Function at 0x1400015c0
Capabilities:
Query environment variable
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x50
call fcn.140009290
sub rsp, rax
mov rax, qword [0x140035d40]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebp, ebp
xor ecx, ecx
mov edi, ebp
call fcn.140006360
call fcn.140002d70
mov rcx, qword [0x140036840]
lea rdx, [0x14003a060]
mov dword [0x14003a064], 2
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea rcx, str.MgrJobs_
call fcn.1400044c0
mov rcx, rax
call fcn.140005e20
lea rcx, str.MgrJobsInput_
call fcn.1400044c0
mov rcx, rax
call fcn.140005e20
lea rcx, str.MgrJobsCmd_
call fcn.1400044c0
mov rcx, rax
call fcn.140005e20
lea rcx, str.MgrJobsLog_
call fcn.1400044c0
mov rcx, rax
call fcn.140005e20
lea rcx, str.MgrJobsLogJobsSummary
call fcn.1400044c0
mov rcx, rax
call fcn.140005e20
lea rcx, str.MgrJobsInput.job
call fcn.1400044c0
mov rcx, rax
call fcn.140005e20
lea rcx, str.MgrJobsLogJobsJobs
call fcn.1400044c0
mov rcx, rax
call fcn.1400062a0
lea rdx, [0x1400276b8]
lea rcx, str.ServiceWork
call fcn.1400012e0
lea rdx, str._________Status:_Start_pending_________
lea rcx, str.ServiceWork
call fcn.1400012e0
lea rdx, str.V6.0___2023.07.23
lea rcx, str.Version
call fcn.1400012e0
call fcn.140003490
mov rdx, rax
lea rcx, str.MyExe
call fcn.1400012e0
lea rdx, str.MgrJobs_
lea rcx, str.JobDir
call fcn.1400012e0
lea rdx, str.MgrJobsCmd_
lea rcx, str.CmdDir
call fcn.1400012e0
lea rdx, str.MgrJobsLog_
lea rcx, str.LogDir
call fcn.1400012e0
lea rdx, str.MgrJobsLogJobsJobs
lea rcx, str.MyLogName
call fcn.1400012e0
lea rdx, str.MgrJobsLogJobsSummary
lea rcx, str.MySummary
call fcn.1400012e0
lea rdx, str.MgrJobs.dat
lea rcx, str.DatFile
call fcn.1400012e0
lea rdx, str.MgrJobsInput_
lea rcx, str.JobInput
call fcn.1400012e0
lea rdx, str.MgrJobsInput.job
lea rcx, str.JobPat
call fcn.1400012e0
lea rdx, str.MgrJobs.cmd
lea rcx, str.CmdExec
call fcn.1400012e0
lea rdx, str._______________________________
lea rcx, str.________
call fcn.1400012e0
lea rcx, str.MgrJobs_
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
lea rcx, str.SetCurrentDirectory:__s__failed_
lea rdx, str.SetCurrentDirectory:__s__o.k._
cmove rdx, rcx
lea r8, str.MgrJobs_
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
mov rcx, qword [0x140036840]
lea rdx, [0x14003a060]
mov dword [0x14003a064], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea rdx, str._________Status:_Running_________
lea rcx, str.ServiceWork
call fcn.1400012e0
call fcn.140003020
lea rdx, [0x140038c20]
sub rdx, rax
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140001840
lea rcx, [0x140038c20]
call fcn.140003d70
xor ecx, ecx
call fcn.140004f70
mov rcx, rax
mov qword [rsp + 0x60], rsi
movabs r14, 0x624dd2f1a9fbe77
mov rax, r14
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
mov dword [0x14003685c], ecx
mov dword [0x140036854], ecx
mov eax, dword [0x140036860]
test eax, eax
je 0x14000193f
cmp eax, 5
jne 0x1400018de
mov rcx, qword [0x140036840]
lea rdx, [0x14003a060]
mov dword [0x140036860], ebp
mov dword [0x14003a064], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea rdx, str._________Status:_Running_________
lea rcx, str.ServiceWork
call fcn.1400012e0
jmp 0x14000193f
cmp eax, 6
jne 0x140001936
mov rcx, qword [0x140036840]
lea rdx, [0x14003a060]
mov dword [0x14003a064], 7
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea rdx, str._________Status:_Paused_________
lea rcx, str.ServiceWork
call fcn.1400012e0
cmp dword [0x140036860], 6
jne 0x14000193f
nop dword [rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140036860], 6
je 0x140001920
jmp 0x14000193f
cmp eax, 3
je 0x140001d35
xor ecx, ecx
call fcn.140004f70
mov rcx, rax
mov rax, r14
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
mov eax, ecx
mov dword [0x140036858], ecx
sub eax, dword [0x140036854]
mov dword [0x140036850], eax
mov eax, ecx
sub eax, dword [0x14003685c]
cmp eax, 0x3d
jle 0x1400019d0
lea rdx, [0x140027890]
lea rcx, str.Wakeup
call fcn.1400012e0
mov ecx, dword [0x140036858]
sub ecx, dword [0x14003685c]
call fcn.140003c40
mov r8, rax
lea rdx, [0x1400278bc]
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, [0x1400278c0]
call fcn.1400012e0
mov ecx, dword [0x140036858]
mov dword [0x14003685c], ecx
cmp ecx, 0x3c
jge 0x140001a27
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, dword [0x140036858]
lea rdx, str.Start:__3d_sec.___Current:__3d_sec.___BootDelay:__3d_sec.
