjapn5PRY8A9wypcWJveRrRGWr]
mov qword [rbx + 0x616], rax
mov rax, qword [0x140057448]
mov qword [rbx + 0x61e], rax
mov rax, qword [0x140057450]
mov qword [rbx + 0x626], rax
mov rax, qword [0x140057458]
mov qword [rbx + 0x62e], rax
movzx eax, word [0x140057460]
mov word [rbx + 0x636], ax
movzx eax, byte [0x140057462]
mov byte [rbx + 0x638], al
mov eax, 0x78
mov word [rdi], ax
jmp 0x14001842d
mov rax, qword [str.claymore.cnfee]
mov qword [rbx + 0x616], rax
mov eax, dword [0x1400573e8]
mov dword [rbx + 0x61e], eax
movzx eax, word [0x1400573ec]
mov word [rbx + 0x622], ax
movzx eax, byte [0x1400573ee]
mov byte [rbx + 0x624], al
mov eax, 0x78
mov word [rdi], ax
jmp 0x14001842d
mov rax, qword [str.vasrashpil_gmail.com]
mov qword [rbx + 0x616], rax
mov rax, qword [0x140057480]
mov qword [rbx + 0x61e], rax
mov eax, dword [0x140057488]
mov dword [rbx + 0x626], eax
movzx eax, byte [0x14005748c]
mov byte [rbx + 0x62a], al
mov eax, 0x78
mov word [rdi], ax
jmp 0x14001842d
mov rax, qword [str.us_east.cryptonight_hub.miningpoolhub.com]
mov qword [rbx + 0x516], rax
mov rax, qword [0x1400573f8]
mov qword [rbx + 0x51e], rax
mov rax, qword [0x140057400]
mov qword [rbx + 0x526], rax
mov rax, qword [0x140057408]
mov qword [rbx + 0x52e], rax
mov rax, qword [0x140057410]
mov qword [rbx + 0x536], rax
movzx eax, word [0x140057418]
mov dword [rbx + 0x924], 0x5064
mov word [rbx + 0x53e], ax
mov rax, qword [str.claymore.cnfee]
mov qword [rbx + 0x616], rax
mov eax, dword [0x1400573e8]
mov dword [rbx + 0x61e], eax
movzx eax, word [0x1400573ec]
mov word [rbx + 0x622], ax
movzx eax, byte [0x1400573ee]
mov dword [rbx + 0x91c], 1
mov byte [rbx + 0x624], al
mov eax, 0x78
mov word [rdi], ax
jmp 0x14001842d
mov rax, qword [str.xmr.suprnova.cc]
mov qword [rbx + 0x516], rax
mov rax, qword [0x1400573d8]
mov dword [rbx + 0x924], 0x1466
mov qword [rbx + 0x51e], rax
mov rax, qword [str.claymore.cnfee]
mov qword [rbx + 0x616], rax
mov eax, dword [0x1400573e8]
mov dword [rbx + 0x61e], eax
movzx eax, word [0x1400573ec]
mov word [rbx + 0x622], ax
movzx eax, byte [0x1400573ee]
mov byte [rbx + 0x624], al
mov eax, 0x78
mov word [rdi], ax
xor eax, eax
mov dword [rbx + 0x91c], eax
mov al, 1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14002e450
mov rbx, qword [rsp + 0x118]
add rsp, 0x100
pop rdi
ret