Function at 0x140004470
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Get common file path
Overwrite dll .text section to remove hooks
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [0x140009470]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x88], rax
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r9d, 0x18
lea r8, [rsp + 0xa0]
mov rdx, qword [rsp + 0x88]
mov rcx, 0xffffffffffffffff
call sub.KERNEL32.dll_K32GetModuleInformation
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x58], rax
dec qword [rsp + 0x58]
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x1400044f7
mov rax, qword [rsp + 0x58]
lea rcx, str._ntdll.dll
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
xor eax, eax
mov word [rsp + 0x40], ax
jmp 0x1400045f1
movzx eax, word [rsp + 0x40]
inc ax
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x140004718
lfence
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x70]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rsp + 0x40]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
lea rcx, str..text
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140004655
inc rax
test dl, dl
jne 0x140004642
xor eax, eax
jmp 0x14000465a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140004713
lfence
movzx eax, word [rsp + 0x40]
mov ecx, eax
call fcn.140001e10
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x60]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x98]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x48]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x60]
add rdi, rdx
mov rdx, rdi
mov rdi, rdx
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x60]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x68], eax
jmp 0x1400045e4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x1d8
pop rdi
pop rsi
ret