Function at 0x419890
Capabilities:
Accept command line arguments
Check os version
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4b0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0
lea eax, [edi + 0x68]
push eax
lea esi, [edi + 0x54]
push ecx
mov ecx, esi
call fcn.0041b210
cmp dword [edi + 0x6c], 0
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
jne 0x4198db
xor ecx, ecx
mov eax, edi
test esi, esi
push 0x452
cmove eax, ecx
push dword [eax + 4]
call ebx
mov dword [edi + 0x6c], eax
cmp dword [edi + 0x70], 0
jne 0x4198fa
test esi, esi
lea eax, [esi - 0x50]
mov ecx, 4
cmove eax, ecx
push 0x453
push dword [eax]
call ebx
mov dword [edi + 0x70], eax
mov ecx, dword [edi + 0x5c]
push 0x18b50
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x467
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b51
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x468
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b52
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x44f
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b59
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x485
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b53
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x450
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
add esp, 4
push 0x18e70
mov ecx, dword [edi + 0x5c]
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x469
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x470
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e71
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x46c
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x46d
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x1925a
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x486
push dword [edi + 4]
mov esi, dword [eax]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push 0x487
push dword [edi + 4]
mov esi, dword [eax]
call ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
push eax
call ebx
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b58
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push dword [eax]
push dword [edi + 0x6c]
call ebx
push dword [ebp - 0x2a4]
call fcn.0041b39b
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b55
call fcn.00402790
push eax
lea ecx, [ebp - 0x2a4]
call fcn.0040a650
push dword [eax]
push dword [edi + 0x70]
call ebx
push dword [ebp - 0x2a4]
call fcn.0041b39b
add esp, 4
push 1
push 0
push 0x160c
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x2a0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x419c2b
cmp dword [ebp - 0x29c], 6
jb 0x419c2b
cmp dword [ebp - 0x298], 2
jb 0x419c2b
mov bl, 1
jmp 0x419c2d
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.modechrome
push eax
call fcn.0041cb55
add esp, 8
test eax, eax
setne byte [ebp - 0x2a6]
test bl, bl
jne 0x419ce3
lea eax, [ebp - 0x2a4]
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerActiveX
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419ce3
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2ac], 0x104
push eax
call fcn.0041d0c0
add esp, 0xc
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4abc40
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
jne 0x419cd5
push 0x470
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x419ce9
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [ebp - 0x2b0]
mov byte [ebp - 0x2a5], 0
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPlugin
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419d80
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2ac], 0x104
push eax
call fcn.0041d0c0
add esp, 0xc
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4abc40
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419d74
push 0x46d
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 0x2a5], 1
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2b4]
xor bh, bh
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPepper
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419e0d
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2ac], 0x104
push eax
call fcn.0041d0c0
add esp, 0xc
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4abc40
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419e01
push 0x487
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov bh, 1
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x419e39
push 0x469
push dword [edi + 4]
call esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x470
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call esi
cmp byte [ebp - 0x2a6], 0
jne 0x419e5c
test bl, bl
je 0x419e53
cmp byte [ebp - 0x2a5], 0
jne 0x419e53
test bh, bh
je 0x419e5c
mov ecx, edi
call fcn.0041a3f0
jmp 0x419e63
mov ecx, edi
call fcn.0041a4d0
xor bl, 1
mov ecx, edi
movzx eax, bl
push eax
call fcn.0041a0a0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b38a
mov esp, ebp
pop ebp
ret 8