Function at 0x1401bc7b0
Capabilities:
Enumerate processes
Print debug messages
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2c00
call fcn.1401bf960
sub rsp, rax
mov qword [rsp + 0x2be8], 0xfffffffffffffffe
mov rax, qword [0x14025e510]
xor rax, rsp
mov qword [rsp + 0x2bf0], rax
lea rcx, [rsp + 0x280]
call fcn.14001b62c
nop
lea rcx, [rsp + 0x1ae0]
call fcn.14001bec0
nop
mov r9, 0xffffffff80000001
lea r8, [rsp + 0x1ae0]
lea rdx, [rsp + 0x280]
lea rcx, [0x14021d750]
call fcn.1401a6ab0
test eax, eax
jne 0x1401bc9a7
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x2b38], rax
lea r8, str._windir__system32msiexec.exe
mov rdx, qword [rsp + 0x2b38]
lea rcx, [rsp + 0x280]
call fcn.14001b9fc
mov rax, qword [rsp + 0x1af0]
mov qword [rsp + 0x2b40], rax
mov r8d, 1
mov rdx, qword [rsp + 0x2b40]
lea rcx, [rsp + 0x1ae0]
call fcn.14001bef4
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x2b48], rax
lea r8, str._windir__system32_services.exe
mov rdx, qword [rsp + 0x2b48]
lea rcx, [rsp + 0x280]
call fcn.14001b9fc
mov rax, qword [rsp + 0x1af0]
mov qword [rsp + 0x2b50], rax
mov r8d, 1
mov rdx, qword [rsp + 0x2b50]
lea rcx, [rsp + 0x1ae0]
call fcn.14001bef4
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x2b58], rax
lea r8, str._windir__system32_spoolsv.exe
mov rdx, qword [rsp + 0x2b58]
lea rcx, [rsp + 0x280]
call fcn.14001b9fc
mov rax, qword [rsp + 0x1af0]
mov qword [rsp + 0x2b60], rax
mov r8d, 1
mov rdx, qword [rsp + 0x2b60]
lea rcx, [rsp + 0x1ae0]
call fcn.14001bef4
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x2b68], rax
lea r8, str._windir__system32_rundll32.exe
mov rdx, qword [rsp + 0x2b68]
lea rcx, [rsp + 0x280]
call fcn.14001b9fc
mov rax, qword [rsp + 0x1af0]
mov qword [rsp + 0x2b70], rax
mov r8d, 1
mov rdx, qword [rsp + 0x2b70]
lea rcx, [rsp + 0x1ae0]
call fcn.14001bef4
mov r9, 0xffffffff80000001
lea r8, [rsp + 0x1ae0]
lea rdx, [rsp + 0x280]
lea rcx, str.UninstallerTracedProcInclude
call fcn.1401a67a0
xor eax, eax
mov word [rsp + 0x1b10], ax
lea rdi, [rsp + 0x1b12]
xor eax, eax
mov ecx, 0xffe
rep stosb byte [rdi], al
mov dword [rsp + 0x2b10], 0
jmp 0x1401bc9e0
mov eax, dword [rsp + 0x2b10]
add eax, 1
mov dword [rsp + 0x2b10], eax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x2b78], rax
movsxd rax, dword [rsp + 0x2b10]
cmp rax, qword [rsp + 0x2b78]
jge 0x1401bcb29
movsxd rax, dword [rsp + 0x2b10]
mov qword [rsp + 0x2b80], rax
cmp qword [rsp + 0x2b80], 0
jl 0x1401bca33
mov rax, qword [rsp + 0x1af0]
cmp qword [rsp + 0x2b80], rax
jl 0x1401bca38
call fcn.1400093e4
mov rcx, qword [rsp + 0x1ae8]
mov rax, qword [rsp + 0x2b80]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x2b88], eax
cmp dword [rsp + 0x2b88], 0
je 0x1401bcb24
movsxd rax, dword [rsp + 0x2b10]
mov qword [rsp + 0x2b90], rax
cmp qword [rsp + 0x2b90], 0
jl 0x1401bca8d
mov rax, qword [rsp + 0x290]
cmp qword [rsp + 0x2b90], rax
jl 0x1401bca92
call fcn.1400093e4
mov rcx, qword [rsp + 0x288]
mov rax, qword [rsp + 0x2b90]
lea rax, [rcx + rax*8]
mov qword [rsp + 0x2b98], rax
mov rax, qword [rsp + 0x2b98]
mov rax, qword [rax]
mov qword [rsp + 0x2ba0], rax
mov r8d, 0x800
lea rdx, [rsp + 0x1b10]
mov rcx, qword [rsp + 0x2ba0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rax, qword [rsp + 0x2c10]
add rax, 0x108
mov qword [rsp + 0x2bb0], rax
mov rax, qword [rsp + 0x2bb0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x2ba8], rax
lea r8, [rsp + 0x1b10]
mov rdx, qword [rsp + 0x2ba8]
mov rcx, qword [rsp + 0x2bb0]
call fcn.14001b9fc
jmp 0x1401bc9cf
mov dword [rsp + 0x278], 0
xor eax, eax
mov word [rsp + 0x2b0], ax
lea rdi, [rsp + 0x2b2]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x1ad8], rax
cmp qword [rsp + 0x1ad8], 0xffffffffffffffff
jne 0x1401bcb8e
lea rcx, [rsp + 0x1ae0]
call fcn.14001bee0
nop
lea rcx, [rsp + 0x280]
call fcn.14001b8f0
jmp 0x1401bce64
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x1ad8]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1401bcbdb
mov rcx, qword [rsp + 0x1ad8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1ae0]
call fcn.14001bee0
nop
lea rcx, [rsp + 0x280]
call fcn.14001b8f0
jmp 0x1401bce64
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
je 0x1401bccd8
mov r9d, 0x400
lea r8, [rsp + 0x2b0]
xor edx, edx
mov rcx, qword [rsp + 0x270]
call sub.PSAPI.DLL_GetModuleFileNameExW
mov rdx, qword [rsp + 0x2c10]
add rdx, 0x108
mov r9d, 1
lea r8, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2c10]
call fcn.1401babf0
test eax, eax
je 0x1401bcca4
call fcn.140008c24
mov rdx, rax
lea rcx, [rsp + 0x2b18]
call fcn.140005310
nop
lea r9, [rsp + 0x2b0]
mov r8d, dword [rsp + 0x38]
lea rdx, str.PID_not_include:_d__s
lea rcx, [rsp + 0x2b18]
call fcn.140005d30
mov rcx, qword [rsp + 0x2b18]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0x2b18]
call fcn.1400053e0
jmp 0x1401bccc8
movsxd rcx, dword [rsp + 0x278]
mov eax, dword [rsp + 0x38]
mov dword [rsp + rcx*4 + 0xac0], eax
mov eax, dword [rsp + 0x278]
add eax, 1
mov dword [rsp + 0x278], eax
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401bcd2c
call fcn.140008c24
mov rdx, rax
lea rcx, [rsp + 0x2b20]
call fcn.140005310
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8d, dword [rsp + 0x38]
lea rdx, [0x14021d900]
lea rcx, [rsp + 0x2b20]
call fcn.140005d30
mov rcx, qword [rsp + 0x2b20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0x2b20]
call fcn.1400053e0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x1ad8]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1401bcbdb
mov rcx, qword [rsp + 0x1ad8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x2c10]
add rdx, 0x168
xor r8d, r8d
lea rcx, [rsp + 0x1ac0]
call fcn.14000a314
nop
mov edx, 0xffffffff
lea rcx, [rsp + 0x1ac0]
call fcn.14000a278
movsxd rcx, dword [rsp + 0x278]
mov eax, 4
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.140008c1c
mov qword [rsp + 0x2b30], rax
mov rcx, qword [rsp + 0x2c10]
mov rax, qword [rsp + 0x2b30]
mov qword [rcx + 0x30], rax
mov dword [rsp + 0x2b28], 0
jmp 0x1401bcde3
mov eax, dword [rsp + 0x2b28]
add eax, 1
mov dword [rsp + 0x2b28], eax
mov eax, dword [rsp + 0x278]
cmp dword [rsp + 0x2b28], eax
jge 0x1401bce1b
movsxd rax, dword [rsp + 0x2b28]
movsxd rdx, dword [rsp + 0x2b28]
mov rcx, qword [rsp + 0x2c10]
mov rcx, qword [rcx + 0x30]
mov eax, dword [rsp + rax*4 + 0xac0]
mov dword [rcx + rdx*4], eax
jmp 0x1401bcdd2
mov rcx, qword [rsp + 0x2c10]
mov eax, dword [rsp + 0x278]
mov dword [rcx + 0x38], eax
lea rcx, [rsp + 0x1ac0]
call fcn.14000a294
nop
lea rcx, [rsp + 0x1ac0]
call fcn.14000a294
nop
lea rcx, [rsp + 0x1ae0]
call fcn.14001bee0
nop
lea rcx, [rsp + 0x280]
call fcn.14001b8f0
mov rcx, qword [rsp + 0x2bf0]
xor rcx, rsp
call fcn.14002f990
add rsp, 0x2c00
pop rdi
ret