Function at 0x180008270
Capabilities:
Create thread
Enumerate pe sections
Overwrite dll .text section to remove hooks
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea r12, [0x1800f5550]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
jne 0x1800082cc
lea edx, [rax + 0xd]
lea r9d, [rax + 0xf]
lea r8, str.Unable_to_load__s__restore_failed.
jmp 0x1800083a1
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, str.AntiAntiDebug
test eax, eax
jne 0x180008310
lea edx, [rax + 0xd]
lea r9d, [rax + 0xf]
lea r8, str.Unable_to_get_the_filename_for_module__s__restore_failed.
jmp 0x1800083a8
mov esi, reloc.WS2_32.dll_ntohs
lea ebp, [rsi - 2]
mov qword [rsp + 0x28], r12
lea r13, str.NtProtectVirtualMemory
mov qword [rsp + 0x20], r13
mov r9d, esi
lea r8, str.Attempting_to_restore_function:__s___s_...
mov edx, ebp
call fcn.1800090a0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180008395
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
movzx eax, word [rbx + 0x14]
lea r14, [rbx + 0x18]
add r14, rax
xor edi, edi
nop dword [rax]
mov rdx, r14
lea rcx, str..text
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800083e5
lea r14, [rdi*4 + 3]
movzx ecx, word [rbx + 0x14]
add rcx, rbx
add r14, rdi
lea r14, [rcx + r14*8]
inc edi
movzx eax, word [rbx + 6]
cmp edi, eax
jbe 0x180008360
lea r8, str.Unable_to_read_the_section_info_for__s__restore_failed.
mov edx, ebp
mov r9d, esi
lea rcx, str.AntiAntiDebug
mov qword [rsp + 0x20], r12
call fcn.1800090a0
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800d2550
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, r13
mov rcx, r12
call fcn.18000cce0
mov rbx, rax
test rax, rax
je 0x1800083b2
mov edx, dword [r14 + 0xc]
sub edx, dword [r14 + 0x14]
mov rdi, rax
sub rdi, rdx
sub rdi, r15
lea r8, [0x1800f5878]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x180008541
lea ecx, [rax + 5]
call fcn.1800d25b4
mov r14, rax
mov r8d, 1
mov edx, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, qword [rsp + 0x30]
mov edx, 1
lea r8d, [rdx + 4]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 5
jne 0x18000850f
mov rax, qword [0x180119560]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 5
mov r8, r14
mov rdx, rbx
lea rcx, [r9 - 6]
call rax
test al, al
je 0x180008506
mov ecx, Ordinal_41
call fcn.1800d2570
mov qword [rsp + 0x40], rax
mov qword [rax], r12
mov qword [rax + 8], r13
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], 5
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
mov r9, rax
lea r8, [0x1800081e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9d, esi
lea r8, str._s___s____Restore_thread_created.
mov edx, ebp
lea rcx, str.AntiAntiDebug
call fcn.1800090a0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov al, 1
jmp 0x1800083b4
lea r8, str.Unable_to_write_the_original_bytes___s___s__restore_failed.
jmp 0x180008516
lea r8, str.Unable_to_read_the_offset_bytes___s___s__restore_failed.
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9d, esi
mov edx, ebp
lea rcx, str.AntiAntiDebug
call fcn.1800090a0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1800083b2
lea r8, str.Unable_to_open__s__restore_failed.
jmp 0x18000839c