Function at 0x180006f40
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x198
mov rax, qword [0x180029010]
xor rax, rsp
mov qword [rsp + 0x188], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x54]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x180006f80
jmp 0x180006fc6
mov dword [rsp + 0x30], 0
jmp 0x180006f94
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x30], eax
jge 0x180006fc6
movsxd rax, dword [rsp + 0x30]
lea rdx, str._pwatest
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + rax*8]
call fcn.180006730
test rax, rax
je 0x180006fc4
mov byte [0x18002b04b], 1
jmp 0x180006f8a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
lea r8, [rsp + 0xa8]
lea rdx, str..text
lea rcx, str.client.dll
call fcn.180006e30
movzx eax, byte [rsp + 0x1a0]
test eax, eax
je 0x180007711
lea rcx, str.steamclient64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180007711
mov byte [rsp + 0xf0], 0x48
mov byte [rsp + 0xf1], 0x83
mov byte [rsp + 0xf2], 0xec
mov byte [rsp + 0xf3], 0x38
mov byte [rsp + 0xf4], 0x48
mov byte [rsp + 0xf5], 0x8b
mov byte [rsp + 0xf6], 0x49
mov byte [rsp + 0xf7], 8
mov byte [rsp + 0xf8], 0x48
mov byte [rsp + 0xf9], 0x8b
mov byte [rsp + 0xfa], 0x44
mov byte [rsp + 0xfb], 0x24
mov byte [rsp + 0xfc], 0x60
mov byte [rsp + 0xfd], 0x48
mov byte [rsp + 0xfe], 0x89
mov byte [rsp + 0xff], 0x44
mov byte [rsp + 0x100], 0x24
mov byte [rsp + 0x101], 0x28
mov byte [rsp + 0x102], 0x44
mov byte [rsp + 0x103], 0x89
mov byte [rsp + 0x104], 0x4c
mov byte [rsp + 0x105], 0x24
mov byte [rsp + 0x106], 0x20
mov byte [rsp + 0x107], 0x4d
mov byte [rsp + 0x108], 0x8b
mov byte [rsp + 0x109], 0xc8
mov byte [rsp + 0x10a], 0x4c
mov byte [rsp + 0x10b], 0x8b
mov byte [rsp + 0x10c], 0x11
mov byte [rsp + 0x10d], 0x4c
mov byte [rsp + 0x10e], 0x8b
mov byte [rsp + 0x10f], 0xc2
mov rax, qword [rsp + 0x48]
add rax, 0x1000
mov r9d, 0x20
lea r8, [rsp + 0xf0]
mov edx, 0x901ab7
mov rcx, rax
call fcn.1800050a0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x180007196
mov rax, qword [rsp + 0x40]
add rax, 0x1d
mov qword [rsp + 0xb0], rax
mov r8d, 0xe
lea rdx, [0x18000799b]
mov rcx, qword [rsp + 0xb0]
call fcn.180004ec0
jmp 0x1800075da
movzx eax, byte [0x18002b04b]
test eax, eax
je 0x1800071b6
xor r9d, r9d
xor r8d, r8d
lea rdx, str.new_steamclient64
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov byte [rsp + 0x130], 0x48
mov byte [rsp + 0x131], 0x83
mov byte [rsp + 0x132], 0xec
mov byte [rsp + 0x133], 0x38
mov byte [rsp + 0x134], 0x48
mov byte [rsp + 0x135], 0x8b
mov byte [rsp + 0x136], 0x49
mov byte [rsp + 0x137], 8
mov byte [rsp + 0x138], 0x48
mov byte [rsp + 0x139], 0x8b
mov byte [rsp + 0x13a], 1
mov byte [rsp + 0x13b], 0x4c
mov byte [rsp + 0x13c], 0x8b
mov byte [rsp + 0x13d], 0x50
mov byte [rsp + 0x13e], 0x10
mov byte [rsp + 0x13f], 0x48
mov byte [rsp + 0x140], 0x8b
mov byte [rsp + 0x141], 0x44
mov byte [rsp + 0x142], 0x24
mov byte [rsp + 0x143], 0x60
mov byte [rsp + 0x144], 0x48
mov byte [rsp + 0x145], 0x89
mov byte [rsp + 0x146], 0x44
mov byte [rsp + 0x147], 0x24
mov byte [rsp + 0x148], 0x28
mov byte [rsp + 0x149], 0x44
mov byte [rsp + 0x14a], 0x89
mov byte [rsp + 0x14b], 0x4c
mov byte [rsp + 0x14c], 0x24
mov byte [rsp + 0x14d], 0x20
mov byte [rsp + 0x14e], 0x4d
mov byte [rsp + 0x14f], 0x8b
mov byte [rsp + 0x150], 0xc8
mov byte [rsp + 0x151], 0x4c
mov byte [rsp + 0x152], 0x8b
mov byte [rsp + 0x153], 0xc2
mov rax, qword [rsp + 0x48]
add rax, 0x1000
mov r9d, 0x24
lea r8, [rsp + 0x130]
mov edx, 0x901ab7
mov rcx, rax
call fcn.1800050a0
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1800075ba
movzx eax, byte [0x18002b04b]
test eax, eax
je 0x18000732d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.find_signature_code
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov byte [rsp + 0x158], 0x48
mov byte [rsp + 0x159], 0x83
mov byte [rsp + 0x15a], 0xec
mov byte [rsp + 0x15b], 0x38
mov byte [rsp + 0x15c], 0x48
mov byte [rsp + 0x15d], 0x8b
mov byte [rsp + 0x15e], 0x49
mov byte [rsp + 0x15f], 8
mov byte [rsp + 0x160], 0x48
mov byte [rsp + 0x161], 0x8b
mov byte [rsp + 0x162], 0x44
mov byte [rsp + 0x163], 0x24
mov byte [rsp + 0x164], 0x60
mov byte [rsp + 0x165], 0x48
mov byte [rsp + 0x166], 0x89
mov byte [rsp + 0x167], 0x44
mov byte [rsp + 0x168], 0x24
mov byte [rsp + 0x169], 0x28
mov byte [rsp + 0x16a], 0x44
mov byte [rsp + 0x16b], 0x89
mov byte [rsp + 0x16c], 0x4c
mov byte [rsp + 0x16d], 0x24
mov byte [rsp + 0x16e], 0x20
mov byte [rsp + 0x16f], 0x4d
mov byte [rsp + 0x170], 0x8b
mov byte [rsp + 0x171], 0xc8
mov byte [rsp + 0x172], 0x4c
mov byte [rsp + 0x173], 0x8b
mov byte [rsp + 0x174], 0x11
mov byte [rsp + 0x175], 0x4c
mov byte [rsp + 0x176], 0x8b
mov byte [rsp + 0x177], 0xc2
mov byte [rsp + 0x178], 0x33
mov byte [rsp + 0x179], 0xd2
mov byte [rsp + 0x17a], 0x41
mov byte [rsp + 0x17b], 0xff
mov byte [rsp + 0x17c], 0x52
mov byte [rsp + 0x17d], 0x10
mov byte [rsp + 0x17e], 0x48
mov byte [rsp + 0x17f], 0x83
mov byte [rsp + 0x180], 0xc4
mov byte [rsp + 0x181], 0x38
mov byte [rsp + 0x182], 0xc3
lea r9, [rsp + 0x98]
mov r8d, 0x40
mov edx, 0x2b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180007598
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 0x2b
lea r8, [rsp + 0x158]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, byte [0x18002b04b]
test eax, eax
je 0x1800074f6
xor r9d, r9d
xor r8d, r8d
lea rdx, str.virtual_protect_successfully
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [rsp + 0x48]
add rax, 0x1000
mov r9d, 0x20
lea r8, [rsp + 0xf0]
mov edx, 0x901ab7
mov rcx, rax
call fcn.1800050a0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x180007576
movzx eax, byte [0x18002b04b]
test eax, eax
je 0x180007549
xor r9d, r9d
xor r8d, r8d
lea rdx, str.find_addr_recvpkg_ex
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [rsp + 0x40]
add rax, 0x1d
mov qword [rsp + 0xb8], rax
mov r8d, 0xe
lea rdx, [0x18000799b]
mov rcx, qword [rsp + 0xb8]
call fcn.180004ec0
jmp 0x180007596
movzx eax, byte [0x18002b04b]
test eax, eax
je 0x180007596
xor r9d, r9d
xor r8d, r8d
lea rdx, str.can_not_find_addr_recvpkg_ex
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1800075b8
movzx eax, byte [0x18002b04b]
test eax, eax
je 0x1800075b8
xor r9d, r9d
xor r8d, r8d
lea rdx, str.can_not_virtual_protect
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1800075da
movzx eax, byte [0x18002b04b]
test eax, eax
je 0x1800075da
xor r9d, r9d
xor r8d, r8d
lea rdx, str.can_not_find_signature_code
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov byte [rsp + 0x110], 0x48
mov byte [rsp + 0x111], 0x83
mov byte [rsp + 0x112], 0xec
mov byte [rsp + 0x113], 0x38
mov byte [rsp + 0x114], 0x48
mov byte [rsp + 0x115], 0x8b
mov byte [rsp + 0x116], 0x49
mov byte [rsp + 0x117], 8
mov byte [rsp + 0x118], 0x44
mov byte [rsp + 0x119], 0x89
mov byte [rsp + 0x11a], 0x4c
mov byte [rsp + 0x11b], 0x24
mov byte [rsp + 0x11c], 0x20
mov byte [rsp + 0x11d], 0x4d
mov byte [rsp + 0x11e], 0x8b
mov byte [rsp + 0x11f], 0xc8
mov byte [rsp + 0x120], 0x44
mov byte [rsp + 0x121], 0x8b
mov byte [rsp + 0x122], 0xc2
mov byte [rsp + 0x123], 0x33
mov byte [rsp + 0x124], 0xd2
mov byte [rsp + 0x125], 0x48
mov byte [rsp + 0x126], 0x8b
mov byte [rsp + 0x127], 1
mov byte [rsp + 0x128], 0xff
mov byte [rsp + 0x129], 0x10
mov rax, qword [rsp + 0x48]
add rax, 0x1000
mov r9d, 0x1a
lea r8, [rsp + 0x110]
mov edx, 0x901ab7
mov rcx, rax
call fcn.1800050a0
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x180007711
mov rax, qword [rsp + 0x88]
add rax, 0xd
mov qword [rsp + 0xc0], rax
mov r8d, 0xe
lea rdx, [0x18000791a]
mov rcx, qword [rsp + 0xc0]
call fcn.180004ec0
lea rcx, str.client
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x180007896
cmp dword [rsp + 0x34], 0
jne 0x180007744
mov dword [rsp + 0x34], 0x2521ff3
mov byte [rsp + 0xe8], 0x41
mov byte [rsp + 0xe9], 0xf
mov byte [rsp + 0xea], 0x5a
mov byte [rsp + 0xeb], 0xc8
mov byte [rsp + 0xec], 0x66
mov eax, dword [rsp + 0x34]
sub eax, 0x15ae0a0
mov rcx, qword [rsp + 0x90]
add rcx, 0x15aefa0
mov r9d, 5
lea r8, [rsp + 0xe8]
mov edx, eax
call fcn.1800050a0
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x180007896
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
lea rax, [rax + rcx + 0x14]
mov qword [rsp + 0x78], rax
lea rax, [0x180006c00]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xd0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8d, 1
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0xd8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x38]
mov r8d, 1
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [rsp + 0x58], 0
je 0x180007889
jmp 0x180007896
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x9c], eax
call fcn.1800069c0
mov word [rsp + 0x50], ax
call fcn.180006950
mov dword [rsp + 0xa0], eax
call fcn.180006a90
mov qword [rsp + 0xe0], rax
xor eax, eax
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.180007a80
add rsp, 0x198
ret