Function at 0x40bec0
Capabilities:
Get common file path
Query or enumerate registry value
Resolve function by parsing pe exports
Set current directory

Disassembly:
mov eax, 0x1045c
call fcn.00412cf0
mov eax, dword [0x422760]
xor eax, esp
mov dword [esp + 0x10458], eax
push ebx
push esi
mov esi, dword [esp + 0x10468]
push edi
lea ebx, [esi + 2]
push 0x20019
push ebx
call fcn.0040b440
mov edi, eax
add esp, 8
test edi, edi
jne 0x40bf14
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10458]
xor ecx, esp
call fcn.00412cdc
add esp, 0x1045c
ret
cmp dword [esp + 0x10470], 0
push 1
setne al
push 0
mov byte [esp + 0x18], al
mov ecx, dword [esp + 0x18]
push ecx
push 0xfffe
lea eax, [esi + 0x18416]
push eax
push str.Application
push edi
call fcn.0040ace0
add esp, 0x1c
test eax, eax
je 0x40bf6e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x10458]
xor ecx, esp
call fcn.00412cdc
add esp, 0x1045c
ret
mov edx, dword [esp + 0x10]
push ebp
push 1
push 0
push edx
push 0x7ffe
lea ebp, [esi + 0x28414]
push ebp
push str.AppParameters
push edi
call fcn.0040ace0
add esp, 0x1c
test eax, eax
je 0x40bfc1
push 0
lea eax, [esi + 0x18416]
push eax
push ebx
push str.AppParameters
push 0x80000405
push 2
call fcn.00405400
push 0x7ffe
push 0
push ebp
call fcn.00412d20
add esp, 0x24
mov eax, dword [esp + 0x14]
push 1
push 1
push eax
push 0xffe6
lea ebp, [esi + 0x30412]
push ebp
push str.AppDirectory
push edi
call fcn.0040ace0
add esp, 0x1c
test eax, eax
jne 0x40bff2
cmp word [ebp], ax
jne 0x40c072
lea eax, [esi + 0x18416]
push eax
push 0x41d4b4
push 0xffffffffffffffff
push 0x7ff3
push ebp
call fcn.00412731
push ebp
call fcn.00409870
add esp, 0x18
cmp word [ebp], 0
jne 0x40c05a
push 0xffe6
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40c032
cmp eax, 0xffe6
jbe 0x40c05a
push 0
push ebx
push str.AppDirectory
push 0xc0000407
push 1
call fcn.00405400
add esp, 0x14
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x40c541
push 0
push ebp
push ebx
push str.AppDirectory
push 0x80000406
push 2
call fcn.00405400
add esp, 0x18
push 0
push 0
push 0
push 0x400
lea ecx, [esp + 0x78]
push ecx
push str.AppAffinity
push edi
call fcn.0040ace0
add esp, 0x1c
test eax, eax
jne 0x40c1ae
cmp word [esp + 0x68], ax
je 0x40c1ae
lea ebp, [esi + 0x40400]
lea edx, [esp + 0x68]
push ebp
push edx
call fcn.0040c820
add esp, 8
test eax, eax
je 0x40c0e3
lea eax, [esp + 0x68]
push eax
push ebx
push 0x8000042b
push 2
call fcn.00405400
add esp, 0x10
mov dword [ebp], 0
mov dword [ebp + 4], 0
jmp 0x40c1bc
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x40c1bc
mov ecx, dword [ebp]
mov ebp, dword [ebp + 4]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], ebp
mov ebp, ecx
and ebp, eax
mov eax, dword [esp + 0x24]
xor edx, edx
and eax, edx
mov dword [esp + 0x40], eax
cmp ebp, ecx
jne 0x40c12e
cmp eax, dword [esp + 0x24]
je 0x40c1bc
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x2c], edx
call fcn.0040c610
add esp, 0xc
test eax, eax
jne 0x40c198
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x14]
push ecx
push edx
push ebp
mov dword [esp + 0x20], eax
call fcn.0040c610
add esp, 0xc
test eax, eax
jne 0x40c184
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x74]
push edx
push ebx
push 0x8000042c
push 2
call fcn.00405400
add esp, 0x1c
mov eax, dword [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x20]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40c1bc
xor eax, eax
mov dword [esi + 0x40400], eax
mov dword [esi + 0x40404], eax
lea edx, [esi + 0x40410]
push edx
lea eax, [esi + 0x403f8]
push eax
push str.AppEnvironment
push edi
push ebx
call fcn.0040ab70
lea ecx, [esi + 0x40418]
push ecx
lea edx, [esi + 0x40414]
push edx
push str.AppEnvironmentExtra
push edi
push ebx
call fcn.0040ab70
push 0
lea eax, [esp + 0x5c]
push eax
push str.AppPriority
push edi
call fcn.0040af80
mov ebp, 1
add esp, 0x38
cmp eax, ebp
jne 0x40c23e
call fcn.0040c9a0
mov ecx, eax
mov eax, dword [esp + 0x30]
and ecx, eax
cmp eax, ecx
jne 0x40c227
mov dword [esi + 0x4041c], eax
jmp 0x40c23e
push 0
push str.AppPriority
push ebx
push 0x4000042a
push 2
call fcn.00405400
add esp, 0x14
push 0
lea edx, [esp + 0x20]
push edx
push str.AppRotateFiles
push edi
call fcn.0040af80
add esp, 0x10
cmp eax, ebp
jne 0x40c267
cmp dword [esp + 0x1c], 0
setne al
mov byte [esi + 0x70460], al
jmp 0x40c26e
mov byte [esi + 0x70460], 0
push 0
lea ecx, [esp + 0x20]
push ecx
push str.AppRotateOnline
push edi
call fcn.0040af80
add esp, 0x10
cmp eax, ebp
jne 0x40c29d
xor eax, eax
cmp dword [esp + 0x1c], eax
je 0x40c29f
mov dword [esi + 0x70468], ebp
mov dword [esi + 0x70464], ebp
jmp 0x40c2ab
xor eax, eax
mov dword [esi + 0x70464], eax
mov dword [esi + 0x70468], eax
push 0
lea ebp, [esi + 0x7046c]
push ebp
push str.AppRotateSeconds
push edi
call fcn.0040af80
add esp, 0x10
cmp eax, 1
je 0x40c2ce
mov dword [ebp], 0
push 0
lea ebp, [esi + 0x70470]
push ebp
push str.AppRotateBytes
push edi
call fcn.0040af80
add esp, 0x10
cmp eax, 1
je 0x40c2f1
mov dword [ebp], 0
push 0
lea ebp, [esi + 0x70474]
push ebp
push str.AppRotateBytesHigh
push edi
call fcn.0040af80
add esp, 0x10
cmp eax, 1
je 0x40c314
mov dword [ebp], 0
push 0
lea ebp, [esi + 0x40420]
push ebp
push str.AppNoConsole
push edi
call fcn.0040af80
add esp, 0x10
cmp eax, 1
je 0x40c337
mov dword [ebp], 0
lea edx, [esp + 0x468]
push edx
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [esi + 0x30412]
push eax
call ebp
push edi
push esi
call fcn.0040b460
add esp, 8
test eax, eax
je 0x40c394
push 0
push ebx
push 0xc000041b
push 1
call fcn.00405400
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x468]
push eax
call ebp
mov eax, 5
jmp 0x40c541
lea ecx, [esp + 0x468]
push ecx
call ebp
push 0x8000042f
push 0
lea edx, [esi + 0x7047c]
push edx
push str.AppRestartDelay
push edi
push ebx
call fcn.0040b240
push 0x8000040c
push 0x5dc
lea eax, [esi + 0x70480]
push eax
push str.AppThrottle
push edi
push ebx
call fcn.0040b240
add esp, 0x30
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push str.AppStopMethodSkip
mov ebp, 4
push edi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x2b], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40c45a
cmp eax, 2
je 0x40c45f
push 0
cmp dword [esp + 0x30], ebp
je 0x40c434
push str.NSSM
push str.AppStopMethodSkip
push ebx
push 0x8000041c
push 2
call fcn.00405400
add esp, 0x18
jmp 0x40c45f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004052c0
add esp, 4
push eax
push str.AppStopMethodSkip
push 0xc00003fa
push 1
call fcn.00405400
add esp, 0x14
jmp 0x40c45f
mov byte [esp + 0x13], 1
cmp byte [esp + 0x13], 0
mov dword [esi + 0x70484], 0xffffffff
je 0x40c47c
mov ecx, dword [esp + 0x38]
not ecx
mov dword [esi + 0x70484], ecx
push 0x80000420
push 0x5dc
lea edx, [esi + 0x70488]
push edx
push str.AppStopMethodConsole
push edi
push ebx
call fcn.0040b240
push 0x80000421
push 0x5dc
lea eax, [esi + 0x7048c]
push eax
push str.AppStopMethodWindow
push edi
push ebx
call fcn.0040b240
push 0x80000422
push 0x5dc
lea ecx, [esi + 0x70490]
push ecx
push str.AppStopMethodThreads
push edi
push ebx
call fcn.0040b240
add esp, 0x48
lea edx, [esp + 0x1b]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push ebx
mov dword [esi + 0x70478], 0
call fcn.0040b5d0
add esp, 0x10
test eax, eax
jne 0x40c538
xor ebx, ebx
cmp dword [section..data], ebx
je 0x40c538
mov eax, section..data
mov ecx, dword [eax]
push 0x10
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.00412c36
add esp, 0xc
test eax, eax
je 0x40c532
inc ebx
cmp dword [ebx*4 + section..data], 0
lea eax, [ebx*4 + section..data]
jne 0x40c508
jmp 0x40c538
mov dword [esi + 0x70478], ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x10468]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00412cdc
add esp, 0x1045c
ret