Function at 0x1800e7ce0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x180175020]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rdx
mov r14, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180179668], eax
je 0x1800e7d1e
mov eax, 0x10dd
jmp 0x1800e8044
mov eax, dword [0x18017966c]
test eax, eax
jne 0x1800e8044
test r14, r14
je 0x1800e7d4a
mov rcx, qword [r14]
test rcx, rcx
jne 0x1800e7d54
mov dword [0x18017966c], 6
mov qword [0x180179670], r14
mov eax, 6
jmp 0x1800e8044
mov qword [rsp + 0x100], rbp
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xc0], r12
xor edx, edx
mov qword [rsp + 0xb8], r13
mov rsi, rdi
mov qword [rsp + 0xb0], r15
mov rbp, rdi
call fcn.1800e7600
xor edx, edx
mov rcx, rbx
mov r12, rax
call fcn.1800e7600
mov qword [rsp + 0x28], rax
cmp rax, r12
jne 0x1800e7db1
cmp dword [0x180179660], esi
jne 0x1800e7fe7
jmp 0x1800e7fab
mov ecx, 0x30
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbp, rax
test rax, rax
jne 0x1800e7dcb
lea edi, [rax + 8]
jmp 0x1800e7fab
mov rcx, r12
call fcn.1800e7360
mov rsi, rax
test rax, rax
jne 0x1800e7de3
lea edi, [rax + 8]
jmp 0x1800e7fab
xor eax, eax
mov r8, r12
mov r13, rsi
lea r15, [rsi + 0x1e]
lea rdx, [0x180127d20]
mov qword [rsi + 0x40], rax
nop word [rax + rax]
lea rax, [rsp + 0x58]
test r13, r13
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x24]
cmovne rcx, r13
mov rbx, r8
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x24], edi
test r8, r8
jne 0x1800e7e4c
lea ecx, [r8 + 0xd]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, rdi
jmp 0x1800e7e6b
movzx eax, byte [r8]
mov r9, r8
mov r8, rcx
shl rax, 4
lea rcx, [rsp + 0x30]
add rax, rdx
mov rdx, rax
call qword [rax + 8]
mov r8, rax
movsxd rax, dword [rsp + 0x24]
mov edx, r8d
sub rax, rbx
sub edx, r12d
add rax, r8
add r13, rax
movzx eax, dl
and al, 7
movzx ecx, r13b
sub cl, sil
shl cl, 3
xor cl, al
mov byte [rsi + 0x40], cl
movzx eax, byte [rbx]
cmp al, 0xeb
je 0x1800e7eed
cmp al, 0xe9
je 0x1800e7eed
cmp al, 0xe0
je 0x1800e7eed
cmp al, 0xc2
je 0x1800e7eed
cmp al, 0xc3
je 0x1800e7eed
cmp al, 0xcc
je 0x1800e7eed
cmp al, 0xff
jne 0x1800e7eb8
cmp byte [rbx + 1], 0x25
je 0x1800e7eed
cmp al, 0x26
je 0x1800e7ed0
cmp al, 0x2e
je 0x1800e7ed0
cmp al, 0x36
je 0x1800e7ed0
cmp al, 0xe3
je 0x1800e7ed0
cmp al, 0x64
je 0x1800e7ed0
cmp al, 0x65
jne 0x1800e7edc
cmp byte [rbx + 1], 0xff
jne 0x1800e7edc
cmp byte [rbx + 2], 0x25
je 0x1800e7eed
cmp edx, 5
jae 0x1800e7f06
lea rdx, [0x180127d20]
jmp 0x1800e7e00
cmp edx, 5
jae 0x1800e7f06
cmp byte [r8], 0x90
jne 0x1800e7f33
inc r8
mov edx, r8d
sub edx, r12d
cmp edx, 5
jb 0x1800e7ef2
cmp r13, r15
jbe 0x1800e7f0c
int3
mov byte [rsi + 0x3e], dl
mov ebx, edx
mov r8d, edx
lea rcx, [rsi + 0x20]
sub r13b, sil
mov rdx, r12
mov byte [r15], r13b
call sub.MSVCR90.dll_memcpy
cmp rbx, 0x19
jbe 0x1800e7f48
mov edi, 6
jmp 0x1800e7fab
cmp edx, 5
jae 0x1800e7f06
cmp dword [0x180179660], 0
mov edi, 9
jne 0x1800e7fb1
jmp 0x1800e7fab
movzx r8d, byte [r15]
lea rax, [rbx + r12]
mov rdx, r15
mov qword [rsi + 0x48], rax
mov rax, qword [rsp + 0x28]
add r8, rsi
mov qword [rsi + 0x50], rax
lea rcx, [r8 + 6]
mov byte [r8], 0xff
mov eax, esi
mov byte [r8 + 1], 0x25
sub eax, ecx
lea rcx, [r8 + 6]
add eax, 0x48
mov dword [r8 + 2], eax
call fcn.1800e70c0
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, rbx
mov rcx, r12
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800e7ff2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x18017966c], edi
test rsi, rsi
je 0x1800e7fda
xor edx, edx
mov rbx, rsi
mov rcx, rsi
lea r8d, [rdx + 0x60]
and rbx, 0xffffffffffff0000
call sub.MSVCR90.dll_memset
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x48], rax
mov qword [rbx + 0x10], rsi
test rbp, rbp
je 0x1800e7fe7
mov rcx, rbp
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [0x180179670], r14
mov eax, edi
jmp 0x1800e801c
mov dword [rbp + 8], edi
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x18], r12
mov eax, dword [rsp + 0x20]
mov dword [rbp + 0x28], eax
mov rax, qword [0x180179680]
mov qword [0x180179680], rbp
mov qword [rbp], rax
xor eax, eax
mov r13, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0x100]
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800e9aa0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret