Function at 0x10042b2
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x1007084]
push ebx
push edi
push 0x41
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
mov byte [ebp - 0x10c], 0
lea edi, [ebp - 0x10b]
mov dword [ebp - 0x530], 1
rep stosd dword es:[edi], eax
call sub.cmutil.dll_GetOSVersion
cmp eax, 2
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
jne 0x1004385
xor ebx, ebx
push ebx
push ebx
push 0x1001644
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [ebp - 0x528], eax
je 0x1004387
push 0x100162c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1004377
push ebx
push 0x1a
lea ecx, [ebp - 0x31c]
push ecx
push ebx
call eax
cmp eax, 1
jne 0x1004377
push 0x104
push dword [esi + 8]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x31c]
push eax
call edi
mov byte [ebp + eax - 0x214], bl
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1004377
mov dword [ebp - 0x530], ebx
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1004387
xor ebx, ebx
cmp dword [ebp - 0x530], ebx
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x528], ebx
mov eax, 0x10015fc
jne 0x10043a9
mov eax, 0x10015c4
push eax
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esi + 0x3c]
call edi
lea ecx, [ebp - 0x524]
push ecx
mov dword [ebp - 0x52c], eax
call edi
mov ecx, dword [ebp - 0x52c]
lea eax, [ecx + eax + 2]
cmp eax, 0x208
jle 0x10043e3
xor eax, eax
jmp 0x1004525
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1001310
lea eax, [ebp - 0x524]
push eax
call edi
push dword [esi + 0x3c]
lea eax, [ebp - 0x524]
push eax
call edi
lea eax, [ebp - 0x538]
push eax
push 1
push ebx
lea eax, [ebp - 0x524]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, 0x1001438
jne 0x100448e
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x540]
push eax
push 0
push edi
push dword [ebp - 0x538]
mov dword [ebp - 0x52c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004479
cmp dword [ebp - 0x53c], eax
mov dword [ebp - 0x528], 1
setne al
mov dword [ebp - 0x534], eax
push dword [ebp - 0x538]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x528], 0
jne 0x10044a3
mov eax, dword [esi + 0x28]
push dword [eax]
push 1
push edi
push 0x1001490
call ebx
mov dword [ebp - 0x534], eax
mov eax, dword [esi + 0x28]
push dword [eax]
mov edi, 0x1001430
push 0x64
push 0x1001424
push edi
call ebx
mov ebx, eax
mov eax, dword [esi + 0x28]
push dword [eax]
lea eax, [ebp - 0x10c]
push 0x104
push eax
push 0x10013e8
push 0x1001414
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [esi + 0x3c]
lea edi, [esi + 0x58]
push dword [ebp - 0x530]
mov ecx, edi
push dword [esi]
call dword [sym.imp.cmutil.dll_public:_long_int___thiscall_CmLogFile::Init_struct_HINSTANCE_____int__char_const__]
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 0x534]
mov ecx, edi
call dword [sym.imp.cmutil.dll_public:_long_int___thiscall_CmLogFile::SetParams_int__unsigned_long_int__char_const__]
cmp dword [esi + 0x94], 0
mov ecx, edi
je 0x100451c
push 0
call dword [sym.imp.cmutil.dll_public:_long_int___thiscall_CmLogFile::Start_int_]
jmp 0x1004522
call dword [sym.imp.cmutil.dll_public:_long_int___thiscall_CmLogFile::Stop_void_]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01004f75
leave
ret