Function at 0x435da0
Capabilities:
Create process on windows
Manipulate user privileges

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
mov eax, 1
mov r15, rcx
mov rsi, rdx
test rcx, rcx
jne 0x435dd7
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rbp, [rsp + 0x60]
call r13
mov r12, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov r8, rbp
mov edx, 0x28
mov rcx, rax
call r12
test eax, eax
je 0x435e26
xor ecx, ecx
lea r8, [rsp + 0x94]
lea rdx, [0x0078f530]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea rdi, [rsp + 0x90]
test eax, eax
jne 0x435f15
call fcn.004309a0
xor edx, edx
lea r8, str.Attempting_to_elevate_to_admin_because_we_need_to_grant_fast_memory_privileges.
mov rcx, rax
call fcn.00430850
call fcn.0041fb70
test eax, eax
jne 0x435f83
call fcn.0040acc0
cmp byte [rax + 0x1f4], 0
je 0x435faa
call fcn.0040acc0
mov rbx, rax
call fcn.0040acc0
mov r14, rax
call fcn.0041fb70
test eax, eax
jne 0x435f83
lea rdi, [rsp + 0x98]
mov ecx, 0x1a
lea rdx, str.runas
rep stosd dword [rdi], eax
mov qword [rsp + 0xa0], rdx
movabs rax, 0x4000000070
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
mov r8, qword [r14 + 0x1a0]
mov qword [rsp + 0xa8], r8
mov r9, qword [rbx + 0x1c0]
mov dword [rsp + 0xc0], 5
mov qword [rsp + 0xb0], r9
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x435f83
call fcn.004309a0
lea r8, str.This_window_has_been_opened_because_xmr_stak_needed_to_run_as_administrator.__It_can_be_safely_closed_now.
xor edx, edx
mov rcx, rax
call fcn.00430850
or edx, 0xffffffff
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call sub.msvcrt.dll_exit
xor r9d, r9d
xor edx, edx
mov r8, rdi
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x90], 1
mov dword [rsp + 0x9c], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x435e26
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x435e26
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x007ac788], 1
mov rax, r15
jmp 0x435dc3
call r13
lea r8, [rsp + 0x38]
mov edx, 8
mov rcx, rax
call r12
sub eax, 1
je 0x435fca
lea rdx, str.Obtaining_SeLockMemoryPrivilege_failed.
xor r15d, r15d
mov qword [rsi], rdx
jmp 0x435f7b
call fcn.004309a0
lea r8, str.The_miner_needs_to_run_as_administrator__but_you_passed___noUAC_option._Please_remove_it_or_set_use_slow_memory_to_always.
xor edx, edx
mov rcx, rax
call fcn.00430850
mov ecx, 1
call fcn.00435d70
lea r15, [rsp + 0x48]
lea r13, [rsp + 0x50]
mov rbx, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], r13
mov r9d, 4
mov r8, r15
mov edx, 0x14
mov rcx, qword [rsp + 0x38]
call rbx
test eax, eax
je 0x4360b2
mov r12d, dword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rbp
call rbx
mov edx, dword [rsp + 0x60]
test r12d, r12d
je 0x436036
test edx, edx
jne 0x436046
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x435f9b
mov ecx, 0x40
mov rdi, rbp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0x60]
mov edx, 1
mov rcx, qword [rsp + 0x38]
mov r12, rax
mov r8, rax
mov qword [rsp + 0x20], rbp
call rbx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x435f9b
mov ecx, 0xc
xor eax, eax
lea r9, [rsp + 0x40]
mov r8d, 0xf0fff
mov rdx, rbp
rep stosd dword [rdi], eax
call sub.ADVAPI32.dll_LsaOpenPolicy
mov rcx, r12
test eax, eax
je 0x4360d6
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x435f9b
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
call rbx
jmp 0x436036
mov rcx, qword [rsp + 0x40]
lea r10, str.SeLockMemoryPrivilege
mov r8, r15
mov qword [rsp + 0x48], 0
mov rdx, qword [r12]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x58], r10
mov dword [rsp + 0x50], 0x2c002a
mov dword [rsp + 0x34], 0
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
jne 0x436183
mov ebp, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x48]
movzx r15d, word [rsp + 0x50]
xor ebx, ebx
mov r14, qword [rsp + 0x58]
jmp 0x436131
add rbx, 1
mov r11, rbx
cmp rbp, rbx
jbe 0x43617b
shl r11, 4
cmp word [rdi + r11], r15w
jne 0x43612d
mov rcx, qword [rdi + r11 + 8]
mov r8d, 0x2a
mov rdx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x43612d
mov rcx, rdi
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x40]
call sub.ADVAPI32.dll_LsaClose
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x435f9b
mov rcx, rdi
call sub.ADVAPI32.dll_LsaFreeMemory
mov rdx, qword [r12]
mov rcx, qword [rsp + 0x40]
mov r8, r13
mov r9d, 1
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, qword [rsp + 0x40]
mov r13d, eax
call sub.ADVAPI32.dll_LsaClose
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, str.Added_SeLockMemoryPrivilege_to_the_current_account._You_need_to_reboot_for_it_to_work
test r13d, r13d
jne 0x435f9b
mov qword [rsi], rcx
xor r15d, r15d
mov dword [0x007ac788], 1
jmp 0x435f7b