Function at 0x40bc80
Capabilities:
Get common file path
Query or enumerate registry value
Resolve function by parsing pe exports
Set current directory

Disassembly:
mov eax, 0x1045c
call fcn.00414e50
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x10458], eax
push ebx
push esi
mov esi, dword [esp + 0x10468]
push edi
lea ebx, [esi + 2]
push 0x20019
push ebx
mov dword [esp + 0x14], ebx
call fcn.0040ad70
mov edi, eax
add esp, 8
test edi, edi
jne 0x40bcd8
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10458]
xor ecx, esp
call fcn.00414aec
add esp, 0x1045c
ret
push ebp
mov ebp, dword [esp + 0x10474]
lea ecx, [esi + 0x40410]
push ecx
lea edx, [esi + 0x403f8]
push edx
push str.AppEnvironment
test ebp, ebp
setne al
push edi
push ebx
mov byte [esp + 0x28], al
call fcn.00409f30
lea eax, [esi + 0x40418]
push eax
lea ecx, [esi + 0x40414]
push ecx
push str.AppEnvironmentExtra
push edi
push ebx
call fcn.00409f30
add esp, 0x28
test ebp, ebp
je 0x40bd2d
push esi
call fcn.0040c9e0
add esp, 4
mov ebx, dword [esp + 0x14]
push 1
push 0
push ebx
push 0xfffe
lea eax, [esi + 0x18416]
push eax
push 0x422ab0
push edi
call fcn.0040a0c0
add esp, 0x1c
test eax, eax
je 0x40bd65
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x40c3af
push 1
push 0
push ebx
push 0x7ffe
lea ebp, [esi + 0x28414]
push ebp
push str.AppParameters
push edi
call fcn.0040a0c0
add esp, 0x1c
test eax, eax
je 0x40bdb7
mov edx, dword [esp + 0x10]
push 0
lea eax, [esi + 0x18416]
push eax
push edx
push str.AppParameters
push 0x80000405
push 2
call fcn.00402230
push 0x7ffe
push 0
push ebp
call fcn.00414b00
add esp, 0x24
push 1
push 1
push ebx
push 0xffe6
lea ebp, [esi + 0x30412]
push ebp
push str.AppDirectory
push edi
call fcn.0040a0c0
add esp, 0x1c
xor ebx, ebx
test eax, eax
jne 0x40bde6
cmp word [ebp], bx
jne 0x40be6b
lea eax, [esi + 0x18416]
push eax
push 0x421914
push 0xffffffffffffffff
push 0x7ff3
push ebp
call fcn.0041454f
push ebp
call fcn.00408640
add esp, 0x18
cmp word [ebp], bx
jne 0x40be50
push 0xffe6
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
je 0x40be25
cmp eax, 0xffe6
jbe 0x40be50
mov eax, dword [esp + 0x10]
push ebx
push eax
push str.AppDirectory
push 0xc0000407
push 1
call fcn.00402230
add esp, 0x14
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x40c3af
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push ecx
push str.AppDirectory
push 0x80000406
push 2
call fcn.00402230
add esp, 0x18
push ebx
push ebx
push ebx
push 0x400
lea edx, [esp + 0x78]
push edx
push str.AppAffinity
push edi
call fcn.0040a0c0
add esp, 0x1c
test eax, eax
jne 0x40bfc5
cmp word [esp + 0x68], bx
je 0x40bfc5
lea ebp, [esi + 0x40400]
lea eax, [esp + 0x68]
push ebp
push eax
call fcn.0040c780
add esp, 8
test eax, eax
je 0x40bed5
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x68]
push ecx
push edx
push 0x8000042b
push 2
call fcn.00402230
add esp, 0x10
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
jmp 0x40bf8f
