Function at 0x418b60
Capabilities:
Accept command line arguments
Check os version
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4ae008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0
lea eax, [edi + 0x68]
push eax
lea esi, [edi + 0x54]
push ecx
mov ecx, esi
call fcn.0041a4e0
cmp dword [edi + 0x6c], 0
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
jne 0x418bab
xor ecx, ecx
mov eax, edi
test esi, esi
push 0x452
cmove eax, ecx
push dword [eax + 4]
call ebx
mov dword [edi + 0x6c], eax
cmp dword [edi + 0x70], 0
jne 0x418bca
test esi, esi
lea eax, [esi - 0x50]
mov ecx, 4
cmove eax, ecx
push 0x453
push dword [eax]
call ebx
mov dword [edi + 0x70], eax
mov ecx, dword [edi + 0x5c]
push 0x18b50
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x467
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b51
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x468
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b52
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x44f
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b59
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x485
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b53
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x450
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
add esp, 4
push 0x18e70
mov ecx, dword [edi + 0x5c]
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x469
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x470
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e71
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x46c
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x46d
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x1925a
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x486
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push 0x487
push dword [edi + 4]
mov esi, dword [eax]
call ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
push eax
call ebx
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b58
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push dword [eax]
push dword [edi + 0x6c]
call ebx
push dword [ebp - 0x2a4]
call fcn.0041a66b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b55
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00409a40
push dword [eax]
push dword [edi + 0x70]
call ebx
push dword [ebp - 0x2a4]
call fcn.0041a66b
add esp, 4
push 1
push 0
push 0x160c
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x2a0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x418efb
cmp dword [ebp - 0x29c], 6
jb 0x418efb
cmp dword [ebp - 0x298], 2
jb 0x418efb
mov bl, 1
jmp 0x418efd
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.modechrome
push eax
call fcn.0041be35
add esp, 8
test eax, eax
setne byte [ebp - 0x2a6]
test bl, bl
jne 0x418fb3
lea eax, [ebp - 0x2a4]
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerActiveX
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418fb3
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2ac], 0x104
push eax
call fcn.0041c3a0
add esp, 0xc
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4aac08
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
jne 0x418fa5
push 0x470
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418fb9
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [ebp - 0x2b0]
mov byte [ebp - 0x2a5], 0
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPlugin
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419050
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2ac], 0x104
push eax
call fcn.0041c3a0
add esp, 0xc
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4aac08
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419044
push 0x46d
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 0x2a5], 1
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2b4]
xor bh, bh
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPepper
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4190dd
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2ac], 0x104
push eax
call fcn.0041c3a0
add esp, 0xc
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4aac08
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4190d1
push 0x487
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov bh, 1
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x419109
push 0x469
push dword [edi + 4]
call esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x470
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call esi
cmp byte [ebp - 0x2a6], 0
jne 0x41912c
test bl, bl
je 0x419123
cmp byte [ebp - 0x2a5], 0
jne 0x419123
test bh, bh
je 0x41912c
mov ecx, edi
call fcn.004196c0
jmp 0x419133
mov ecx, edi
call fcn.004197a0
xor bl, 1
mov ecx, edi
movzx eax, bl
push eax
call fcn.00419370
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 8