Function at 0x403449
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c
mov eax, 0x40a84a
call fcn.0040985c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.mfc100.dll_Ordinal_316]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov byte [ebp - 4], 1
mov eax, dword [0x45d0e4]
mov esi, str.NoDelegate
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x44], 4
movsb byte es:[edi], byte [esi]
test eax, eax
jne 0x4034a4
xor ecx, ecx
jmp 0x4034a6
mov ecx, dword [eax]
test cl, 4
je 0x4034b8
push str.Extract_Cmd_Options
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
pop ecx
pop ecx
mov edi, dword [ebp - 0x2c]
push edi
call fcn.0040140e
lea esi, [ebx + 0x14]
pop ecx
cmp eax, dword [esi]
jbe 0x4034d6
mov dword [esi], eax
mov eax, dword [edi]
push esi
push eax
call fcn.00402f8d
pop ecx
pop ecx
mov eax, dword [0x45d0e4]
test eax, eax
jne 0x4034e3
xor ecx, ecx
jmp 0x4034e5
mov ecx, dword [eax]
test cl, 4
je 0x4034ff
push dword [esi]
push str.Extract_Cmd_Options
push str._s:_Trace_level_is_set_by_command_line_to:__d
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0x10
push 0x434528
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 2
xor esi, esi
push esi
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
xor edi, edi
inc edi
mov dword [ebp - 0x30], edi
call fcn.00404490
add esp, 0x14
test eax, eax
jne 0x403566
push 0x434524
lea ecx, [ebp - 0x3c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 3
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
push esi
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x2c]
call fcn.00404490
add esp, 0x14
mov byte [ebp - 0x21], 0
test eax, eax
je 0x40356a
mov byte [ebp - 0x21], 1
mov dword [ebp - 4], 2
test byte [ebp - 0x30], 2
je 0x403584
and dword [ebp - 0x30], 0xfffffffd
lea ecx, [ebp - 0x3c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov dword [ebp - 4], edi
test byte [ebp - 0x30], 1
je 0x40359a
and dword [ebp - 0x30], 0xfffffffe
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp byte [ebp - 0x21], 0
je 0x4035d2
mov dword [ebx], edi
mov eax, dword [0x45d0e4]
cmp eax, esi
jne 0x4035af
xor ecx, ecx
jmp 0x4035b1
mov ecx, dword [eax]
test cl, 4
je 0x4037d5
push str.Extract_Cmd_Options
push str._s:_Display_versions_of_modules_loaded
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
jmp 0x4037d5
push str.__Register
lea ecx, [ebp - 0x20]
mov dword [ebx], esi
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 4
push esi
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call fcn.00404490
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_901]
xor ecx, ecx
cmp esi, ecx
je 0x403633
mov dword [ebx + 0xc], edi
mov eax, dword [0x45d0e4]
cmp eax, ecx
je 0x40361e
mov ecx, dword [eax]
test cl, 4
je 0x4037d5
push str.Extract_Cmd_Options
push str._s:_Register_SAP_shortcut
jmp 0x4035c4
lea eax, [ebp - 0x40]
push eax
push 0x20019
push ecx
push 0x4333e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403684
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x40]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x403681
cmp dword [ebp - 0x48], 4
je 0x403684
mov dword [ebp - 0x34], edi
push str.__NoDelegate
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 5
push 0
lea eax, [ebp - 0x28]
push eax
push 0x20
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call fcn.00404490
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp dword [ebp - 0x34], 0
je 0x4036cb
cmp dword [ebp - 0x34], edi
jne 0x4036f7
test esi, esi
jne 0x4036f7
call fcn.00404860
cmp eax, edi
jne 0x4036f7
mov dword [ebx + 4], edi
mov eax, dword [0x45d0e4]
test eax, eax
jne 0x4036e4
xor ecx, ecx
jmp 0x4036e6
mov ecx, dword [eax]
test cl, 4
je 0x40371f
push str.Extract_Cmd_Options
push str._s:_Delegation_mode_is_enabled
jmp 0x403716
xor ecx, ecx
mov dword [ebx + 4], ecx
mov eax, dword [0x45d0e4]
cmp eax, ecx
je 0x403707
mov ecx, dword [eax]
test cl, 4
je 0x40371f
push str.Extract_Cmd_Options
push str._s:_Delegation_mode_is_disabled
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
cmp dword [ebx + 4], edi
jne 0x40373d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
lea ecx, [ebx + 0x10]
push ecx
push 0x20
push str.__Rfc
push eax
call fcn.004042c0
add esp, 0x10
push str.__MinimizeSL
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 6
push 0
lea eax, [ebp - 0x28]
push eax
push 0x20
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call fcn.00404490
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_901]
xor ecx, ecx
cmp esi, ecx
je 0x4037a8
mov dword [ebx + 8], edi
mov eax, dword [0x45d0e4]
cmp dword [ebx + 4], edi
jne 0x4037b0
cmp eax, ecx
je 0x40378e
mov ecx, dword [eax]
test cl, 4
je 0x4037b0
push str.Extract_Cmd_Options
push str._s:_SAP_Logon_will_be_started_minimized
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
jmp 0x4037ab
mov dword [ebx + 8], ecx
mov eax, dword [0x45d0e4]
test eax, eax
jne 0x4037b8
xor ecx, ecx
jmp 0x4037ba
mov ecx, dword [eax]
test cl, 4
je 0x4037cc
push str.Extract_Cmd_Options
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
call dword [sym.imp.mfc100.dll_Ordinal_13137]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc100.dll_Ordinal_901]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call dword [sym.imp.mfc100.dll_Ordinal_901]
call fcn.004098a6
ret