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x40bf8f
mov eax, dword [ebp]
mov ebx, dword [ebp + 4]
mov ecx, dword [esp + 0x34]
xor edx, edx
mov ebp, eax
mov dword [esp + 0x18], ebx
and ebp, ecx
and ebx, edx
cmp ebp, eax
jne 0x40bf14
cmp ebx, dword [esp + 0x18]
je 0x40bf8d
lea eax, [esp + 0x14]
push eax
push edx
push ecx
mov dword [esp + 0x20], edx
call fcn.0040c570
add esp, 0xc
test eax, eax
jne 0x40bf79
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebp
mov dword [esp + 0x1c], eax
call fcn.0040c570
add esp, 0xc
test eax, eax
jne 0x40bf65
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x74]
push ecx
lea eax, [esi + 2]
push eax
push 0x8000042c
push 2
call fcn.00402230
add esp, 0x1c
mov edx, dword [esp + 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x30]
push ecx
push str.AppPriority
push edi
call fcn.0040a360
mov ebp, 1
add esp, 0x10
cmp eax, ebp
jne 0x40bfec
call fcn.0040c900
mov edx, eax
mov eax, dword [esp + 0x2c]
and edx, eax
cmp eax, edx
jne 0x40bfd3
mov dword [esi + 0x4041c], eax
jmp 0x40bfec
mov dword [esi + 0x40400], ebx
mov dword [esi + 0x40404], ebx
jmp 0x40bf8f
push ebx
push str.AppPriority
lea eax, [esi + 2]
push eax
push 0x4000042a
push 2
call fcn.00402230
add esp, 0x14
push ebx
lea eax, [esp + 0x24]
push eax
push str.AppRedirectHook
push edi
call fcn.0040a360
add esp, 0x10
cmp eax, ebp
jne 0x40c013
cmp dword [esp + 0x20], ebx
setne cl
mov byte [esi + 0x70470], cl
jmp 0x40c017
mov dword [esp + 0x20], ebx
push ebx
lea edx, [esp + 0x20]
push edx
push str.AppRotateFiles
push edi
call fcn.0040a360
add esp, 0x10
cmp eax, ebp
jne 0x40c03e
cmp dword [esp + 0x1c], ebx
setne al
mov byte [esi + 0x70471], al
jmp 0x40c045
mov byte [esi + 0x70471], 0
push ebx
lea ecx, [esp + 0x20]
push ecx
push str.AppRotateOnline
push edi
call fcn.0040a360
add esp, 0x10
cmp eax, ebp
jne 0x40c071
cmp dword [esp + 0x1c], ebx
je 0x40c071
mov dword [esi + 0x7047c], ebp
mov dword [esi + 0x70478], ebp
jmp 0x40c07d
mov dword [esi + 0x70478], ebx
mov dword [esi + 0x7047c], ebx
push ebx
lea edx, [esp + 0x44]
push edx
push str.AppTimestampLog
push edi
call fcn.0040a360
add esp, 0x10
cmp eax, ebp
jne 0x40c0a4
cmp dword [esp + 0x40], ebx
je 0x40c0a4
mov byte [esi + 0x70472], 1
jmp 0x40c0ab
mov byte [esi + 0x70472], 0
mov ecx, dword [esp + 0x20]
cmp dword [esi + 0x70478], ebx
jne 0x40c0c8
cmp byte [esi + 0x70472], 0
jne 0x40c0c8
cmp ecx, ebx
jne 0x40c0c8
xor eax, eax
jmp 0x40c0ca
mov eax, ebp
mov byte [esi + 0x6043c], al
cmp dword [esi + 0x7047c], ebx
jne 0x40c0e9
cmp byte [esi + 0x70472], 0
jne 0x40c0e9
cmp ecx, ebx
jne 0x40c0e9
xor eax, eax
jmp 0x40c0eb
mov eax, ebp
push ebx
lea ebp, [esi + 0x70480]
push ebp
push str.AppRotateSeconds
push edi
mov byte [esi + 0x7045c], al
call fcn.0040a360
add esp, 0x10
cmp eax, 1
je 0x40c10f
mov dword [ebp], ebx
push ebx
lea ebp, [esi + 0x70484]
push ebp
push str.AppRotateBytes
push edi
call fcn.0040a360
add esp, 0x10
cmp eax, 1
je 0x40c12d
mov dword [ebp], ebx
push ebx
