Function at 0x140061b70
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
xor esi, esi
call fcn.1400a8238
or rbx, 0xffffffffffffffff
mov rbp, rax
mov rdx, rbx
inc rdx
cmp word [rax + rdx*2], si
jne 0x140061b90
inc rdx
mov rcx, rax
call fcn.1400aa3f4
lea rdx, str.SVCHOST.EXE
mov rcx, rbp
call fcn.1400a99c0
test rax, rax
je 0x140061c9c
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], si
jne 0x140061bc0
add rbx, 0x2e
lea rcx, [rbx + rbx]
call fcn.1400a82f0
lea r8, str.SystemCurrentControlSetServices_s
mov r9, rdi
mov rcx, rax
mov rdx, rbx
mov rbp, rax
call fcn.1400aa928
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140061c94
mov rcx, qword [rsp + 0x78]
lea rdx, str.ServiceDll
call fcn.14005f6f0
mov rsi, rax
test rax, rax
jne 0x140061c94
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.SystemCurrentControlSetServices_sParameters
mov r9, rdi
mov rdx, rbx
mov rcx, rbp
call fcn.1400aa928
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140061c94
mov rcx, qword [rsp + 0x78]
lea rdx, str.ServiceDll
call fcn.14005f6f0
mov rcx, qword [rsp + 0x78]
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
jmp 0x140061d3a
mov rcx, qword [0x140130fb8]
mov r8d, 5
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x140061cc7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebx, dword [rsp + 0x70]
mov ecx, ebx
call fcn.1400a82f0
lea r9, [rsp + 0x70]
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
je 0x140061d37
mov ecx, ebx
add rcx, rcx
call fcn.1400a82f0
mov rcx, qword [rdi + 0x10]
mov r8d, ebx
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
call fcn.1400a82b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140061dbb
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov ebp, eax
test eax, eax
je 0x140061dbb
lea rcx, [rbp*2]
call fcn.1400a82f0
mov r9d, ebp
xor r8d, r8d
mov rdi, rax
lea rax, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov edx, ebp
mov rcx, rdi
call fcn.1400aa140
mov rcx, rsi
call fcn.1400a82b0
mov rsi, rdi
mov rax, rsi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret