Function at 0x18000e2f0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x100
mov rax, qword [0x18006e168]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor edi, edi
test rdx, rdx
mov rbx, rdx
mov r12, rcx
mov qword [rsp + 0x38], rcx
jne 0x18000e328
lea eax, [rdx + 0x57]
jmp 0x18000e6d5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1800705f8], eax
je 0x18000e340
mov eax, 0x10dd
jmp 0x18000e6d5
mov eax, dword [0x1800705fc]
test eax, eax
jne 0x18000e6d5
test r12, r12
je 0x18000e36d
mov rcx, qword [r12]
test rcx, rcx
jne 0x18000e377
mov dword [0x1800705fc], 6
mov qword [0x180070600], r12
mov eax, 6
jmp 0x18000e6d5
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0xf0], r13
xor edx, edx
mov qword [rsp + 0xe8], r14
mov r12, rdi
mov qword [rsp + 0xe0], r15
mov r13, rdi
call fcn.18000dad0
xor edx, edx
mov rcx, rbx
mov r15, rax
call fcn.18000dad0
cmp rax, r15
mov qword [rsp + 0x40], rax
jne 0x18000e3d4
cmp dword [0x1800705f0], edi
jne 0x18000e69f
jmp 0x18000e662
mov ecx, 0x30
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov r13, rax
jne 0x18000e3ee
lea edi, [rax + 8]
jmp 0x18000e662
mov rcx, r15
call fcn.18000d2e0
test rax, rax
mov r12, rax
jne 0x18000e406
lea edi, [rax + 8]
jmp 0x18000e662
add rax, 0x40
xor ecx, ecx
mov rsi, r15
mov qword [rax], rcx
mov r14, r12
mov dword [rsp + 0x20], edi
lea rcx, [0x18007a1b0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
test r14, r14
lea r8, [rsp + 0x90]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x24]
cmovne r8, r14
test rsi, rsi
mov rbp, rsi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x5c], edi
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x24], edi
jne 0x18000e485
lea ecx, [rsi + 0xd]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, rdi
jmp 0x18000e4a0
movzx eax, byte [rsi]
mov r9, rsi
shl rax, 4
add rax, rcx
lea rcx, [rsp + 0x50]
mov rdx, rax
call qword [rax + VariantCopy]
mov rsi, rax
mov rdx, qword [rsp + 0x30]
movsxd rax, dword [rsp + 0x24]
mov ebx, esi
sub rax, rbp
sub ebx, r15d
add rdx, 1
add rax, rsi
mov qword [rsp + 0x30], rdx
add r14, rax
movzx eax, bl
and al, 7
movzx ecx, r14b
sub cl, r12b
shl cl, 3
xor cl, al
mov eax, dword [rsp + 0x20]
add eax, 1
mov byte [rdx - 1], cl
cmp eax, 8
mov dword [rsp + 0x20], eax
jae 0x18000e54a
movzx eax, byte [rbp]
cmp al, 0xeb
je 0x18000e54a
cmp al, 0xe9
je 0x18000e54a
cmp al, 0xe0
je 0x18000e54a
cmp al, 0xc2
je 0x18000e54a
cmp al, 0xc3
je 0x18000e54a
cmp al, 0xcc
je 0x18000e54a
cmp al, 0xf3
jne 0x18000e50b
cmp byte [rbp + 1], 0xc3
je 0x18000e54a
cmp al, 0xff
jne 0x18000e515
cmp byte [rbp + 1], 0x25
je 0x18000e54a
cmp al, 0x26
je 0x18000e52d
cmp al, 0x2e
je 0x18000e52d
cmp al, 0x36
je 0x18000e52d
cmp al, 0x3e
je 0x18000e52d
cmp al, 0x64
je 0x18000e52d
cmp al, 0x65
jne 0x18000e539
cmp byte [rbp + 1], 0xff
jne 0x18000e539
cmp byte [rbp + 2], 0x25
je 0x18000e54a
cmp ebx, 5
jae 0x18000e576
lea rcx, [0x18007a1b0]
jmp 0x18000e425
cmp ebx, 5
jae 0x18000e576
nop
mov rcx, rsi
call fcn.18000d120
test eax, eax
je 0x18000e56d
cdqe
add rsi, rax
mov ebx, esi
sub ebx, r15d
cmp ebx, 5
jb 0x18000e550
jmp 0x18000e576
cmp ebx, 5
jb 0x18000e654
mov eax, dword [rsp + 0x20]
cmp eax, 8
ja 0x18000e654
lea rsi, [r12 + 0x1e]
cmp r14, rsi
jbe 0x18000e58e
int3
lea rcx, [r12 + 0x20]
sub r14b, r12b
mov r8, rbx
mov rdx, r15
mov byte [r12 + 0x3e], bl
mov byte [rsi], r14b
call sub.MSVCR80.dll_memcpy
cmp rbx, 0x19
jbe 0x18000e5b9
mov edi, 6
jmp 0x18000e662
movzx r8d, byte [rsi]
lea rax, [rbx + r15]
mov rdx, rsi
mov qword [r12 + 0x48], rax
mov rax, qword [rsp + 0x40]
add r8, r12
mov qword [r12 + 0x50], rax
lea rcx, [r8 + 6]
mov byte [r8], 0xff
mov eax, r12d
mov byte [r8 + 1], 0x25
sub eax, ecx
lea rcx, [r8 + 6]
add eax, 0x48
mov dword [r8 + 2], eax
call fcn.18000d0e0
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rbx
mov rcx, r15
mov dword [rsp + 0x28], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000e621
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18000e662
mov rax, qword [rsp + 0x38]
mov dword [r13 + 8], edi
mov qword [r13 + 0x20], r12
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x18], r15
mov eax, dword [rsp + 0x28]
mov dword [r13 + 0x28], eax
mov rax, qword [0x180070610]
mov qword [0x180070610], r13
mov qword [r13], rax
xor eax, eax
jmp 0x18000e6ad
cmp dword [0x1800705f0], 0
mov edi, 9
jne 0x18000e668
mov dword [0x1800705fc], edi
test r12, r12
je 0x18000e692
xor edx, edx
mov rbx, r12
mov rcx, r12
lea r8d, [rdx + 0x60]
and rbx, 0xffffffffffff0000
call sub.MSVCR80.dll_memset
mov rax, qword [rbx + 0x10]
mov qword [r12 + 0x48], rax
mov qword [rbx + 0x10], r12
test r13, r13
je 0x18000e69f
mov rcx, r13
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, qword [rsp + 0x38]
mov qword [0x180070600], rax
mov eax, edi
mov r14, qword [rsp + 0xe8]
mov r13, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x130]
mov r15, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.18003f5f0
add rsp, 0x100
pop r12
pop rdi
pop rbx
ret