Function at 0x18000d2e0
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
cmp rcx, 0x7ff80000
mov rdi, rcx
jbe 0x18000d302
lea rsi, [rcx - 0x7ff80000]
jmp 0x18000d307
mov esi, 0x80000
cmp rcx, 0xffffffff80000000
mov qword [rsp + 0x158], rbp
jae 0x18000d321
lea rbp, [rcx + 0x7ff80000]
jmp 0x18000d328
mov rbp, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x18000d377
cmp byte [rcx + 1], 0x25
jne 0x18000d377
movsxd rax, dword [rcx + 2]
lea rcx, [rax + rcx + 6]
cmp rcx, rdi
jae 0x18000d35e
cmp rcx, 0xffffffff80000000
jae 0x18000d355
lea rbp, [rcx + 0x7ff80000]
jmp 0x18000d3bb
mov rbp, 0xfffffffffff80000
jmp 0x18000d3bb
cmp rcx, 0x7ff80000
jbe 0x18000d370
lea rsi, [rcx - 0x7ff80000]
jmp 0x18000d3bb
mov esi, 0x80000
jmp 0x18000d3bb
cmp al, 0xe9
jne 0x18000d3bb
movsxd rax, dword [rcx + 1]
lea rcx, [rax + rcx + 5]
cmp rcx, rdi
jae 0x18000d3a4
cmp rcx, 0xffffffff80000000
jae 0x18000d39b
lea rbp, [rcx + 0x7ff80000]
jmp 0x18000d3bb
mov rbp, 0xfffffffffff80000
jmp 0x18000d3bb
cmp rcx, 0x7ff80000
jbe 0x18000d3b6
lea rsi, [rcx - 0x7ff80000]
jmp 0x18000d3bb
mov esi, 0x80000
mov rdx, qword [0x1800705e8]
mov rax, qword [0x1800705e0]
mov qword [rsp + 0x150], rbx
test rdx, rdx
mov qword [rsp + 0x160], r12
jne 0x18000d3ed
test rax, rax
je 0x18000d404
mov rdx, rax
mov qword [0x1800705e8], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x18000d404
cmp rcx, rsi
jb 0x18000d404
cmp rcx, rbp
jbe 0x18000da98
test rax, rax
mov rdx, rax
mov qword [0x1800705e8], rax
je 0x18000d43f
test rdx, rdx
je 0x18000d42f
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x18000d42f
cmp rax, rsi
jb 0x18000d42f
cmp rax, rbp
jbe 0x18000da98
mov rdx, qword [rdx + 8]
test rdx, rdx
mov qword [0x1800705e8], rdx
jne 0x18000d413
movzx eax, di
sub rdi, rax
cmp rdi, 0x40000000
jbe 0x18000d544
lea rbx, [rdi - 0x40010000]
movzx eax, bx
test rax, rax
je 0x18000d464
sub rbx, rax
cmp rbx, rsi
jbe 0x18000d544
nop
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x18000d48b
sub rbx, 0x8000000
jmp 0x18000d53b
xor eax, eax
lea rdx, [rsp + 0xe0]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000d544
cmp dword [rsp + 0x100], 0x10000
jne 0x18000d521
cmp qword [rsp + 0xf8], 0x10000
jb 0x18000d521
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rdx, rax
jne 0x18000da42
sub rbx, 0x10000
jmp 0x18000d53b
mov rbx, qword [rsp + 0xe8]
add rbx, 0xffffffffffff0000
movzx eax, bx
test rax, rax
je 0x18000d53b
sub rbx, rax
cmp rbx, rsi
ja 0x18000d470
movabs r12, 0xffffffff40000000
cmp rdi, r12
jae 0x18000d65b
lea rbx, [rdi + 0x40000000]
movzx ecx, bx
test rcx, rcx
je 0x18000d571
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rbp
jae 0x18000d65b
nop
nop
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x18000d59b
add rbx, 0x8000000
jmp 0x18000d652
xor eax, eax
lea rdx, [rsp + 0x80]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000d65b
cmp dword [rsp + 0xa0], 0x10000
mov rcx, qword [rsp + 0x98]
jne 0x18000d634
cmp rcx, 0x10000
jb 0x18000d634
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rdx, rax
jne 0x18000da42
add rbx, 0x10000
jmp 0x18000d652
mov rbx, qword [rsp + 0x80]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x18000d652
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rbp
jb 0x18000d580
cmp rdi, 0x40000000
jbe 0x18000d74d
lea rbx, [rdi - 0x40000000]
movzx ecx, bx
test rcx, rcx
je 0x18000d682
