Function at 0x14017dc20
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140628520]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, [0x140667c88]
call fcn.140039b60
mov edx, Ordinal_26
lea rcx, [rsp + 0x50]
call fcn.140019350
lea rcx, [rsp + 0x50]
call fcn.1400128d0
nop
movzx eax, byte [0x140666b52]
test eax, eax
je 0x14017dc9a
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x30000000
xor r8d, r8d
mov edx, ntohl
lea rcx, [0x140628400]
call fcn.14017a0d0
jmp 0x14017dcd1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x20000000
mov r8d, 0xd000000
mov edx, ntohl
lea rcx, [0x140628460]
call fcn.14017a0d0
mov dword [rsp + 0x40], 0
jmp 0x14017dce5
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
call fcn.140043520
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
jae 0x14017dde3
movzx eax, byte [0x140666b52]
test eax, eax
je 0x14017dd79
movsxd rax, dword [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1401512c0
mov rax, qword [rax]
add rax, 0xc
mov ecx, eax
call fcn.14014a4d0
movzx eax, al
cmp eax, 0xa4
jne 0x14017dd77
movsxd rax, dword [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1401512c0
mov rdx, rax
lea rcx, [0x140667c88]
call fcn.140040850
movsxd rax, dword [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1401512c0
mov eax, dword [rax]
mov dword [0x14066780c], eax
jmp 0x14017ddde
movsxd rax, dword [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1401512c0
mov rax, qword [rax]
add rax, 0xc
mov ecx, eax
call fcn.14014a4d0
movzx eax, al
cmp eax, 0xa4
jne 0x14017ddde
movsxd rax, dword [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1401512c0
mov rdx, rax
lea rcx, [0x140667c88]
call fcn.140040850
movsxd rax, dword [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1401512c0
mov eax, dword [rax]
mov dword [0x14066780c], eax
jmp 0x14017dcdb
lea rcx, [rsp + 0x50]
call fcn.140039b60
mov eax, dword [0x14066780c]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14017df33
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1f4
xor edx, edx
mov rcx, qword [0x1406677b0]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x140667800], eax
cmp dword [0x140667800], 0
je 0x14017df33
movzx eax, byte [0x140666b52]
test eax, eax
je 0x14017de70
mov eax, dword [0x140667800]
mov qword [rsp + 0x20], 0
mov r9d, reloc.WLDAP32.dll_Ordinal_60
lea r8, [0x140628420]
mov edx, eax
mov rcx, qword [0x1406677b0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14017de9b
mov eax, dword [0x140667800]
mov qword [rsp + 0x20], 0
mov r9d, reloc.WLDAP32.dll_Ordinal_60
lea r8, [0x140628470]
mov edx, eax
mov rcx, qword [0x1406677b0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x140667800]
add eax, 0x13
mov dl, 0x50
mov ecx, eax
call fcn.14017c470
mov eax, dword [0x140667800]
add eax, 0x5e
mov ecx, dword [0x140667800]
add ecx, 9
mov edx, eax
call fcn.14017c4c0
mov eax, dword [rsp + 0x44]
add eax, 8
cdqe
mov qword [rsp + 0x20], 0
mov r9d, 7
lea r8, [0x140667804]
mov rdx, rax
mov rcx, qword [0x1406677b0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [0x140667800]
mov qword [rsp + 0x20], 0
mov r9d, 7
lea r8, [0x140667804]
mov edx, eax
mov rcx, qword [0x1406677b0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.14017da70
mov byte [0x140666097], 1
mov byte [0x14066782d], 0
lea rcx, [rsp + 0x50]
call fcn.140034160
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401cfb20
add rsp, 0x78
ret