Function at 0x40bc70
Capabilities:
Get common file path
Query or enumerate registry value
Resolve function by parsing pe exports
Set current directory

Disassembly:
mov eax, 0x1045c
call fcn.00414e40
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x10458], eax
push ebx
push esi
mov esi, dword [esp + 0x10468]
push edi
lea ebx, [esi + 2]
push 0x20019
push ebx
mov dword [esp + 0x14], ebx
call fcn.0040ad60
mov edi, eax
add esp, 8
test edi, edi
jne 0x40bcc8
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10458]
xor ecx, esp
call fcn.00414adc
add esp, 0x1045c
ret
push ebp
mov ebp, dword [esp + 0x10474]
lea ecx, [esi + 0x40410]
push ecx
lea edx, [esi + 0x403f8]
push edx
push str.AppEnvironment
test ebp, ebp
setne al
push edi
push ebx
mov byte [esp + 0x28], al
call fcn.00409f20
lea eax, [esi + 0x40418]
push eax
lea ecx, [esi + 0x40414]
push ecx
push str.AppEnvironmentExtra
push edi
push ebx
call fcn.00409f20
add esp, 0x28
test ebp, ebp
je 0x40bd1d
push esi
call fcn.0040c9d0
add esp, 4
mov ebx, dword [esp + 0x14]
push 1
push 0
push ebx
push 0xfffe
lea eax, [esi + 0x18416]
push eax
push 0x422a90
push edi
call fcn.0040a0b0
add esp, 0x1c
test eax, eax
je 0x40bd55
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x40c39f
push 1
push 0
push ebx
push 0x7ffe
lea ebp, [esi + 0x28414]
push ebp
push str.AppParameters
push edi
call fcn.0040a0b0
add esp, 0x1c
test eax, eax
je 0x40bda7
mov edx, dword [esp + 0x10]
push 0
lea eax, [esi + 0x18416]
push eax
push edx
push str.AppParameters
push 0x80000405
push 2
call fcn.00402230
push 0x7ffe
push 0
push ebp
call fcn.00414af0
add esp, 0x24
push 1
push 1
push ebx
push 0xffe6
lea ebp, [esi + 0x30412]
push ebp
push str.AppDirectory
push edi
call fcn.0040a0b0
add esp, 0x1c
xor ebx, ebx
test eax, eax
jne 0x40bdd6
cmp word [ebp], bx
jne 0x40be5b
lea eax, [esi + 0x18416]
push eax
push 0x4218f4
push 0xffffffffffffffff
push 0x7ff3
push ebp
call fcn.0041453f
push ebp
call fcn.00408640
add esp, 0x18
cmp word [ebp], bx
jne 0x40be40
push 0xffe6
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
je 0x40be15
cmp eax, 0xffe6
jbe 0x40be40
mov eax, dword [esp + 0x10]
push ebx
push eax
push str.AppDirectory
push 0xc0000407
push 1
call fcn.00402230
add esp, 0x14
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x40c39f
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push ecx
push str.AppDirectory
push 0x80000406
push 2
call fcn.00402230
add esp, 0x18
push ebx
push ebx
push ebx
push 0x400
lea edx, [esp + 0x78]
push edx
push str.AppAffinity
push edi
call fcn.0040a0b0
add esp, 0x1c
test eax, eax
jne 0x40bfb5
cmp word [esp + 0x68], bx
je 0x40bfb5
lea ebp, [esi + 0x40400]
lea eax, [esp + 0x68]
push ebp
push eax
call fcn.0040c770
add esp, 8
test eax, eax
je 0x40bec5
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x68]
push ecx
push edx
push 0x8000042b
push 2
call fcn.00402230
add esp, 0x10
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
jmp 0x40bf7f
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x40bf7f
mov eax, dword [ebp]
mov ebx, dword [ebp + 4]
mov ecx, dword [esp + 0x34]
xor edx, edx
mov ebp, eax
mov dword [esp + 0x18], ebx
and ebp, ecx
and ebx, edx
cmp ebp, eax
jne 0x40bf04
cmp ebx, dword [esp + 0x18]
je 0x40bf7d
lea eax, [esp + 0x14]
push eax
push edx
push ecx
mov dword [esp + 0x20], edx
call fcn.0040c560
add esp, 0xc
test eax, eax
jne 0x40bf69
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebp
mov dword [esp + 0x1c], eax
call fcn.0040c560
add esp, 0xc
test eax, eax
jne 0x40bf55
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x74]
push ecx
lea eax, [esi + 2]
push eax
push 0x8000042c
push 2
call fcn.00402230
add esp, 0x1c
mov edx, dword [esp + 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x30]
push ecx
push str.AppPriority
push edi
call fcn.0040a350
mov ebp, 1
add esp, 0x10
cmp eax, ebp
jne 0x40bfdc
call fcn.0040c8f0
mov edx, eax
mov eax, dword [esp + 0x2c]
and edx, eax
cmp eax, edx
jne 0x40bfc3
mov dword [esi + 0x4041c], eax
jmp 0x40bfdc
mov dword [esi + 0x40400], ebx
mov dword [esi + 0x40404], ebx
jmp 0x40bf7f
push ebx
push str.AppPriority
lea eax, [esi + 2]
push eax
push 0x4000042a
push 2
call fcn.00402230
add esp, 0x14
push ebx
lea eax, [esp + 0x24]
push eax
push str.AppRedirectHook
push edi
call fcn.0040a350
add esp, 0x10
cmp eax, ebp
jne 0x40c003
cmp dword [esp + 0x20], ebx
setne cl
mov byte [esi + 0x70470], cl
jmp 0x40c007
mov dword [esp + 0x20], ebx
push ebx
lea edx, [esp + 0x20]
push edx
push str.AppRotateFiles
push edi
call fcn.0040a350
add esp, 0x10
cmp eax, ebp
jne 0x40c02e
cmp dword [esp + 0x1c], ebx
setne al
mov byte [esi + 0x70471], al
jmp 0x40c035
mov byte [esi + 0x70471], 0
push ebx
lea ecx, [esp + 0x20]
push ecx
push str.AppRotateOnline
push edi
call fcn.0040a350
add esp, 0x10
cmp eax, ebp
jne 0x40c061
cmp dword [esp + 0x1c], ebx
je 0x40c061
mov dword [esi + 0x7047c], ebp
mov dword [esi + 0x70478], ebp
jmp 0x40c06d
mov dword [esi + 0x70478], ebx
mov dword [esi + 0x7047c], ebx
push ebx
lea edx, [esp + 0x44]
push edx
push str.AppTimestampLog
push edi
call fcn.0040a350
add esp, 0x10
cmp eax, ebp
jne 0x40c094
cmp dword [esp + 0x40], ebx
je 0x40c094
mov byte [esi + 0x70472], 1
jmp 0x40c09b
mov byte [esi + 0x70472], 0
mov ecx, dword [esp + 0x20]
cmp dword [esi + 0x70478], ebx
jne 0x40c0b8
cmp byte [esi + 0x70472], 0
jne 0x40c0b8
cmp ecx, ebx
jne 0x40c0b8
xor eax, eax
jmp 0x40c0ba
mov eax, ebp
mov byte [esi + 0x6043c], al
cmp dword [esi + 0x7047c], ebx
jne 0x40c0d9
cmp byte [esi + 0x70472], 0
jne 0x40c0d9
cmp ecx, ebx
jne 0x40c0d9
xor eax, eax
jmp 0x40c0db
mov eax, ebp
push ebx
lea ebp, [esi + 0x70480]
push ebp
push str.AppRotateSeconds
push edi
mov byte [esi + 0x7045c], al
call fcn.0040a350
add esp, 0x10
cmp eax, 1
je 0x40c0ff
mov dword [ebp], ebx
push ebx
lea ebp, [esi + 0x70484]
push ebp
push str.AppRotateBytes
push edi
call fcn.0040a350
add esp, 0x10
cmp eax, 1
je 0x40c11d
mov dword [ebp], ebx
push ebx
lea ebp, [esi + 0x70488]
push ebp
push str.AppRotateBytesHigh
push edi
call fcn.0040a350
add esp, 0x10
cmp eax, 1
je 0x40c13b
mov dword [ebp], ebx
push 0x8000040c
push ebx
lea eax, [esi + 0x7048c]
push eax
push str.AppRotateDelay
push edi
lea ebp, [esi + 2]
push ebp
call fcn.0040ab00
push 0
lea ebx, [esi + 0x40420]
push ebx
push str.AppNoConsole
push edi
call fcn.0040a350
add esp, 0x28
cmp eax, 1
je 0x40c179
mov dword [ebx], 0
lea ecx, [esp + 0x468]
push ecx
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [esi + 0x30412]
push eax
call ebx
push edi
push esi
call fcn.0040ad80
add esp, 8
test eax, eax
je 0x40c1d6
push 0
push ebp
push 0xc000041b
push 1
call fcn.00402230
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x468]
push edx
call ebx
mov eax, 5
jmp 0x40c39f
lea eax, [esp + 0x468]
push eax
call ebx
push 0x8000042f
push 0
lea ecx, [esi + 0x70494]
push ecx
push str.AppRestartDelay
push edi
push ebp
call fcn.0040ab00
push 0x8000040c
push 0x5dc
lea edx, [esi + 0x70498]
push edx
push str.AppThrottle
push edi
push ebp
call fcn.0040ab00
add esp, 0x30
mov eax, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push str.AppStopMethodSkip
push edi
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40c294
cmp eax, 2
je 0x40c296
cmp dword [esp + 0x28], 4
push 0
je 0x40c274
push str.NSSM
push str.AppStopMethodSkip
push ebp
push 0x8000041c
push 2
call fcn.00402230
add esp, 0x18
jmp 0x40c296
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppStopMethodSkip
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
jmp 0x40c296
mov bl, 1
mov dword [esi + 0x7049c], 0xffffffff
test bl, bl
je 0x40c2b0
mov eax, dword [esp + 0x38]
not eax
mov dword [esi + 0x7049c], eax
push 0x80000420
push 0x5dc
lea ecx, [esi + 0x704a0]
push ecx
push str.AppStopMethodConsole
push edi
push ebp
call fcn.0040ab00
push 0x80000421
push 0x5dc
lea edx, [esi + 0x704a4]
push edx
push str.AppStopMethodWindow
push edi
push ebp
call fcn.0040ab00
push 0x80000422
push 0x5dc
lea eax, [esi + 0x704a8]
push eax
push str.AppStopMethodThreads
push edi
push ebp
call fcn.0040ab00
add esp, 0x48
xor ebx, ebx
push ebx
lea ecx, [esp + 0x34]
push ecx
push str.AppKillProcessTree
push edi
call fcn.0040a350
add esp, 0x10
cmp eax, 1
jne 0x40c334
cmp dword [esp + 0x30], ebx
setne dl
mov byte [esi + 0x704ac], dl
jmp 0x40c33b
mov byte [esi + 0x704ac], 1
lea eax, [esp + 0x27]
push eax
lea ecx, [esp + 0x4c]
push ecx
push ebx
push ebp
mov dword [esi + 0x70490], ebx
call fcn.0040af10
add esp, 0x10
test eax, eax
jne 0x40c396
cmp dword [0x42802c], eax
je 0x40c396
mov eax, 0x42802c
mov edx, dword [eax]
push 0x10
push edx
lea eax, [esp + 0x50]
push eax
call fcn.00414a36
add esp, 0xc
test eax, eax
je 0x40c390
inc ebx
cmp dword [ebx*4 + 0x42802c], 0
lea eax, [ebx*4 + 0x42802c]
jne 0x40c366
jmp 0x40c396
mov dword [esi + 0x70490], ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x10468]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00414adc
add esp, 0x1045c
ret