Function at 0x40b5b0
Capabilities:
Get common file path
Query or enumerate registry value
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10470
call fcn.0041d6a0
mov eax, dword [0x424284]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 2]
mov ecx, 0x20019
mov eax, ebx
mov dword [ebp - 0x1045c], edi
mov dword [ebp - 0x10434], ebx
call fcn.0040b410
mov dword [ebp - 0x10430], eax
test eax, eax
jne 0x40b607
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
lea edx, [edi + 0x40410]
push edx
setne cl
push ebx
lea esi, [edi + 0x403f8]
mov ebx, str.AppEnvironment
mov byte [ebp - 0x10448], cl
call fcn.0040a750
mov ecx, dword [ebp - 0x10434]
lea eax, [edi + 0x40418]
push eax
mov eax, dword [ebp - 0x10430]
lea esi, [edi + 0x40414]
push ecx
mov ebx, str.AppEnvironmentExtra
call fcn.0040a750
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x40b660
mov eax, edi
call fcn.0040c920
mov ebx, dword [ebp - 0x10448]
mov esi, dword [ebp - 0x10430]
push 1
push 0
push ebx
lea eax, [edi + 0x18416]
push eax
push 0x420e88
push esi
mov eax, 0xfffe
call fcn.0040a8b0
add esp, 0x18
test eax, eax
je 0x40b6ac
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10430]
push 1
push 0
push ebx
lea esi, [edi + 0x28414]
push esi
push str.AppParameters
push edx
mov eax, 0x7ffe
call fcn.0040a8b0
add esp, 0x18
test eax, eax
je 0x40b706
push 0
lea eax, [edi + 0x18416]
push eax
mov eax, dword [ebp - 0x10434]
push eax
push str.AppParameters
push 0x80000405
push 2
call fcn.004021b0
push 0x7ffe
push 0
push esi
call fcn.0041a110
add esp, 0x24
push 1
push 1
push ebx
mov ebx, dword [ebp - 0x10430]
lea esi, [edi + 0x30412]
push esi
push str.AppDirectory
push ebx
mov eax, 0xffe6
call fcn.0040a8b0
add esp, 0x18
test eax, eax
jne 0x40b738
cmp word [esi], ax
jne 0x40b7d0
lea eax, [edi + 0x18416]
push eax
push 0x4200a8
push 0xffffffffffffffff
push 0x7ff3
push esi
call fcn.004149b0
add esp, 0x14
mov edx, esi
call fcn.00408410
cmp word [esi], 0
jne 0x40b7b2
push 0xffe6
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40b778
cmp eax, 0xffe6
jbe 0x40b7b2
mov ecx, dword [ebp - 0x10434]
push 0
push ecx
push str.AppDirectory
push 0xc0000407
push 1
call fcn.004021b0
add esp, 0x14
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10434]
push 0
push esi
push edx
push str.AppDirectory
push 0x80000406
push 2
call fcn.004021b0
add esp, 0x18
push 0
push 0
push 0
lea eax, [ebp - 0x42c]
push eax
push str.AppAffinity
push ebx
mov eax, 0x400
call fcn.0040a8b0
add esp, 0x18
test eax, eax
jne 0x40b96a
cmp word [ebp - 0x42c], ax
je 0x40b96a
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [edi + 0x40400]
call fcn.0040c640
add esp, 4
test eax, eax
je 0x40b854
mov eax, dword [ebp - 0x10434]
lea edx, [ebp - 0x42c]
push edx
push eax
push 0x8000042b
push 2
call fcn.004021b0
add esp, 0x10
mov dword [edi + 0x40400], 0
mov dword [edi + 0x40404], 0
jmp 0x40b936
lea ecx, [ebp - 0x10464]
push ecx
lea edx, [ebp - 0x10470]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x40b936
mov eax, dword [edi + 0x40400]
mov ebx, dword [edi + 0x40404]
mov ecx, dword [ebp - 0x10464]
xor edx, edx
mov esi, eax
mov dword [ebp - 0x10448], ebx
and esi, ecx
and ebx, edx
cmp esi, eax
jne 0x40b8a7
cmp ebx, dword [ebp - 0x10448]
je 0x40b930
lea eax, [ebp - 0x10440]
push eax
push edx
push ecx
mov dword [ebp - 0x10440], edx
call fcn.0040c3d0
add esp, 0xc
test eax, eax
jne 0x40b91a
lea ecx, [ebp - 0x10448]
push ecx
push ebx
push esi
mov dword [ebp - 0x10448], eax
call fcn.0040c3d0
mov esi, dword [ebp - 0x10448]
add esp, 0xc
test eax, eax
jne 0x40b90a
mov edx, dword [ebp - 0x10440]
mov ecx, dword [ebp - 0x10434]
push 0
push esi
push edx
lea eax, [ebp - 0x42c]
push eax
push ecx
push 0x8000042c
push 2
call fcn.004021b0
add esp, 0x1c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x10440]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp - 0x10430]
push ebx
lea ecx, [ebp - 0x10454]
mov esi, str.AppPriority
call fcn.0040ab10
add esp, 4
cmp eax, 1
jne 0x40b997
call fcn.0040c840
mov ecx, eax
mov eax, dword [ebp - 0x10454]
and ecx, eax
cmp eax, ecx
jne 0x40b97a
mov dword [edi + 0x4041c], eax
jmp 0x40b997
xor eax, eax
mov dword [edi + 0x40400], eax
mov dword [edi + 0x40404], eax
jmp 0x40b936
mov edx, dword [ebp - 0x10434]
push 0
push str.AppPriority
push edx
push 0x4000042a
push 2
call fcn.004021b0
add esp, 0x14
push ebx
lea ecx, [ebp - 0x10438]
mov esi, str.AppRedirectHook
call fcn.0040ab10
add esp, 4
cmp eax, 1
jne 0x40b9c2
cmp dword [ebp - 0x10438], 0
setne al
mov byte [edi + 0x70470], al
jmp 0x40b9cc
mov dword [ebp - 0x10438], 0
push ebx
lea ecx, [ebp - 0x10444]
mov esi, str.AppRotateFiles
call fcn.0040ab10
add esp, 4
cmp eax, 1
jne 0x40b9f7
cmp dword [ebp - 0x10444], 0
setne cl
mov byte [edi + 0x70471], cl
jmp 0x40b9fe
mov byte [edi + 0x70471], 0
push ebx
lea ecx, [ebp - 0x10444]
mov esi, str.AppRotateOnline
call fcn.0040ab10
mov ecx, 1
add esp, 4
cmp eax, ecx
jne 0x40ba33
xor eax, eax
cmp dword [ebp - 0x10444], eax
je 0x40ba35
mov dword [edi + 0x7047c], ecx
mov dword [edi + 0x70478], ecx
jmp 0x40ba41
xor eax, eax
mov dword [edi + 0x70478], eax
mov dword [edi + 0x7047c], eax
push ebx
lea ecx, [ebp - 0x1046c]
mov esi, str.AppTimestampLog
call fcn.0040ab10
add esp, 4
cmp eax, 1
jne 0x40ba6b
cmp dword [ebp - 0x1046c], 0
je 0x40ba6b
mov byte [edi + 0x70472], al
jmp 0x40ba72
mov byte [edi + 0x70472], 0
cmp dword [edi + 0x70478], 0
mov ecx, dword [ebp - 0x10438]
jne 0x40ba92
cmp byte [edi + 0x70472], 0
jne 0x40ba92
test ecx, ecx
jne 0x40ba92
xor eax, eax
jmp 0x40ba97
mov eax, 1
cmp dword [edi + 0x7047c], 0
mov byte [edi + 0x6043c], al
jne 0x40bab7
cmp byte [edi + 0x70472], 0
jne 0x40bab7
test ecx, ecx
jne 0x40bab7
xor eax, eax
jmp 0x40babc
mov eax, 1
mov edx, dword [ebp - 0x10430]
push edx
lea ecx, [edi + 0x70480]
mov esi, str.AppRotateSeconds
mov byte [edi + 0x7045c], al
call fcn.0040ab10
add esp, 4
cmp eax, 1
je 0x40baeb
mov dword [edi + 0x70480], 0
mov eax, dword [ebp - 0x10430]
push eax
lea ecx, [edi + 0x70484]
mov esi, str.AppRotateBytes
call fcn.0040ab10
add esp, 4
cmp eax, 1
je 0x40bb14
mov dword [edi + 0x70484], 0
mov ecx, dword [ebp - 0x10430]
push ecx
lea ecx, [edi + 0x70488]
mov esi, str.AppRotateBytesHigh
call fcn.0040ab10
add esp, 4
cmp eax, 1
je 0x40bb3d
mov dword [edi + 0x70488], 0
mov edx, dword [ebp - 0x10430]
mov ecx, dword [ebp - 0x10434]
push 0x8000040c
push 0
lea ebx, [edi + 0x7048c]
push edx
mov esi, str.AppRotateDelay
call fcn.0040b220
mov eax, dword [ebp - 0x10430]
add esp, 0xc
push eax
lea ecx, [edi + 0x40420]
mov esi, str.AppNoConsole
call fcn.0040ab10
add esp, 4
cmp eax, 1
je 0x40bb8d
mov dword [edi + 0x40420], 0
lea ecx, [ebp - 0x1042c]
push ecx
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [edi + 0x30412]
push eax
call esi
mov ebx, dword [ebp - 0x10430]
mov eax, edi
call fcn.0040b420
test eax, eax
je 0x40bbff
mov edx, dword [ebp - 0x10434]
push 0
push edx
push 0xc000041b
push 1
call fcn.004021b0
add esp, 0x10
mov eax, ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1042c]
push ecx
call esi
mov eax, 5
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1042c]
push edx
call esi
mov eax, dword [ebp - 0x10430]
mov ecx, dword [ebp - 0x10434]
push 0x8000042f
push 0
lea ebx, [edi + 0x70494]
push eax
mov esi, str.AppRestartDelay
call fcn.0040b220
mov ecx, dword [ebp - 0x10430]
add esp, 0xc
push 0x8000040c
push 0x5dc
push ecx
mov ecx, dword [ebp - 0x10434]
lea ebx, [edi + 0x70498]
mov esi, str.AppThrottle
call fcn.0040b220
add esp, 0xc
lea edx, [ebp - 0x10468]
push edx
mov edx, dword [ebp - 0x10430]
lea eax, [ebp - 0x10460]
push eax
lea ecx, [ebp - 0x10450]
push ecx
push 0
push str.AppStopMethodSkip
mov esi, 4
push edx
mov dword [ebp - 0x10450], esi
mov dword [ebp - 0x10468], esi
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40bcee
cmp eax, 2
je 0x40bcf0
push 0
cmp dword [ebp - 0x10450], esi
je 0x40bcca
mov eax, dword [ebp - 0x10434]
push str.INVGATE
push str.AppStopMethodSkip
push eax
push 0x8000041c
push 2
call fcn.004021b0
add esp, 0x18
jmp 0x40bcf0
mov edi, eax
call fcn.00402080
push eax
push str.AppStopMethodSkip
push 0xc00003fa
push 1
call fcn.004021b0
mov edi, dword [ebp - 0x1045c]
add esp, 0x14
jmp 0x40bcf0
mov bl, 1
mov dword [edi + 0x7049c], 0xffffffff
test bl, bl
je 0x40bd0c
mov ecx, dword [ebp - 0x10460]
not ecx
mov dword [edi + 0x7049c], ecx
mov edx, dword [ebp - 0x10430]
mov ecx, dword [ebp - 0x10434]
push 0x80000420
push 0x5dc
lea ebx, [edi + 0x704a0]
push edx
mov esi, str.AppStopMethodConsole
call fcn.0040b220
mov eax, dword [ebp - 0x10430]
mov ecx, dword [ebp - 0x10434]
add esp, 0xc
push 0x80000421
push 0x5dc
lea ebx, [edi + 0x704a4]
push eax
mov esi, str.AppStopMethodWindow
call fcn.0040b220
mov ecx, dword [ebp - 0x10430]
add esp, 0xc
push 0x80000422
push 0x5dc
push ecx
mov ecx, dword [ebp - 0x10434]
lea ebx, [edi + 0x704a8]
mov esi, str.AppStopMethodThreads
call fcn.0040b220
mov ebx, dword [ebp - 0x10430]
add esp, 0xc
push ebx
lea ecx, [ebp - 0x10458]
mov esi, str.AppKillProcessTree
call fcn.0040ab10
add esp, 4
cmp eax, 1
jne 0x40bdbb
cmp dword [ebp - 0x10458], 0
setne dl
mov byte [edi + 0x704ac], dl
jmp 0x40bdc2
mov byte [edi + 0x704ac], 1
mov edx, dword [ebp - 0x10434]
lea eax, [ebp - 0x10439]
push eax
lea ecx, [ebp - 0x28]
push ecx
xor esi, esi
push esi
push edx
mov dword [edi + 0x70490], esi
call fcn.0040be40
add esp, 0x10
test eax, eax
jne 0x40be25
cmp dword [0x424db0], esi
je 0x40be25
mov eax, 0x424db0
mov eax, dword [eax]
push 0x10
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.0041475d
add esp, 0xc
test eax, eax
je 0x40be1f
inc esi
cmp dword [esi*4 + 0x424db0], 0
lea eax, [esi*4 + 0x424db0]
jne 0x40bdf6
jmp 0x40be25
mov dword [edi + 0x70490], esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041427b
mov esp, ebp
pop ebp
ret