Function at 0x140081720
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x250
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
xor r15d, r15d
mov rbp, r9
mov r8, rdx
mov rbx, rcx
mov qword [rdi], r15
test rcx, rcx
jne 0x14008192c
test byte [r9 + 0x28], 0x20
je 0x14008197a
mov edx, dword [0x14012c9e4]
mov eax, r15d
test edx, edx
je 0x14008197a
mov r9, qword [0x14012ca38]
lea rcx, [r9 + 0x2c]
cmp dword [rcx], r8d
je 0x140081798
inc eax
add rcx, 0x38
cmp eax, edx
jb 0x140081782
xor al, al
jmp 0x140081902
mov rcx, qword [0x140130fb8]
imul rdx, rax, 0x38
mov r8d, 5
mov rdx, qword [rdx + r9]
mov qword [rsp + 0x288], r14
mov rsi, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x140081920
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebx, dword [rsp + 0x20]
mov ecx, ebx
call fcn.1400a82f0
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rdx, rax
mov rcx, r14
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x140081920
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140081920
cmp qword [rbp + 0x358], r15
jne 0x140081833
call fcn.1400a8238
mov qword [rbp + 0x358], rax
mov rcx, qword [rsi + 0x10]
lea rdx, [0x1400d2448]
call fcn.1400a99c0
test rax, rax
je 0x140081854
cmp word [rax + 8], r15w
je 0x140081854
mov word [rax + 8], r15w
mov rax, qword [rsi + 0x10]
cmp word [rax], 0x22
jne 0x140081866
add rax, 2
mov qword [rsi + 0x10], rax
mov rax, qword [rsi + 0x10]
or rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [rax + rdx*2], r15w
jne 0x140081870
add edx, 5
mov ebx, edx
lea rcx, [rdx + rdx]
call fcn.1400a82f0
mov edx, ebx
mov qword [rdi], rax
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.1400a97ac
mov rcx, rsi
call fcn.1400a82b0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400818f8
mov rcx, qword [rdi]
cmp word [rcx], 0x22
je 0x1400818d8
mov edx, 0x20
call fcn.1400a9720
test rax, rax
je 0x1400818d8
mov rcx, qword [rdi]
mov edx, 0x20
call fcn.1400a9720
mov word [rax], r15w
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400818f8
mov rcx, qword [rdi]
lea r8, [0x1400d2448]
mov rdx, rbx
call fcn.1400abdb0
mov al, 1
mov r14, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x250
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rsi
call fcn.1400a82b0
xor al, al
jmp 0x1400818fa
mov rdx, rdi
call fcn.14007ce50
test al, al
jne 0x14008197e
lea r8, [rsp + 0x20]
mov r9d, 2
xor edx, edx
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov esi, eax
test eax, eax
je 0x14008197a
lea rcx, [rsi*2 + 2]
call fcn.1400a82f0
mov r9d, esi
xor edx, edx
mov r8, rax
mov rcx, rbx
mov qword [rdi], rax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov eax, eax
test rax, rax
jne 0x14008197e
xor al, al
jmp 0x140081902
mov rcx, qword [rdi]
lea rdx, str.SystemRoot_
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.1400a9d30
test eax, eax
jne 0x1400819e6
mov r8, qword [rdi]
lea rdx, str.__SystemRoot___s
lea rcx, [rsp + 0x30]
add r8, 0x18
call fcn.14002d7d0
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, eax
mov ebx, eax
add rcx, rcx
call fcn.1400a82f0
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov al, 1
jmp 0x140081902
mov rcx, qword [rdi]
lea rdx, [0x1400d2368]
mov r8d, 4
call fcn.1400a9818
test eax, eax
jne 0x140081a1f
mov rcx, qword [rdi]
or rdx, 0xffffffffffffffff
lea r8, [rcx + 8]
nop word [rax + rax]
inc rdx
cmp word [rcx + rdx*2], r15w
jne 0x140081a10
call fcn.1400a97ac
mov al, 1
jmp 0x140081902