Function at 0x180006df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8, qword [0x1800290b8]
xor ebp, ebp
mov rdi, rdx
mov rsi, rcx
mov ebx, 0x20
test r8, r8
jne 0x180006e77
mov ecx, 0x710
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r8, rax
test rax, rax
je 0x180006e6d
add rax, 8
mov ecx, ebx
nop word [rax + rax]
mov dword [rax - 8], 0xffffffff
mov dword [rax - 4], ebp
mov qword [rax], rbp
add rax, 0x38
dec rcx
jne 0x180006e40
mov qword [r8 + 0x700], rbp
mov qword [r8 + 0x708], rbp
mov qword [0x1800290b8], r8
jmp 0x180006e77
mov r8, rbp
mov qword [0x1800290b8], rbp
mov dword [rdi + 0x10], ebp
nop word [rax + rax]
cmp dword [r8], 0xffffffff
je 0x180006ecf
movsxd rcx, dword [rdi + 0x10]
mov rax, qword [r8]
imul rcx, rcx, 0x38
mov qword [rcx + rdi + 0x14], rax
mov rax, qword [r8 + 8]
mov qword [rcx + rdi + 0x1c], rax
mov rax, qword [r8 + 0x10]
mov qword [rcx + rdi + 0x24], rax
mov rax, qword [r8 + 0x18]
mov qword [rcx + rdi + 0x2c], rax
mov rax, qword [r8 + 0x20]
mov qword [rcx + rdi + 0x34], rax
mov rax, qword [r8 + 0x28]
mov qword [rcx + rdi + 0x3c], rax
mov rax, qword [r8 + 0x30]
mov qword [rcx + rdi + 0x44], rax
inc dword [rdi + 0x10]
add r8, 0x38
dec rbx
jne 0x180006e80
mov dword [rdi], 0x2d2f2757
mov dword [rdi + 4], 8
mov eax, dword [rdi + 0x10]
mov r8d, 0x7530
mov rdx, rdi
mov rcx, rsi
imul eax, eax, 0x38
add eax, 4
mov dword [rdi + 0xc], ebp
mov dword [rdi + 8], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180018160

Function at 0x180007ba0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd rdx, edx
mov r10, rcx
mov r11d, r9d
mov ebx, r9d
mov edi, r9d
test rdx, rdx
jle 0x180007c13
sub r10, r8
mov eax, r9d
mov ecx, ebx
inc r8
shr eax, 3
shl ecx, 7
lea r9d, [r9 + rax - 0x11111111]
mov eax, r11d
shr eax, 5
lea r11d, [r11 + rax - 0x22222222]
mov eax, 0x33333333
sub eax, ecx
mov ecx, edi
add ebx, eax
shl ecx, 9
mov eax, 0x44444444
sub eax, ecx
add edi, eax
lea eax, [r11 + r9]
add al, bl
add al, dil
xor al, byte [r10 + r8 - 1]
dec rdx
mov byte [r8 - 1], al
jne 0x180007bc1
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
xor eax, eax
ret

Function at 0x180007c20
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18002a728]
mov rbx, r9
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
test rax, rax
jne 0x180007c83
mov rax, qword [0x18002a710]
test rax, rax
jne 0x180007c6c
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a710], rax
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a728], rax
mov r9, rsi
mov r8d, 0xf000
mov rdx, rbp
mov ecx, 2
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
call rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret