Function at 0x14000dd40
Capabilities:
Get common file path
Query or enumerate registry value
Set current directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x104c0
call fcn.140024ca0
sub rsp, rax
mov rax, qword [0x140030f90]
xor rax, rsp
mov qword [rsp + 0x104b0], rax
mov rdi, rdx
mov rbx, rcx
mov edx, 0x20019
add rcx, 2
call fcn.14000cd30
mov rsi, rax
test rax, rax
jne 0x14000dd8a
lea eax, [rsi + 1]
jmp 0x14000e5c6
lea rax, [rbx + 0x4042c]
lea r9, [rbx + 0x40410]
lea r8, str.AppEnvironment
lea rcx, [rbx + 2]
test rdi, rdi
mov rdx, rsi
mov qword [rsp + 0x10500], r14
mov qword [rsp + 0x20], rax
setne r14b
call fcn.14000bbd0
lea r11, [rbx + 0x40438]
lea r9, [rbx + 0x40430]
lea r8, str.AppEnvironmentExtra
lea rcx, [rbx + 2]
mov rdx, rsi
mov qword [rsp + 0x20], r11
call fcn.14000bbd0
test rdi, rdi
je 0x14000ddf2
mov rcx, rbx
call fcn.14000ed90
mov byte [rsp + 0x30], 1
lea rbp, [rbx + 0x1842a]
lea rdx, str.Application
mov r9d, 0xfffe
mov rcx, rsi
mov r8, rbp
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], r14b
call fcn.14000bdb0
test eax, eax
je 0x14000de37
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x14000e5be
mov byte [rsp + 0x30], 1
lea r8, [rbx + 0x28428]
lea rdx, str.AppParameters
mov r9d, 0x7ffe
mov rcx, rsi
mov qword [rsp + 0x104f8], r13
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], r14b
mov qword [rsp + 0x10508], r15
call fcn.14000bdb0
xor edi, edi
lea r15d, [rdi + 2]
test eax, eax
je 0x14000deb3
lea r9, [rbx + 2]
lea r8, str.AppParameters
mov edx, 0x80000405
movzx ecx, r15w
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
call fcn.1400025f0
lea rcx, [rbx + 0x28428]
xor edx, edx
mov r8d, 0x7ffe
call fcn.140018830
mov byte [rsp + 0x30], 1
lea r13, [rbx + 0x30426]
lea rdx, str.AppDirectory
mov r9d, 0xffe6
mov rcx, rsi
mov r8, r13
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r14b
call fcn.14000bdb0
test eax, eax
jne 0x14000def0
cmp word [r13], di
jne 0x14000df8b
lea r9, [0x140026d3c]
or r8, 0xffffffffffffffff
mov edx, 0x7ff3
mov rcx, r13
mov qword [rsp + 0x20], rbp
call fcn.140018170
mov rcx, r13
call fcn.140009f50
cmp word [r13], di
jne 0x14000df68
mov edx, 0xffe6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14000df35
cmp eax, 0xffe6
jbe 0x14000df68
mov ebp, 1
lea r9, [rbx + 2]
lea r8, str.AppDirectory
mov edx, 0xc0000407
movzx ecx, bp
mov qword [rsp + 0x20], rdi
call fcn.1400025f0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rbp + 3]
jmp 0x14000e5ae
lea r9, [rbx + 2]
lea r8, str.AppDirectory
mov edx, 0x80000406
movzx ecx, r15w
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
call fcn.1400025f0
mov byte [rsp + 0x30], dil
lea r8, [rsp + 0xb0]
lea rdx, str.AppAffinity
mov r9d, 0x400
mov rcx, rsi
mov byte [rsp + 0x28], dil
mov byte [rsp + 0x20], dil
call fcn.14000bdb0
test eax, eax
jne 0x14000e0d4
cmp word [rsp + 0xb0], di
je 0x14000e0d4
lea rdx, [rbx + 0x40418]
lea rcx, [rsp + 0xb0]
call fcn.14000eac0
test eax, eax
je 0x14000e00b
lea r9, [rsp + 0xb0]
lea r8, [rbx + 2]
mov edx, 0x8000042b
movzx ecx, r15w
call fcn.1400025f0
mov qword [rbx + 0x40418], rdi
jmp 0x14000e0db
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x14000e0db
mov rax, qword [rbx + 0x40418]
mov rcx, qword [rsp + 0x78]
mov rbp, rax
and rbp, rcx
cmp rbp, rax
je 0x14000e0db
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rdi
call fcn.14000e8b0
test eax, eax
jne 0x14000e0bc
lea rdx, [rsp + 0x68]
mov rcx, rbp
mov qword [rsp + 0x68], rdi
call fcn.14000e8b0
test eax, eax
jne 0x14000e0a6
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
lea r8, [rbx + 2]
mov edx, 0x8000042c
movzx ecx, r15w
mov qword [rsp + 0x20], rax
call fcn.1400025f0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000e0db
mov qword [rbx + 0x40418], rdi
lea r8, [rsp + 0x70]
lea rdx, str.AppPriority
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
cmp eax, 1
jne 0x14000e12c
call fcn.14000ecd0
mov ecx, dword [rsp + 0x70]
and eax, ecx
cmp ecx, eax
jne 0x14000e10e
mov dword [rbx + 0x4043c], ecx
jmp 0x14000e12c
lea r9, str.AppPriority
lea r8, [rbx + 2]
mov edx, 0x4000042a
movzx ecx, r15w
mov qword [rsp + 0x20], rdi
call fcn.1400025f0
lea r8, [rsp + 0x44]
lea rdx, str.AppRedirectHook
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
cmp eax, 1
jne 0x14000e157
cmp dword [rsp + 0x44], edi
setne al
mov byte [rbx + 0x704ac], al
jmp 0x14000e15b
mov dword [rsp + 0x44], edi
lea r8, [rsp + 0x40]
lea rdx, str.AppRotateFiles
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
cmp eax, 1
jne 0x14000e186
cmp dword [rsp + 0x40], edi
setne al
mov byte [rbx + 0x704ad], al
jmp 0x14000e18d
mov byte [rbx + 0x704ad], dil
lea r8, [rsp + 0x40]
lea rdx, str.AppRotateOnline
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
mov ebp, 1
cmp eax, ebp
jne 0x14000e1cf
cmp dword [rsp + 0x40], edi
je 0x14000e1c1
mov dword [rbx + 0x704b8], ebp
mov dword [rbx + 0x704b4], ebp
jmp 0x14000e1db
mov dword [rbx + 0x704b8], edi
mov dword [rbx + 0x704b4], edi
jmp 0x14000e1db
mov dword [rbx + 0x704b8], edi
mov dword [rbx + 0x704b4], edi
lea r8, [rsp + 0x60]
lea rdx, str.AppTimestampLog
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
cmp eax, ebp
jne 0x14000e20e
cmp dword [rsp + 0x60], edi
je 0x14000e205
mov byte [rbx + 0x704ae], bpl
jmp 0x14000e215
mov byte [rbx + 0x704ae], dil
jmp 0x14000e215
mov byte [rbx + 0x704ae], dil
mov ecx, dword [rsp + 0x44]
cmp dword [rbx + 0x704b4], edi
jne 0x14000e232
cmp byte [rbx + 0x704ae], dil
jne 0x14000e232
test ecx, ecx
jne 0x14000e232
mov eax, edi
jmp 0x14000e234
mov eax, ebp
mov byte [rbx + 0x6045c], al
cmp dword [rbx + 0x704b8], edi
jne 0x14000e253
cmp byte [rbx + 0x704ae], dil
jne 0x14000e253
test ecx, ecx
jne 0x14000e253
mov eax, edi
jmp 0x14000e255
mov eax, ebp
lea r8, [rbx + 0x704bc]
lea rdx, str.AppRotateSeconds
xor r9d, r9d
mov rcx, rsi
mov byte [rbx + 0x70488], al
call fcn.14000c0f0
cmp eax, ebp
je 0x14000e27e
mov dword [rbx + 0x704bc], edi
lea r8, [rbx + 0x704c0]
lea rdx, str.AppRotateBytes
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
cmp eax, ebp
je 0x14000e2a1
mov dword [rbx + 0x704c0], edi
lea r8, [rbx + 0x704c4]
lea rdx, str.AppRotateBytesHigh
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
cmp eax, ebp
je 0x14000e2c4
mov dword [rbx + 0x704c4], edi
lea r9, [rbx + 0x704c8]
lea r8, str.AppRotateDelay
lea rcx, [rbx + 2]
mov rdx, rsi
mov dword [rsp + 0x28], 0x8000040c
mov dword [rsp + 0x20], edi
call fcn.14000cab0
lea r8, [rbx + 0x40440]
lea rdx, str.AppNoConsole
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
cmp eax, ebp
je 0x14000e30d
mov dword [rbx + 0x40440], edi
lea rdx, [rsp + 0x4b0]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rdx, rsi
mov rcx, rbx
call fcn.14000cd40
test eax, eax
je 0x14000e36d
lea r8, [rbx + 2]
xor r9d, r9d
mov edx, 0xc000041b
movzx ecx, bp
call fcn.1400025f0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, 5
jmp 0x14000e5ae
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r9, [rbx + 0x704d0]
lea r8, str.AppRestartDelay
lea rcx, [rbx + 2]
mov rdx, rsi
mov dword [rsp + 0x28], 0x8000042f
mov dword [rsp + 0x20], edi
call fcn.14000cab0
lea r9, [rbx + 0x704d4]
lea r8, str.AppThrottle
lea rcx, [rbx + 2]
mov rdx, rsi
mov dword [rsp + 0x28], 0x8000040c
mov dword [rsp + 0x20], 0x5dc
call fcn.14000cab0
lea rax, [rsp + 0x74]
lea r9, [rsp + 0x4c]
lea rdx, str.AppStopMethodSkip
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x4c], 4
mov dword [rsp + 0x74], 4
mov qword [rsp + 0x20], rax
xor r13b, r13b
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000e46b
cmp eax, r15d
je 0x14000e46f
cmp dword [rsp + 0x4c], 4
je 0x14000e446
lea rax, str.NSSM
lea r9, str.AppStopMethodSkip
lea r8, [rbx + 2]
mov edx, 0x8000041c
movzx ecx, r15w
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.1400025f0
jmp 0x14000e46f
mov ecx, eax
call fcn.140002430
lea r8, str.AppStopMethodSkip
mov edx, 0xc00003fa
movzx ecx, bp
mov r9, rax
mov qword [rsp + 0x20], rdi
call fcn.1400025f0
jmp 0x14000e46f
movzx r13d, bpl
mov dword [rbx + 0x704d8], 0xffffffff
test r13b, r13b
je 0x14000e48a
mov eax, dword [rsp + 0x50]
not eax
mov dword [rbx + 0x704d8], eax
lea r9, [rbx + 0x704dc]
lea r8, str.AppStopMethodConsole
lea rcx, [rbx + 2]
mov rdx, rsi
mov dword [rsp + 0x28], 0x80000420
mov dword [rsp + 0x20], 0x5dc
call fcn.14000cab0
lea r9, [rbx + 0x704e0]
lea r8, str.AppStopMethodWindow
lea rcx, [rbx + 2]
mov rdx, rsi
mov dword [rsp + 0x28], 0x80000421
mov dword [rsp + 0x20], 0x5dc
call fcn.14000cab0
lea r9, [rbx + 0x704e4]
lea r8, str.AppStopMethodThreads
lea rcx, [rbx + 2]
mov rdx, rsi
mov dword [rsp + 0x28], 0x80000422
mov dword [rsp + 0x20], 0x5dc
call fcn.14000cab0
lea r8, [rsp + 0x64]
lea rdx, str.AppKillProcessTree
xor r9d, r9d
mov rcx, rsi
call fcn.14000c0f0
cmp eax, ebp
jne 0x14000e532
cmp dword [rsp + 0x64], edi
setne al
mov byte [rbx + 0x704e8], al
jmp 0x14000e539
mov byte [rbx + 0x704e8], bpl
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x88]
lea rcx, [rbx + 2]
xor edx, edx
mov dword [rbx + 0x704cc], edi
call fcn.14000cf10
test eax, eax
jne 0x14000e5a3
mov rbp, rdi
cmp qword [str.Restart], rdi
je 0x14000e5a3
lea r12, str.Restart
mov rax, r12
mov rdx, qword [rax]
lea rcx, [rsp + 0x88]
mov r8d, 0x10
call fcn.14001873c
test eax, eax
je 0x14000e59d
inc rbp
inc edi
cmp qword [r12 + rbp*8], 0
lea rax, [r12 + rbp*8]
jne 0x14000e571
jmp 0x14000e5a3
mov dword [rbx + 0x704cc], edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov r13, qword [rsp + 0x104f8]
mov r15, qword [rsp + 0x10508]
mov r14, qword [rsp + 0x10500]
mov rcx, qword [rsp + 0x104b0]
xor rcx, rsp
call fcn.140018800
add rsp, 0x104c0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret