Function at 0x1800029a0
Capabilities:
Allocate or change rwx memory
Create thread
Get os information via kuser_shared_data
Resume thread
Set console window title
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x530
mov rax, qword [0x180057040]
xor rax, rsp
mov qword [rsp + 0x520], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ebx, ebx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x18004d85c]
lea rdx, str.CONIN_
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x18004d868]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x18004d868]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
lea rcx, str.t.me_redderonline
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.___Allocating_memory..._n
call fcn.180002940
movabs rdi, 0x23b66b0000
mov edx, 0x1bbc000
mov rcx, rdi
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180002ab4
mov r9d, 0x10
lea r8, str._t.me_redderonline__aimware_crack_engine_error
lea rdx, str.Core_initialization_failure._Diagnostic_code:_BA_1
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0xffffecc9
movabs dword [0xdeadfeed], eax
mov edx, 0x1bbc000
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x180cc1578], rax
test rax, rax
jne 0x180002b03
mov r9d, 0x10
lea r8, str._t.me_redderonline__aimware_crack_engine_error
lea rdx, str.Core_initialization_failure._Diagnostic_code:_BA_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0xffffecc9
movabs dword [0xdeadfeed], eax
lea rcx, str.___Memory_allocated__n
call fcn.180002940
lea rcx, str.___Copying_binary..._n
call fcn.180002940
mov r8d, 0xc69750
lea rdx, [0x1800572e0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x180cc1578]
lea rdx, [0x1800572e0]
mov r8d, 0xc69750
call sub.VCRUNTIME140.dll_memcpy
lea rcx, str.___Binary_copied__n
call fcn.180002940
call fcn.180002c80
lea rcx, str.___Finalizing..._n
call fcn.180002940
movsxd rax, dword [0x7ffe0260]
mov qword [0x180cc1590], rax
call fcn.18002c370
lea rdx, [0x180027010]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
lea rcx, str.___Registered_VEH_n
call fcn.180002940
lea rcx, str.___Creating_EP_thread__n
call fcn.180002940
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], 4
movabs r8, 0x23b686145e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.___Thread_created__n
mov rbx, rax
call fcn.180002940
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov eax, 0xf0000040
mov dword [rsp + 0x80], 0x100010
lea rdx, [rsp + 0x50]
mov qword [rsp + 0xc0], rax
mov rcx, rbx
mov qword [rsp + 0xb0], 0x7ffe0260
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x180002c4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____SetThreadContext_failure__Error:__lu_n
call fcn.180002940
mov r9d, 0x10
lea r8, str._t.me_redderonline__aimware_crack_engine_error
lea rdx, str.Core_initialization_failure._Diagnostic_code:_STBNH
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.___NtBuildNumber_hooked__n
call fcn.180002940
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, str.___Thread_resumed__n
call fcn.180002940
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180002c70