Function at 0x14000d634
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r9, qword [0x1400116b0]
cmp rcx, 0x7ff80000
lea rax, [rcx - 0x7ff80000]
mov r13d, 0x10000
mov r14, 0xfffffffffff80000
mov rsi, rcx
mov r15d, r13d
mov edx, 0x80000000
cmova r15, rax
cmp rcx, 0xffffffff80000000
lea rax, [rcx + 0x7ff80000]
mov rcx, qword [0x1400116c0]
cmovb r14, rax
xor edi, edi
test r9, r9
jne 0x14000d6b6
test rcx, rcx
je 0x14000d6d6
mov r9, rcx
mov qword [0x1400116b0], rcx
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x14000d6d6
cmp rax, r15
jb 0x14000d6cd
cmp rax, r14
jbe 0x14000d90f
cmp rax, rdx
jl 0x14000d90f
mov r9, rcx
mov qword [0x1400116b0], rcx
test rcx, rcx
je 0x14000d71a
test rcx, rcx
je 0x14000d70a
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x14000d70a
cmp rax, r15
jb 0x14000d701
cmp rax, r14
jbe 0x14000d90f
cmp rax, rdx
jl 0x14000d90f
mov r9, qword [r9 + 8]
mov qword [0x1400116b0], r9
test r9, r9
jne 0x14000d6ea
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor ebx, eax
mov eax, dword [rbp + 0x34]
xor eax, ebx
xor eax, dword [rbp + 0x30]
movzx eax, al
shl eax, 0x10
mov r9d, eax
mov r12d, eax
call fcn.14000d56c
mov r9, rax
mov qword [0x1400116b0], rax
test rax, rax
je 0x14000d790
mov eax, 0x80000000
cmp r9, rax
jl 0x14000d8c3
xor edx, edx
mov r8d, 0x8000
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [0x1400116b0], rdi
movzx eax, si
sub rsi, rax
lea rax, [r15 + 0x1000]
add rax, r12
jmp 0x14000d811
lea rbx, [rax + 0xffff]
lea rdx, [rbp - 0x30]
mov r8d, 0x30
and rbx, 0xffffffffffff0000
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
cmovbe rbx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000d81d
cmp dword [rbp - 0x10], r13d
jne 0x14000d806
mov rdx, qword [rbp - 0x18]
cmp rdx, r13
jb 0x14000d80a
xor r9d, r9d
mov rcx, rbx
call fcn.14000d56c
mov r9, rax
mov qword [0x1400116b0], rax
test rax, rax
jne 0x14000d8c3
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov ecx, 0x80010000
cmp rax, rsi
jb 0x14000d7a2
jmp 0x14000d822
mov ecx, 0x80010000
lea rbx, [r12 + rsi]
cmp rbx, r14
jae 0x14000d942
lea rax, [rbx - 0x50000000]
lea rdx, [rbp - 0x60]
mov r8d, 0x30
cmp rax, 0x30000000
cmovbe rbx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000d942
cmp dword [rbp - 0x40], r13d
jne 0x14000d8a5
mov rcx, qword [rbp - 0x48]
cmp rcx, r13
jb 0x14000d8a9
movzx edx, bx
test rdx, rdx
je 0x14000d88b
mov rbx, qword [rbp - 0x60]
mov rax, r13
sub rax, rdx
sub rcx, rax
add rbx, rax
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x48], rcx
xor r9d, r9d
mov rcx, rbx
call fcn.14000d56c
mov r9, rax
mov qword [0x1400116b0], rax
test rax, rax
jne 0x14000d8c3
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
add rbx, rcx
cmp rbx, r14
jae 0x14000d942
mov ecx, 0x80010000
jmp 0x14000d82f
mov rax, qword [0x1400116c0]
mov dword [r9], 0x52727464
mov qword [r9 + 0x10], rdi
mov qword [r9 + 8], rax
mov qword [0x1400116c0], r9
lea rcx, [r9 + 0xfe0]
lea rax, [r9 + 0xfc0]
mov edx, 0x46
mov qword [rcx], rdi
mov rdi, rax
sub rax, 0x38
lea rcx, [rcx - 0x38]
dec rdx
jne 0x14000d8f3
mov qword [r9 + 0x10], rdi
mov edx, 0x80000000
mov rbx, qword [r9 + 0x10]
cmp rbx, r15
jb 0x14000d91d
cmp rbx, r14
jbe 0x14000d922
cmp rbx, rdx
jge 0x14000d942
mov rcx, qword [rbx + 0x20]
mov edx, 0xcc
mov r8d, 0x38
mov qword [r9 + 0x10], rcx
mov rcx, rbx
call sub.msvcrt.dll_memset
mov rax, rbx
jmp 0x14000d944
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret