Function at 0x140001dd0
Capabilities:
Enumerate files on windows
Move file
Query environment variable
Set environment variable

Disassembly:
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x14f8]
mov eax, 0x15f8
call fcn.140009290
sub rsp, rax
mov rax, qword [0x140035d40]
xor rax, rsp
mov qword [rbp + 0x14e0], rax
xor esi, esi
lea rdx, [rsp + 0x60]
lea rcx, str.MgrJobsInput.job
mov dword [0x140036848], esi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea r14, [0x140038c60]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001f1e
nop word [rax + rax]
movsxd r8, dword [0x140036848]
cmp r8d, 5
jge 0x140001ebf
movzx eax, byte [0x140027640]
mov r9, r8
movups xmm0, xmmword [str.MgrJobsInput_]
shl r9, 0xa
add r9, r14
movups xmmword [r9], xmm0
mov byte [r9 + 0x10], al
lea rax, [r9 - 1]
cmp byte [rax + 1], sil
lea rax, [rax + 1]
jne 0x140001e65
lea r10, [rbp - 0x74]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r10 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140001e80
inc r8d
lea rdx, str.File__2.2d:__s
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.FindFile
call fcn.1400012e0
inc dword [0x140036848]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001e30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, dword [0x140036848]
lea rdx, str.Files_found:__d
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.Findjobs
call fcn.1400012e0
lea rdx, [0x1400276b8]
lea rcx, str.________
call fcn.1400012e0
mov qword [rsp + 0x1620], rdi
mov ebx, esi
cmp dword [0x140036848], ebx
mov qword [rsp + 0x1628], r12
mov qword [rsp + 0x1630], r13
mov qword [rsp + 0x15f0], r15
jle 0x14000233d
lea r15, str.MgrJobs.cmd
lea r12, [0x140027bc4]
lea r13, str._E:ON
xor edx, edx
lea rcx, str.Y.M.D_h.m.s
call fcn.140003780
lea rdx, [rbp + 0xa0]
sub rdx, rax
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140001f80
movsxd rdi, ebx
lea r9, [rbp + 0xce0]
shl rdi, 0xa
xor r8d, r8d
add rdi, r14
mov qword [rsp + 0x20], rsi
mov rcx, rdi
xor edx, edx
call fcn.1400127ec
mov rcx, rsi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0xce0]
mov byte [rbp + rcx + 0xe0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001fc0
lea rdx, str._202
lea rcx, [rbp + 0xe0]
call fcn.140004130
test eax, eax
jle 0x140002004
cdqe
cmp rax, 0x400
jae 0x14000237b
mov byte [rbp + rax + 0xe0], sil
lea rax, [rbp + 0xe0]
nop dword [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140002020
mov byte [rax], 0x5c
inc rax
jmp 0x140002010
test cl, cl
je 0x140002029
inc rax
jmp 0x140002010
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xe0]
lea rax, [rbp + 0xce0]
lea r8, str.MgrJobsCmd_
mov qword [rsp + 0x20], rax
lea rdx, str._s_s_s__s.cmd
lea rcx, [rbp + 0x4e0]
call fcn.140002a90
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xe0]
lea rax, [rbp + 0xce0]
lea r8, str.MgrJobsLog_
mov qword [rsp + 0x20], rax
lea rdx, str._s_s_s__s.log
lea rcx, [rbp + 0x8e0]
call fcn.140002a90
lea rcx, [rbp + 0x4e0]
call fcn.1400044c0
mov rcx, rax
call fcn.140005e20
lea rcx, [rbp + 0x8e0]
call fcn.1400044c0
mov rcx, rax
call fcn.140005e20
mov r8, rdi
lea rdx, str._s___Rename_to_...
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.StartJobs
call fcn.1400012e0
lea r8, [rbp + 0x4e0]
lea rdx, [0x1400278bc]
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.StartJobs
call fcn.1400012e0
lea rdx, [rbp + 0x4e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [rbp + 0x4e0]
call fcn.1400044c0
mov rcx, rax
call fcn.1400033b0
lea rcx, [0x140037c20]
test eax, eax
jne 0x140002176
lea r9, [rbp + 0x4e0]
mov r8, rdi
lea rdx, str._s____s___Rename_failed__retry_later
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.RenameJobs
call fcn.1400012e0
jmp 0x14000232f
lea r8, [rbp + 0x8e0]
lea rdx, [0x1400278bc]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.StartJobs
call fcn.1400012e0
movups xmm0, xmmword [str._Windir_System32Cmd.exe]
movzx eax, word [0x140027bb8]
lea rdx, [rbp + 0xe0]
lea rcx, str._Job
mov word [rbp + 0xd8], ax
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140027bb0]
movsd qword [rbp + 0xd0], xmm0
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov r8d, 0x400
lea rdx, [rbp + 0x10e0]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x8e0]
mov qword [rsp + 0x48], rax
lea r9, [0x140027bd4]
lea rax, [rbp + 0x4e0]
mov ecx, 1
mov qword [rsp + 0x40], rax
lea r8, str.Cmd.exe
mov qword [rsp + 0x38], r15
lea rax, [0x140027bd0]
mov qword [rsp + 0x30], r12
lea rdx, [rbp + 0x10e0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.14001294c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0xe0]
lea rdx, str._____________Job:__s_started_____________
lea rcx, [0x140037c20]
call fcn.140002a90
lea rdx, [0x140037c20]
lea rcx, str.Spawn
call fcn.1400012e0
lea rdx, [0x1400276b8]
lea rcx, str.________
call fcn.1400012e0
call fcn.1400035b0
mov r8, rax
lea r9, [rbp + 0x8e0]
lea rdx, str._s____s
lea rcx, [0x140037c20]
call fcn.140002a90
lea r9, [rbp + 0xa0]
mov byte [rbp + 0xaa], sil
lea r8, str.MgrJobsLogJobsSummary
lea rdx, [0x140027b90]
lea rcx, [rbp + 0xe0]
call fcn.140002a90
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, rax
call fcn.140005160
mov rbx, rax
test rax, rax
je 0x140002313
lea rdx, [0x140037c20]
mov rcx, rax
call fcn.140005b60
mov rcx, rbx
call fcn.140004fc0
mov ebx, esi
cmp dword [0x140036860], esi
jne 0x14000232f
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x140002315
inc ebx
cmp ebx, dword [0x140036848]
jl 0x140001f61
mov r15, qword [rsp + 0x15f0]
xor eax, eax
mov r13, qword [rsp + 0x1630]
mov r12, qword [rsp + 0x1628]
mov rdi, qword [rsp + 0x1620]
mov rcx, qword [rbp + 0x14e0]
xor rcx, rsp
call fcn.1400092f0
add rsp, 0x15f8
pop r14
pop rsi
pop rbx
pop rbp
ret
call fcn.140009068
int3