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jae 0x18000d74d
nop
nop
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x18000d6ab
add rbx, 0x8000000
jmp 0x18000d744
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000d74d
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x18000d729
cmp rcx, 0x10000
jb 0x18000d729
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rdx, rax
jne 0x18000da42
add rbx, 0x10000
jmp 0x18000d744
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x18000d744
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x18000d690
cmp rdi, r12
jae 0x18000d827
lea rbx, [rdi + 0x3fff0000]
movzx eax, bx
test rax, rax
je 0x18000d768
sub rbx, rax
cmp rbx, rdi
jbe 0x18000d827
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x18000d78c
sub rbx, 0x8000000
jmp 0x18000d81e
xor eax, eax
lea rdx, [rsp + 0x50]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000d827
cmp dword [rsp + 0x70], 0x10000
jne 0x18000d807
cmp qword [rsp + 0x68], 0x10000
jb 0x18000d807
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rdx, rax
jne 0x18000da42
sub rbx, 0x10000
jmp 0x18000d81e
mov rbx, qword [rsp + 0x58]
add rbx, 0xffffffffffff0000
movzx eax, bx
test rax, rax
je 0x18000d81e
sub rbx, rax
cmp rbx, rdi
ja 0x18000d771
lea rbx, [rdi - 0x10000]
movzx eax, bx
test rax, rax
je 0x18000d839
sub rbx, rax
cmp rbx, rsi
jbe 0x18000d924
nop
nop
nop
nop
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x18000d86b
sub rbx, 0x8000000
jmp 0x18000d91b
xor eax, eax
lea rdx, [rsp + 0xb0]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000d924
cmp dword [rsp + 0xd0], 0x10000
jne 0x18000d901
cmp qword [rsp + 0xc8], 0x10000
jb 0x18000d901
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rdx, rax
jne 0x18000da42
sub rbx, 0x10000
jmp 0x18000d91b
mov rbx, qword [rsp + 0xb8]
add rbx, 0xffffffffffff0000
movzx eax, bx
test rax, rax
je 0x18000d91b
sub rbx, rax
cmp rbx, rsi
ja 0x18000d850
movzx eax, di
test rax, rax
je 0x18000d936
sub rdi, rax
add rdi, 0x10000
cmp rdi, rbp
jae 0x18000da17
nop
lea rax, [rdi - 0x70000000]
cmp rax, 0x10000000
ja 0x18000d95b
add rdi, 0x8000000
jmp 0x18000da0e
xor eax, eax
lea rdx, [rsp + 0x110]
mov rcx, rdi
lea r8d, [rax + 0x30]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000da17
cmp dword [rsp + 0x130], 0x10000
mov rcx, qword [rsp + 0x128]
jne 0x18000d9f0
cmp rcx, 0x10000
jb 0x18000d9f0
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rdx, rax
jne 0x18000da42
add rdi, 0x10000
jmp 0x18000da0e
mov rdi, qword [rsp + 0x110]
add rdi, rcx
movzx ecx, di
test rcx, rcx
je 0x18000da0e
mov eax, 0x10000
sub rax, rcx
add rdi, rax
cmp rdi, rbp
jb 0x18000d940
xor eax, eax
mov r12, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x168]
add rsp, 0x140
pop rdi
ret
mov dword [rdx], 0x52727464
xor r8d, r8d
mov qword [0x1800705e8], rdx
mov qword [rdx + 0x10], r8
mov rax, qword [0x1800705e0]
lea rcx, [rdx + 0xffa8]
mov qword [rdx + 8], rax
mov qword [0x1800705e0], rdx
lea rax, [rdx + 0xff60]
mov r9d, 0x2a7
nop
mov qword [rcx], r8
mov r8, rax
sub rcx, 0x60
sub rax, 0x60
sub r9, 1
jne 0x18000da80
mov qword [rdx + 0x10], r8
mov rbx, qword [rdx + 0x10]
cmp rbx, rsi
jb 0x18000da17
cmp rbx, rbp
ja 0x18000da17
mov rcx, qword [rbx + 0x48]
mov qword [rdx + 0x10], rcx
mov edx, 0xcc
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call sub.MSVCR80.dll_memset
mov rax, rbx
jmp 0x18000da19