Function at 0x18006f680
Capabilities:
Create thread
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
call fcn.180045de0
mov qword [rax + 0xd88], rbx
mov edi, 0x5a4d
xor ebp, ebp
cmp word [rbx], di
je 0x18006f6c8
mov ebx, ebp
jmp 0x18006f6de
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
je 0x18006f6da
mov rbx, rbp
jmp 0x18006f6de
mov ebx, dword [rax + rbx + 0x50]
call fcn.180045de0
mov qword [rax + 0xd90], rbx
call fcn.180045de0
mov rcx, qword [rax + 0xd50]
mov rbx, rbp
cmp word [rcx], di
jne 0x18006f70f
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x18006f70f
mov ebx, dword [rax + rcx + 0x50]
call fcn.180045de0
mov qword [rax + 0xd98], rbx
call fcn.180045de0
mov rcx, rax
call fcn.18002e4a0
test al, al
je 0x18006f97e
call fcn.180045de0
mov rsi, rax
call fcn.180045de0
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2 + 0x1608], bp
jne 0x18006f750
lea rdx, [rsi + 0x1608]
mov rcx, rax
call fcn.18001f720
call fcn.180045de0
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2 + 0xe08], bp
jne 0x18006f780
lea rdx, [rsi + 0xe08]
lea rcx, [rax + 0x78e0]
call fcn.18001f720
call fcn.180045de0
call fcn.180045de0
mov r8, rbx
nop
inc r8
cmp word [rsi + r8*2 + 0x1108], bp
jne 0x18006f7b0
lea rdx, [rsi + 0x1108]
lea rcx, [rax + 0x7900]
call fcn.18001f720
call fcn.180045de0
call fcn.180045de0
mov r8, rbx
nop
inc r8
cmp word [rsi + r8*2 + 0x1408], bp
jne 0x18006f7e0
lea rdx, [rsi + 0x1408]
lea rcx, [rax + 0x7920]
call fcn.18001f720
call fcn.180045de0
call fcn.180045de0
lea rcx, [rax + 0x7940]
xor r8d, r8d
lea rdx, [0x180169b10]
call fcn.18001f720
call fcn.180045de0
nop word [rax + rax]
inc rbx
cmp word [rsi + rbx*2 + 0x1508], bp
jne 0x18006f830
mov r8, rbx
lea rdx, [rsi + 0x1508]
lea rcx, [rax + 0x448]
call fcn.18001f720
call fcn.180045de0
mov edx, 1
mov rcx, rax
call fcn.18002e840
call fcn.180045de0
mov rcx, rax
call fcn.18002e6d0
call fcn.180045de0
call fcn.180045de0
mov rcx, rax
call fcn.180044f50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x40]
mov ecx, 0x7b797e
call fcn.18004ac10
call fcn.180045de0
mov edi, dword [rax + 0xd90]
call fcn.180045de0
mov rbx, qword [rax + 0xd88]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x44], rbx
mov dword [rsp + 0x4c], edi
lea rdx, [rsp + 0x40]
mov ecx, 0x7b7974
call fcn.18004ac10
call fcn.180008ca0
mov rbx, rax
mov rax, qword [rax + 0xec8]
test rax, rax
jne 0x18006f92f
lea ecx, [rax + 0x38]
call fcn.1800f2748
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rcx
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
mov word [rax + 0x20], cx
mov dword [rax + 0x30], ebp
mov qword [rax + 0x28], rbp
mov byte [rax + 0x34], cl
mov qword [rbx + 0xec8], rax
mov rdx, qword [rbx + 0xf10]
add rdx, qword [rbx + 0xf08]
mov r9d, dword [rbx + 0xf18]
mov r8, qword [rbx + 0xef8]
mov rcx, rax
call fcn.1800709d0
call fcn.180008ca0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, qword [rax + 0xf20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800f23a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret