Function at 0x18009d7f0
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xd8
cmp qword [rsp + 0xe0], 0x7ff80000
jbe 0x18009d822
mov rax, qword [rsp + 0xe0]
sub rax, 0x7ff80000
mov qword [rsp + 0xc0], rax
jmp 0x18009d82e
mov qword [rsp + 0xc0], 0x10000
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0xe0], 0xffffffff80000000
jae 0x18009d861
mov rax, qword [rsp + 0xe0]
add rax, 0x7ff80000
mov qword [rsp + 0xc8], rax
jmp 0x18009d86d
mov qword [rsp + 0xc8], 0xfffffffffff80000
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
cmp qword [0x1802053a8], 0
jne 0x18009d8a5
cmp qword [0x1802053a0], 0
je 0x18009d8a5
mov rax, qword [0x1802053a0]
mov qword [0x1802053a8], rax
cmp qword [0x1802053a8], 0
je 0x18009d94b
mov rax, qword [0x1802053a8]
cmp qword [rax + 0x10], 0
je 0x18009d94b
mov rcx, qword [0x1802053a8]
mov rax, qword [rsp + 0x28]
cmp qword [rcx + 0x10], rax
jb 0x18009d94b
mov rcx, qword [0x1802053a8]
mov rax, qword [rsp + 0x30]
cmp qword [rcx + 0x10], rax
ja 0x18009d94b
mov rax, qword [0x1802053a8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x38], rax
jb 0x18009d911
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jbe 0x18009d918
xor eax, eax
jmp 0x18009dca6
mov rcx, qword [0x1802053a8]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
mov qword [rcx + 0x10], rax
mov r8d, 0x38
mov edx, 0xcc
mov rcx, qword [rsp + 0x38]
call fcn.18011a1e0
mov rax, qword [rsp + 0x38]
jmp 0x18009dca6
mov rax, qword [0x1802053a0]
mov qword [0x1802053a8], rax
jmp 0x18009d96d
mov rax, qword [0x1802053a8]
mov rax, qword [rax + 8]
mov qword [0x1802053a8], rax
cmp qword [0x1802053a8], 0
je 0x18009d9ba
cmp qword [0x1802053a8], 0
je 0x18009d9b8
mov rax, qword [0x1802053a8]
cmp qword [rax + 0x10], 0
je 0x18009d9b8
mov rcx, qword [0x1802053a8]
mov rax, qword [rsp + 0x28]
cmp qword [rcx + 0x10], rax
jb 0x18009d9b8
mov rcx, qword [0x1802053a8]
mov rax, qword [rsp + 0x30]
cmp qword [rcx + 0x10], rax
ja 0x18009d9b8
jmp 0x18009d8e9
jmp 0x18009d95b
mov rcx, qword [rsp + 0xe0]
call fcn.18009e2b0
and eax, 0xffff
mov ecx, eax
mov rax, qword [rsp + 0xe0]
sub rax, rcx
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jbe 0x18009db5b
cmp qword [rsp + 0x20], 0x70000000
jb 0x18009da1e
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x18009da1e
mov qword [rsp + 0x20], 0x6fff0000
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18009da3e
jmp 0x18009db5b
cmp dword [rsp + 0x60], 0x10000
jne 0x18009db46
cmp qword [rsp + 0x58], 0x10000
jb 0x18009db46
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x1802053a8], rax
cmp qword [0x1802053a8], 0
je 0x18009db44
mov rax, qword [0x1802053a8]
mov dword [rax], 0x52727464
mov rax, qword [0x1802053a8]
mov qword [rax + 0x10], 0
mov rcx, qword [0x1802053a8]
mov rax, qword [0x1802053a0]
mov qword [rcx + 8], rax
mov rax, qword [0x1802053a8]
mov qword [0x1802053a0], rax
mov qword [rsp + 0x70], 0
mov rax, qword [0x1802053a8]
add rax, 0x38
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x78], 0x490
jmp 0x18009daf6
mov eax, dword [rsp + 0x78]
sub eax, 1
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 1
jle 0x18009db2d
movsxd rdx, dword [rsp + 0x78]
imul rdx, rdx, 0x38
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x70]
mov qword [rcx + rdx + 0x20], rax
movsxd rcx, dword [rsp + 0x78]
imul rcx, rcx, 0x38
mov rax, qword [rsp + 0x38]
add rax, rcx
mov qword [rsp + 0x70], rax
jmp 0x18009daeb
mov rcx, qword [0x1802053a8]
mov rax, qword [rsp + 0x70]
mov qword [rcx + 0x10], rax
jmp 0x18009d8e9
jmp 0x18009db5b
mov rax, qword [rsp + 0x48]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18009d9ee
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jae 0x18009dca4
cmp qword [rsp + 0x20], 0x70000000
jb 0x18009db99
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x18009db99
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
mov r8d, 0x30
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18009dbbc
jmp 0x18009dca4
cmp dword [rsp + 0xa0], 0x10000
jne 0x18009dc87
cmp qword [rsp + 0x98], 0x10000
jb 0x18009dc87
mov rax, qword [rsp + 0x20]
and rax, 0xffff
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x18009dc55
mov eax, 0x10000
sub rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x98]
sub rax, rcx
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x80]
add rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x1802053a8], rax
cmp qword [0x1802053a8], 0
je 0x18009dc87
jmp 0x18009da8c
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x80]
add rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x18009db68
xor eax, eax
add rsp, 0xd8
ret