mov r8d, dword [0x140036854]
lea rcx, [0x140037c20]
mov dword [rsp + 0x20], 0x3c
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, [0x1400278c0]
call fcn.1400012e0
jmp 0x140001892
cmp edi, 4
jge 0x140001a3e
inc edi
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001892
lea rcx, [rsp + 0x30]
mov edi, ebp
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x36]
cmp eax, dword [section..data]
je 0x140001c6e
mov dword [section..data], eax
call fcn.140004840
lea rdx, [0x1400276b8]
lea rcx, str.ServiceWork
call fcn.1400012e0
lea rdx, str._________Next_day_________
lea rcx, str.ServiceWork
call fcn.1400012e0
xor ecx, ecx
call fcn.140004f70
mov rcx, rax
mov rax, r14
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
call fcn.140003c40
xor ecx, ecx
mov rbx, rax
call fcn.140004f70
mov r8, rax
lea rcx, [0x140037c20]
mov rax, r14
mov r9, rbx
mul r8
sub r8, rdx
shr r8, 1
add r8, rdx
lea rdx, str.Uptime:______8d_seconds____s
shr r8, 9
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
mov ecx, dword [0x140036850]
call fcn.140003c40
mov r8d, dword [0x140036850]
lea rdx, str.Running:_____8d_seconds____s
mov r9, rax
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
mov r8d, 0x3e8
lea rdx, str.SleepTicks:__8d_ticks
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
mov r8d, 4
lea rdx, str.SkipChecks:__8d
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
mov r8d, dword [0x14003500c]
lea rdx, str.DeltaMax:____8d
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
mov r8d, 0x1400
lea rdx, str.FileList:____8zd_bytes
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
lea rdx, str._______________________________
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov rsi, rax
mov rbx, rax
cmp byte [rax], dil
je 0x140001c60
nop dword [rax + rax]
mov r8, rbx
lea rdx, str.Env:__s
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
cmp byte [rbx], dil
je 0x140001c58
nop
inc rbx
cmp byte [rbx], dil
jne 0x140001c50
inc rbx
cmp byte [rbx], dil
jne 0x140001c20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.140004900
movzx eax, word [rsp + 0x38]
cmp eax, dword [0x140035004]
je 0x140001d06
cmp word [rsp + 0x3a], 0x32
ja 0x140001d06
lea rdx, [0x1400276b8]
lea rcx, str.ServiceWork
call fcn.1400012e0
movzx eax, word [rsp + 0x38]
lea rdx, str._________Next_hour_________
lea rcx, [0x140037c20]
mov dword [0x140035004], eax
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
mov ecx, dword [0x140036850]
call fcn.140003c40
mov r8d, dword [0x140036850]
lea rdx, str.Running:_____8d_seconds____s
mov r9, rax
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.ServiceWork
call fcn.1400012e0
movzx eax, word [rsp + 0x3a]
cmp eax, dword [0x140035008]
je 0x140001d2b
lea rcx, str.MgrJobs.dat
mov dword [0x140035008], eax
mov dword [0x14003684c], ebp
call fcn.140002390
call fcn.140001dd0
jmp 0x140001892
mov rcx, qword [0x140036840]
lea rdx, [0x14003a060]
mov dword [0x14003a064], 3
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea rdx, str._________Status:_Stop_pending_________
lea rcx, str.ServiceWork
call fcn.1400012e0
lea rdx, str._________Status:_Stopped_________
lea rcx, str.ServiceWork
call fcn.1400012e0
call fcn.140006260
mov rcx, qword [0x140036840]
lea rdx, [0x14003a060]
mov dword [0x14003a064], 1
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400092f0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret