Function at 0x180007c80
Capabilities:
Create thread
Enumerate pe sections
Overwrite dll .text section to remove hooks
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea r12, [0x180112660]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
jne 0x180007cdc
lea edx, [rax + 0xd]
lea r9d, [rax + 0xf]
lea r8, str.Unable_to_load__s__restore_failed.
jmp 0x180007db1
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, str.AntiAntiDebug
test eax, eax
jne 0x180007d20
lea edx, [rax + 0xd]
lea r9d, [rax + 0xf]
lea r8, str.Unable_to_get_the_filename_for_module__s__restore_failed.
jmp 0x180007db8
mov esi, reloc.WS2_32.dll_ntohs
lea ebp, [rsi - 2]
mov qword [rsp + 0x28], r12
lea r13, str.NtProtectVirtualMemory
mov qword [rsp + 0x20], r13
mov r9d, esi
lea r8, str.Attempting_to_restore_function:__s___s_...
mov edx, ebp
call fcn.180008ab0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180007da5
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
movzx eax, word [rbx + 0x14]
lea r14, [rbx + 0x18]
add r14, rax
xor edi, edi
nop dword [rax]
mov rdx, r14
lea rcx, str..text
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x180007df5
lea r14, [rdi*4 + 3]
movzx ecx, word [rbx + 0x14]
add rcx, rbx
add r14, rdi
lea r14, [rcx + r14*8]
inc edi
movzx eax, word [rbx + 6]
cmp edi, eax
jbe 0x180007d70
lea r8, str.Unable_to_read_the_section_info_for__s__restore_failed.
mov edx, ebp
mov r9d, esi
lea rcx, str.AntiAntiDebug
mov qword [rsp + 0x20], r12
call fcn.180008ab0
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800d2160
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, r13
mov rcx, r12
call fcn.18000c8c0
mov rbx, rax
test rax, rax
je 0x180007dc2
mov edx, dword [r14 + 0xc]
sub edx, dword [r14 + 0x14]
mov rdi, rax
sub rdi, rdx
sub rdi, r15
lea r8, [0x1801129c8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x180007f51
lea ecx, [rax + 5]
call fcn.1800d2498
mov r14, rax
mov r8d, 1
mov edx, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, qword [rsp + 0x30]
mov edx, 1
lea r8d, [rdx + 4]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 5
jne 0x180007f1f
mov rax, qword [0x180136818]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 5
mov r8, r14
mov rdx, rbx
lea rcx, [r9 - 6]
call rax
test al, al
je 0x180007f16
mov ecx, Ordinal_41
call fcn.1800d22a0
mov qword [rsp + 0x40], rax
mov qword [rax], r12
mov qword [rax + 8], r13
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], 5
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
mov r9, rax
lea r8, [0x180007bf0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9d, esi
lea r8, str._s___s____Restore_thread_created.
mov edx, ebp
lea rcx, str.AntiAntiDebug
call fcn.180008ab0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov al, 1
jmp 0x180007dc4
lea r8, str.Unable_to_write_the_original_bytes___s___s__restore_failed.
jmp 0x180007f26
lea r8, str.Unable_to_read_the_offset_bytes___s___s__restore_failed.
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9d, esi
mov edx, ebp
lea rcx, str.AntiAntiDebug
call fcn.180008ab0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x180007dc2
lea r8, str.Unable_to_open__s__restore_failed.
jmp 0x180007dac