Function at 0x140016790
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x228]
sub rsp, 0x320
mov rax, qword [0x14005b740]
xor rax, rsp
mov qword [rbp + 0x200], rax
cmp byte [0x14005f520], 0
jne 0x140016bdb
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
xor ecx, ecx
mov qword [r11 - 0x18], r15
lea r12, sym.ZecMiner64.exe__Co9eEk_rc_U8Qzt_M_rBCXNPgLr_62n_K__
nop word [rax + rax]
movzx eax, byte [rcx + r12 + 0x60020]
lea rcx, [rcx + 1]
mov byte [rbp + rcx + 0xcf], al
test al, al
jne 0x1400167e0
lea rcx, [rbp + 0xd0]
mov dword [rbp + 0x60], 0x2a2e2a
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140016810
lea r8, [rbp + 0x60]
xor edx, edx
movzx eax, byte [r8 + rdx]
lea rdx, [rdx + 1]
mov byte [rcx + rdx - 1], al
test al, al
jne 0x140016820
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xd0]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140016bc3
mov qword [rsp + 0x330], rbx
mov qword [rsp + 0x338], rsi
mov qword [rsp + 0x318], r14
nop word [rax + rax]
xor edx, edx
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rcx + r12 + 0x52168]
test dl, 1
je 0x140016892
xor al, 1
jmp 0x140016894
xor al, 3
inc edx
mov byte [rbp + rcx + 0x60], al
inc rcx
cmp edx, 0xd
jl 0x140016880
lea rcx, [rsp + 0x4c]
mov byte [rbp + 0x6d], 0
xor ebx, ebx
call fcn.14002d9f4
mov rsi, rax
test rax, rax
je 0x140016913
lea rcx, [rbp + 0x60]
call fcn.14002d9f4
mov r14, rax
test rax, rax
je 0x140016904
mov rcx, rax
call fcn.140041fbc
mov rcx, rsi
mov rbx, rax
call fcn.140041fbc
mov rdx, rbx
mov rcx, rax
call fcn.14002b57c
mov rbx, rax
test rax, rax
je 0x1400168fc
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002b484
mov rcx, rsi
call fcn.14002b484
test rbx, rbx
je 0x140016913
inc edi
xor edx, edx
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rcx + r12 + 0x52178]
test dl, 1
je 0x140016932
xor al, 1
jmp 0x140016934
xor al, 3
inc edx
mov byte [rbp + rcx + 0x60], al
inc rcx
cmp edx, 0xf
jl 0x140016920
lea rcx, [rsp + 0x4c]
mov byte [rbp + 0x6f], 0
xor ebx, ebx
call fcn.14002d9f4
mov rsi, rax
test rax, rax
je 0x1400169b3
lea rcx, [rbp + 0x60]
call fcn.14002d9f4
mov r14, rax
test rax, rax
je 0x1400169a4
mov rcx, rax
call fcn.140041fbc
mov rcx, rsi
mov rbx, rax
call fcn.140041fbc
mov rdx, rbx
mov rcx, rax
call fcn.14002b57c
mov rbx, rax
test rax, rax
je 0x14001699c
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002b484
mov rcx, rsi
call fcn.14002b484
test rbx, rbx
je 0x1400169b3
inc edi
lea rcx, [rsp + 0x4c]
mov dword [rbp + 0x60], 0x776f6843
mov dword [rbp + 0x64], 0x78652e6e
mov word [rbp + 0x68], 0x65
xor ebx, ebx
call fcn.14002d9f4
mov rsi, rax
test rax, rax
je 0x140016a34
lea rcx, [rbp + 0x60]
call fcn.14002d9f4
mov r14, rax
test rax, rax
je 0x140016a25
mov rcx, rax
call fcn.140041fbc
mov rcx, rsi
mov rbx, rax
call fcn.140041fbc
mov rdx, rbx
mov rcx, rax
call fcn.14002b57c
mov rbx, rax
test rax, rax
je 0x140016a1d
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002b484
mov rcx, rsi
call fcn.14002b484
test rbx, rbx
je 0x140016a34
inc edi
xor edx, edx
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rcx + r12 + 0x52188]
test dl, 1
je 0x140016a52
xor al, 1
jmp 0x140016a54
xor al, 3
inc edx
mov byte [rbp + rcx + 0x60], al
inc rcx
cmp edx, 0x16
jl 0x140016a40
lea rcx, [rsp + 0x4c]
mov byte [rbp + 0x76], 0
xor ebx, ebx
call fcn.14002d9f4
mov rsi, rax
test rax, rax
je 0x140016ad3
lea rcx, [rbp + 0x60]
call fcn.14002d9f4
mov r14, rax
test rax, rax
je 0x140016ac4
mov rcx, rax
call fcn.140041fbc
mov rcx, rsi
mov rbx, rax
call fcn.140041fbc
mov rdx, rbx
mov rcx, rax
call fcn.14002b57c
mov rbx, rax
test rax, rax
je 0x140016abc
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002b484
mov rcx, rsi
call fcn.14002b484
test rbx, rbx
je 0x140016ad3
inc edi
xor edx, edx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [rax + r12 + 0x521a0]
test dl, 1
je 0x140016af3
xor cl, 1
jmp 0x140016af6
xor cl, 3
inc edx
mov byte [rbp + rax + 0x60], cl
inc rax
cmp edx, 0xe
jl 0x140016ae0
lea rcx, [rsp + 0x4c]
mov byte [rbp + 0x6e], 0
xor ebx, ebx
call fcn.14002d9f4
mov rsi, rax
test rax, rax
je 0x140016b75
lea rcx, [rbp + 0x60]
call fcn.14002d9f4
mov r14, rax
test rax, rax
je 0x140016b66
mov rcx, rax
call fcn.140041fbc
mov rcx, rsi
mov rbx, rax
call fcn.140041fbc
mov rdx, rbx
mov rcx, rax
call fcn.14002b57c
mov rbx, rax
test rax, rax
je 0x140016b5e
lea rcx, [rsp + 0x4c]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.14002b484
mov rcx, rsi
call fcn.14002b484
test rbx, rbx
je 0x140016b75
inc edi
lea rdx, [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140016870
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, byte [0x14005f520]
mov r14, qword [rsp + 0x318]
mov rsi, qword [rsp + 0x338]
mov rbx, qword [rsp + 0x330]
mov ecx, 1
test edi, edi
cmovg eax, ecx
mov byte [0x14005f520], al
mov r12, qword [rsp + 0x348]
mov rdi, qword [rsp + 0x340]
mov r15, qword [rsp + 0x310]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14002aed0
add rsp, 0x320
pop rbp
ret