Function at 0x180006f70
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
jmp 0x180006f70
push rdi
sub rsp, 0x1b0
lea rdi, [rsp + 0x40]
mov ecx, 0x5c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x18003c038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x148]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x148]
call fcn.180007640
mov rcx, rax
call fcn.18000119a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x68], rax
mov r9d, 0x18
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffffffffffff
call sub.KERNEL32.dll_K32GetModuleInformation
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x149]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x149]
call fcn.180007730
mov rcx, rax
call fcn.1800015aa
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1800011fe
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.1800011fe
nop
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x100], 0
jmp 0x180007138
mov eax, dword [rsp + 0x100]
inc eax
mov dword [rsp + 0x100], eax
movzx eax, byte [0x18003c011]
movsx eax, al
mov dword [rsp + 0x150], eax
movzx ecx, byte [0x18003c014]
movsx ecx, cl
mov dword [rsp + 0x154], ecx
call fcn.180003730
movsx eax, al
mov dword [rsp + 0x158], eax
call fcn.180003740
movsx eax, al
shl eax, 1
mov ecx, dword [rsp + 0x158]
imul eax, ecx
mov dword [rsp + 0x15c], eax
call fcn.180003770
movsx eax, al
movzx ecx, byte [0x18003c015]
movsx ecx, cl
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x15c]
add eax, ecx
xor edx, edx
mov ecx, dword [rsp + 0x154]
div ecx
mov ecx, dword [rsp + 0x150]
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.180003790
cmp dword [rsp + 0x100], eax
jge 0x1800074c8
xor eax, eax
mov word [rsp + 0x104], ax
jmp 0x1800071ef
movzx eax, word [rsp + 0x104]
inc ax
mov word [rsp + 0x104], ax
mov rax, qword [rsp + 0xf8]
movzx eax, word [rax + 6]
movzx ecx, word [rsp + 0x104]
cmp ecx, eax
jge 0x1800074c3
movzx eax, word [rsp + 0x104]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xf8]
movzx ecx, word [rcx + 0x14]
mov rdx, qword [rsp + 0xf8]
lea rcx, [rdx + rcx + 0x18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x108], rax
movzx eax, byte [0x18003c011]
movsx eax, al
mov dword [rsp + 0x160], eax
movzx ecx, byte [0x18003c014]
movsx ecx, cl
mov dword [rsp + 0x164], ecx
call fcn.180003730
movsx eax, al
mov dword [rsp + 0x168], eax
call fcn.180003740
movsx eax, al
shl eax, 3
mov ecx, dword [rsp + 0x168]
imul eax, ecx
mov dword [rsp + 0x16c], eax
call fcn.180003770
movsx eax, al
movzx ecx, byte [0x18003c015]
movsx ecx, cl
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x16c]
add eax, ecx
xor edx, edx
mov ecx, dword [rsp + 0x164]
div ecx
mov ecx, dword [rsp + 0x160]
sub eax, ecx
test eax, eax
je 0x1800074be
lea rax, [rsp + 0x14a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x14a]
call fcn.180007820
mov rcx, rax
call fcn.180001555
mov rcx, qword [rsp + 0x108]
mov rdx, rax
call sub.ucrtbased.dll_strcmp
test eax, eax
jne 0x180007319
mov qword [rsp + 0x170], 1
jmp 0x180007325
mov qword [rsp + 0x170], 0
movzx eax, byte [0x18003c011]
movsx eax, al
mov dword [rsp + 0x178], eax
movzx ecx, byte [0x18003c014]
movsx ecx, cl
mov dword [rsp + 0x17c], ecx
call fcn.180003730
movsx eax, al
mov dword [rsp + 0x180], eax
call fcn.180003740
movsx eax, al
imul eax, eax, 9
mov ecx, dword [rsp + 0x180]
imul eax, ecx
mov dword [rsp + 0x184], eax
call fcn.180003770
movsx eax, al
movzx ecx, byte [0x18003c015]
movsx ecx, cl
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x184]
add eax, ecx
xor edx, edx
mov ecx, dword [rsp + 0x17c]
div ecx
mov ecx, dword [rsp + 0x178]
sub eax, ecx
mov dword [rsp + 0x188], eax
cvtsi2sd xmm0, qword [rsp + 0x170]
call fcn.180003790
mov ecx, dword [rsp + 0x188]
imul eax, ecx
test eax, eax
je 0x1800074be
xor eax, eax
cmp eax, 4
je 0x1800074be
mov dword [rsp + 0x124], 0
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x108]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x80]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x124]
mov r8d, 0x40
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x134], eax
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x108]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0xe8]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x108]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x80]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x190], rdx
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x190]
mov rcx, rax
call fcn.1800010f0
nop
jmp 0x180007482
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x108]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x80]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x124]
mov r8d, dword [rsp + 0x124]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1800071dc
jmp 0x180007128
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x138], 0
jmp 0x1800074f0
mov eax, dword [rsp + 0x138]
inc eax
mov dword [rsp + 0x138], eax
movzx eax, byte [0x18003c011]
movsx eax, al
mov dword [rsp + 0x198], eax
movzx ecx, byte [0x18003c014]
movsx ecx, cl
mov dword [rsp + 0x19c], ecx
call fcn.180003730
movsx eax, al
mov dword [rsp + 0x1a0], eax
call fcn.180003740
movsx eax, al
imul eax, eax, 0xa
mov ecx, dword [rsp + 0x1a0]
imul eax, ecx
mov dword [rsp + 0x1a4], eax
call fcn.180003770
movsx eax, al
movzx ecx, byte [0x18003c015]
movsx ecx, cl
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1a4]
add eax, ecx
xor edx, edx
mov ecx, dword [rsp + 0x19c]
div ecx
mov ecx, dword [rsp + 0x198]
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.180003790
cmp dword [rsp + 0x138], eax
jge 0x1800075e2
mov dword [rsp + 0x13c], 0
jmp 0x1800075a2
cmp dword [rsp + 0x13c], 0x1d
jae 0x1800075dd
mov dword [rsp + 0x14c], 0
lea rcx, [rsp + 0xd8]
call fcn.1800013b6
nop
lea rcx, [rsp + 0xb8]
call fcn.1800013b6
mov eax, dword [rsp + 0x14c]
jmp 0x1800075fd
jmp 0x1800074e0
lea rcx, [rsp + 0xd8]
call fcn.1800013b6
nop
lea rcx, [rsp + 0xb8]
call fcn.1800013b6
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180021f18]
call fcn.180001582
mov rax, rdi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.180001348
add rsp, 0x1b0
pop rdi
ret