Function at 0x1400403e0
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xd8
cmp qword [rsp + 0xe0], 0x7ff80000
jbe 0x140040412
mov rax, qword [rsp + 0xe0]
sub rax, 0x7ff80000
mov qword [rsp + 0xc0], rax
jmp 0x14004041e
mov qword [rsp + 0xc0], 0x10000
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0xe0], 0xffffffff80000000
jae 0x140040451
mov rax, qword [rsp + 0xe0]
add rax, 0x7ff80000
mov qword [rsp + 0xc8], rax
jmp 0x14004045d
mov qword [rsp + 0xc8], 0xfffffffffff80000
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
cmp qword [0x14005ce08], 0
jne 0x140040495
cmp qword [0x14005ce00], 0
je 0x140040495
mov rax, qword [0x14005ce00]
mov qword [0x14005ce08], rax
cmp qword [0x14005ce08], 0
je 0x14004053b
mov rax, qword [0x14005ce08]
cmp qword [rax + 0x10], 0
je 0x14004053b
mov rcx, qword [0x14005ce08]
mov rax, qword [rsp + 0x28]
cmp qword [rcx + 0x10], rax
jb 0x14004053b
mov rcx, qword [0x14005ce08]
mov rax, qword [rsp + 0x30]
cmp qword [rcx + 0x10], rax
ja 0x14004053b
mov rax, qword [0x14005ce08]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x38], rax
jb 0x140040501
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jbe 0x140040508
xor eax, eax
jmp 0x140040896
mov rcx, qword [0x14005ce08]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
mov qword [rcx + 0x10], rax
mov r8d, 0x38
mov edx, 0xcc
mov rcx, qword [rsp + 0x38]
call fcn.14002ea20
mov rax, qword [rsp + 0x38]
jmp 0x140040896
mov rax, qword [0x14005ce00]
mov qword [0x14005ce08], rax
jmp 0x14004055d
mov rax, qword [0x14005ce08]
mov rax, qword [rax + 8]
mov qword [0x14005ce08], rax
cmp qword [0x14005ce08], 0
je 0x1400405aa
cmp qword [0x14005ce08], 0
je 0x1400405a8
mov rax, qword [0x14005ce08]
cmp qword [rax + 0x10], 0
je 0x1400405a8
mov rcx, qword [0x14005ce08]
mov rax, qword [rsp + 0x28]
cmp qword [rcx + 0x10], rax
jb 0x1400405a8
mov rcx, qword [0x14005ce08]
mov rax, qword [rsp + 0x30]
cmp qword [rcx + 0x10], rax
ja 0x1400405a8
jmp 0x1400404d9
jmp 0x14004054b
mov rcx, qword [rsp + 0xe0]
call fcn.1400271a0
and eax, 0xffff
mov ecx, eax
mov rax, qword [rsp + 0xe0]
sub rax, rcx
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jbe 0x14004074b
cmp qword [rsp + 0x20], 0x70000000
jb 0x14004060e
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x14004060e
mov qword [rsp + 0x20], 0x6fff0000
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14004062e
jmp 0x14004074b
cmp dword [rsp + 0x60], 0x10000
jne 0x140040736
cmp qword [rsp + 0x58], 0x10000
jb 0x140040736
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x14005ce08], rax
cmp qword [0x14005ce08], 0
je 0x140040734
mov rax, qword [0x14005ce08]
mov dword [rax], 0x52727464
mov rax, qword [0x14005ce08]
mov qword [rax + 0x10], 0
mov rcx, qword [0x14005ce08]
mov rax, qword [0x14005ce00]
mov qword [rcx + 8], rax
mov rax, qword [0x14005ce08]
mov qword [0x14005ce00], rax
mov qword [rsp + 0x70], 0
mov rax, qword [0x14005ce08]
add rax, 0x38
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x78], 0x490
jmp 0x1400406e6
mov eax, dword [rsp + 0x78]
sub eax, 1
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 1
jle 0x14004071d
movsxd rdx, dword [rsp + 0x78]
imul rdx, rdx, 0x38
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x70]
mov qword [rcx + rdx + 0x20], rax
movsxd rcx, dword [rsp + 0x78]
imul rcx, rcx, 0x38
mov rax, qword [rsp + 0x38]
add rax, rcx
mov qword [rsp + 0x70], rax
jmp 0x1400406db
mov rcx, qword [0x14005ce08]
mov rax, qword [rsp + 0x70]
mov qword [rcx + 0x10], rax
jmp 0x1400404d9
jmp 0x14004074b
mov rax, qword [rsp + 0x48]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1400405de
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jae 0x140040894
cmp qword [rsp + 0x20], 0x70000000
jb 0x140040789
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x140040789
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
mov r8d, 0x30
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400407ac
jmp 0x140040894
cmp dword [rsp + 0xa0], 0x10000
jne 0x140040877
cmp qword [rsp + 0x98], 0x10000
jb 0x140040877
mov rax, qword [rsp + 0x20]
and rax, 0xffff
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x140040845
mov eax, 0x10000
sub rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x98]
sub rax, rcx
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x80]
add rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x14005ce08], rax
cmp qword [0x14005ce08], 0
je 0x140040877
jmp 0x14004067c
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x80]
add rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140040758
xor eax, eax
add rsp, 0xd8
ret