Function at 0x40bc90
Capabilities:
Get common file path
Query or enumerate registry value
Resolve function by parsing pe exports
Set current directory

Disassembly:
mov eax, 0x1045c
call fcn.00412710
mov eax, dword [0x422760]
xor eax, esp
mov dword [esp + 0x10458], eax
push ebx
push esi
mov esi, dword [esp + 0x10468]
push edi
lea ebx, [esi + 2]
push 0x20019
push ebx
call fcn.0040b210
mov edi, eax
add esp, 8
test edi, edi
jne 0x40bce4
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10458]
xor ecx, esp
call fcn.004126f3
add esp, 0x1045c
ret
cmp dword [esp + 0x10470], 0
push 1
setne al
push 0
mov byte [esp + 0x18], al
mov ecx, dword [esp + 0x18]
push ecx
push 0xfffe
lea eax, [esi + 0x18416]
push eax
push 0x41e1cc
push edi
call fcn.0040aab0
add esp, 0x1c
test eax, eax
je 0x40bd3e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x10458]
xor ecx, esp
call fcn.004126f3
add esp, 0x1045c
ret
mov edx, dword [esp + 0x10]
push ebp
push 1
push 0
push edx
push 0x7ffe
lea ebp, [esi + 0x28414]
push ebp
push str.AppParameters
push edi
call fcn.0040aab0
add esp, 0x1c
test eax, eax
je 0x40bd91
push 0
lea eax, [esi + 0x18416]
push eax
push ebx
push str.AppParameters
push 0x80000405
push 2
call fcn.004050e0
push 0x7ffe
push 0
push ebp
call fcn.00412740
add esp, 0x24
mov eax, dword [esp + 0x14]
push 1
push 1
push eax
push 0xffe6
lea ebp, [esi + 0x30412]
push ebp
push str.AppDirectory
push edi
call fcn.0040aab0
add esp, 0x1c
test eax, eax
jne 0x40bdc2
cmp word [ebp], ax
jne 0x40be42
lea eax, [esi + 0x18416]
push eax
push 0x41d488
push 0xffffffffffffffff
push 0x7ff3
push ebp
call fcn.004126d2
push ebp
call fcn.00409580
add esp, 0x18
cmp word [ebp], 0
jne 0x40be2a
push 0xffe6
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40be02
cmp eax, 0xffe6
jbe 0x40be2a
push 0
push ebx
push str.AppDirectory
push 0xc0000407
push 1
call fcn.004050e0
add esp, 0x14
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x40c311
push 0
push ebp
push ebx
push str.AppDirectory
push 0x80000406
push 2
call fcn.004050e0
add esp, 0x18
push 0
push 0
push 0
push 0x400
lea ecx, [esp + 0x78]
push ecx
push str.AppAffinity
push edi
call fcn.0040aab0
add esp, 0x1c
test eax, eax
jne 0x40bf7e
cmp word [esp + 0x68], ax
je 0x40bf7e
lea ebp, [esi + 0x40400]
lea edx, [esp + 0x68]
push ebp
push edx
call fcn.0040c5f0
add esp, 8
test eax, eax
je 0x40beb3
lea eax, [esp + 0x68]
push eax
push ebx
push 0x8000042b
push 2
call fcn.004050e0
add esp, 0x10
mov dword [ebp], 0
mov dword [ebp + 4], 0
jmp 0x40bf8c
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x40bf8c
mov ecx, dword [ebp]
mov ebp, dword [ebp + 4]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], ebp
mov ebp, ecx
and ebp, eax
mov eax, dword [esp + 0x24]
xor edx, edx
and eax, edx
mov dword [esp + 0x40], eax
cmp ebp, ecx
jne 0x40befe
cmp eax, dword [esp + 0x24]
je 0x40bf8c
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x2c], edx
call fcn.0040c3e0
add esp, 0xc
test eax, eax
jne 0x40bf68
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x14]
push ecx
push edx
push ebp
mov dword [esp + 0x20], eax
call fcn.0040c3e0
add esp, 0xc
test eax, eax
jne 0x40bf54
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x74]
push edx
push ebx
push 0x8000042c
push 2
call fcn.004050e0
add esp, 0x1c
mov eax, dword [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x20]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40bf8c
xor eax, eax
mov dword [esi + 0x40400], eax
mov dword [esi + 0x40404], eax
lea edx, [esi + 0x40410]
push edx
lea eax, [esi + 0x403f8]
push eax
push str.AppEnvironment
push edi
push ebx
call fcn.0040a940
lea ecx, [esi + 0x40418]
push ecx
lea edx, [esi + 0x40414]
push edx
push str.AppEnvironmentExtra
push edi
push ebx
call fcn.0040a940
push 0
lea eax, [esp + 0x5c]
push eax
push str.AppPriority
push edi
call fcn.0040ad50
mov ebp, 1
add esp, 0x38
cmp eax, ebp
jne 0x40c00e
call fcn.0040c770
mov ecx, eax
mov eax, dword [esp + 0x30]
and ecx, eax
cmp eax, ecx
jne 0x40bff7
mov dword [esi + 0x4041c], eax
jmp 0x40c00e
push 0
push str.AppPriority
push ebx
push 0x4000042a
push 2
call fcn.004050e0
add esp, 0x14
push 0
lea edx, [esp + 0x20]
push edx
push str.AppRotateFiles
push edi
call fcn.0040ad50
add esp, 0x10
cmp eax, ebp
jne 0x40c037
cmp dword [esp + 0x1c], 0
setne al
mov byte [esi + 0x70460], al
jmp 0x40c03e
mov byte [esi + 0x70460], 0
push 0
lea ecx, [esp + 0x20]
push ecx
push str.AppRotateOnline
push edi
call fcn.0040ad50
add esp, 0x10
cmp eax, ebp
jne 0x40c06d
xor eax, eax
cmp dword [esp + 0x1c], eax
je 0x40c06f
mov dword [esi + 0x70468], ebp
mov dword [esi + 0x70464], ebp
jmp 0x40c07b
xor eax, eax
mov dword [esi + 0x70464], eax
mov dword [esi + 0x70468], eax
push 0
lea ebp, [esi + 0x7046c]
push ebp
push str.AppRotateSeconds
push edi
call fcn.0040ad50
add esp, 0x10
cmp eax, 1
je 0x40c09e
mov dword [ebp], 0
push 0
lea ebp, [esi + 0x70470]
push ebp
push str.AppRotateBytes
push edi
call fcn.0040ad50
add esp, 0x10
cmp eax, 1
je 0x40c0c1
mov dword [ebp], 0
push 0
lea ebp, [esi + 0x70474]
push ebp
push str.AppRotateBytesHigh
push edi
call fcn.0040ad50
add esp, 0x10
cmp eax, 1
je 0x40c0e4
mov dword [ebp], 0
push 0
lea ebp, [esi + 0x40420]
push ebp
push str.AppNoConsole
push edi
call fcn.0040ad50
add esp, 0x10
cmp eax, 1
je 0x40c107
mov dword [ebp], 0
lea edx, [esp + 0x468]
push edx
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [esi + 0x30412]
push eax
call ebp
push edi
push esi
call fcn.0040b230
add esp, 8
test eax, eax
je 0x40c164
push 0
push ebx
push 0xc000041b
push 1
call fcn.004050e0
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x468]
push eax
call ebp
mov eax, 5
jmp 0x40c311
lea ecx, [esp + 0x468]
push ecx
call ebp
push 0x8000042f
push 0
lea edx, [esi + 0x7047c]
push edx
push str.AppRestartDelay
push edi
push ebx
call fcn.0040b010
push 0x8000040c
push 0x5dc
lea eax, [esi + 0x70480]
push eax
push str.AppThrottle
push edi
push ebx
call fcn.0040b010
add esp, 0x30
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push str.AppStopMethodSkip
mov ebp, 4
push edi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x2b], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40c22a
cmp eax, 2
je 0x40c22f
push 0
cmp dword [esp + 0x30], ebp
je 0x40c204
push str.NSSM
push str.AppStopMethodSkip
push ebx
push 0x8000041c
push 2
call fcn.004050e0
add esp, 0x18
jmp 0x40c22f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404fa0
add esp, 4
push eax
push str.AppStopMethodSkip
push 0xc00003fa
push 1
call fcn.004050e0
add esp, 0x14
jmp 0x40c22f
mov byte [esp + 0x13], 1
cmp byte [esp + 0x13], 0
mov dword [esi + 0x70484], 0xffffffff
je 0x40c24c
mov ecx, dword [esp + 0x38]
not ecx
mov dword [esi + 0x70484], ecx
push 0x80000420
push 0x5dc
lea edx, [esi + 0x70488]
push edx
push str.AppStopMethodConsole
push edi
push ebx
call fcn.0040b010
push 0x80000421
push 0x5dc
lea eax, [esi + 0x7048c]
push eax
push str.AppStopMethodWindow
push edi
push ebx
call fcn.0040b010
push 0x80000422
push 0x5dc
lea ecx, [esi + 0x70490]
push ecx
push str.AppStopMethodThreads
push edi
push ebx
call fcn.0040b010
add esp, 0x48
lea edx, [esp + 0x1b]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push ebx
mov dword [esi + 0x70478], 0
call fcn.0040b3a0
add esp, 0x10
test eax, eax
jne 0x40c308
xor ebx, ebx
cmp dword [0x422004], ebx
je 0x40c308
mov eax, 0x422004
mov ecx, dword [eax]
push 0x10
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.0041262c
add esp, 0xc
test eax, eax
je 0x40c302
inc ebx
cmp dword [ebx*4 + 0x422004], 0
lea eax, [ebx*4 + 0x422004]
jne 0x40c2d8
jmp 0x40c308
mov dword [esi + 0x70478], ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x10468]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004126f3
add esp, 0x1045c
ret