lea ebp, [esi + 0x70488]
push ebp
push str.AppRotateBytesHigh
push edi
call fcn.0040a360
add esp, 0x10
cmp eax, 1
je 0x40c14b
mov dword [ebp], ebx
push 0x8000040c
push ebx
lea eax, [esi + 0x7048c]
push eax
push str.AppRotateDelay
push edi
lea ebp, [esi + 2]
push ebp
call fcn.0040ab10
push 0
lea ebx, [esi + 0x40420]
push ebx
push str.AppNoConsole
push edi
call fcn.0040a360
add esp, 0x28
cmp eax, 1
je 0x40c189
mov dword [ebx], 0
lea ecx, [esp + 0x468]
push ecx
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [esi + 0x30412]
push eax
call ebx
push edi
push esi
call fcn.0040ad90
add esp, 8
test eax, eax
je 0x40c1e6
push 0
push ebp
push 0xc000041b
push 1
call fcn.00402230
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x468]
push edx
call ebx
mov eax, 5
jmp 0x40c3af
lea eax, [esp + 0x468]
push eax
call ebx
push 0x8000042f
push 0
lea ecx, [esi + 0x70494]
push ecx
push str.AppRestartDelay
push edi
push ebp
call fcn.0040ab10
push 0x8000040c
push 0x5dc
lea edx, [esi + 0x70498]
push edx
push str.AppThrottle
push edi
push ebp
call fcn.0040ab10
add esp, 0x30
mov eax, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push str.AppStopMethodSkip
push edi
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40c2a4
cmp eax, 2
je 0x40c2a6
cmp dword [esp + 0x28], 4
push 0
je 0x40c284
push str.NSSM
push str.AppStopMethodSkip
push ebp
push 0x8000041c
push 2
call fcn.00402230
add esp, 0x18
jmp 0x40c2a6
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppStopMethodSkip
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
jmp 0x40c2a6
mov bl, 1
mov dword [esi + 0x7049c], 0xffffffff
test bl, bl
je 0x40c2c0
mov eax, dword [esp + 0x38]
not eax
mov dword [esi + 0x7049c], eax
push 0x80000420
push 0x5dc
lea ecx, [esi + 0x704a0]
push ecx
push str.AppStopMethodConsole
push edi
push ebp
call fcn.0040ab10
push 0x80000421
push 0x5dc
lea edx, [esi + 0x704a4]
push edx
push str.AppStopMethodWindow
push edi
push ebp
call fcn.0040ab10
push 0x80000422
push 0x5dc
lea eax, [esi + 0x704a8]
push eax
push str.AppStopMethodThreads
push edi
push ebp
call fcn.0040ab10
add esp, 0x48
xor ebx, ebx
push ebx
lea ecx, [esp + 0x34]
push ecx
push str.AppKillProcessTree
push edi
call fcn.0040a360
add esp, 0x10
cmp eax, 1
jne 0x40c344
cmp dword [esp + 0x30], ebx
setne dl
mov byte [esi + 0x704ac], dl
jmp 0x40c34b
mov byte [esi + 0x704ac], 1
lea eax, [esp + 0x27]
push eax
lea ecx, [esp + 0x4c]
push ecx
push ebx
push ebp
mov dword [esi + 0x70490], ebx
call fcn.0040af20
add esp, 0x10
test eax, eax
jne 0x40c3a6
cmp dword [0x42802c], eax
je 0x40c3a6
mov eax, 0x42802c
mov edx, dword [eax]
push 0x10
push edx
lea eax, [esp + 0x50]
push eax
call fcn.00414a46
add esp, 0xc
test eax, eax
je 0x40c3a0
inc ebx
cmp dword [ebx*4 + 0x42802c], 0
lea eax, [ebx*4 + 0x42802c]
jne 0x40c376
jmp 0x40c3a6
mov dword [esi + 0x70490], ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x10468]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00414aec
add esp, 0x1045c
ret