Function at 0x404e30
Capabilities:
Accept command line arguments
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0
lea eax, [edi + 0x68]
push eax
lea esi, [edi + 0x54]
push ecx
mov ecx, esi
call fcn.00406830
cmp dword [edi + 0x6c], 0
jne 0x404e79
xor ecx, ecx
mov eax, edi
test esi, esi
push 0x452
cmove eax, ecx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [edi + 0x6c], eax
cmp dword [edi + 0x70], 0
jne 0x404e9c
test esi, esi
lea eax, [esi - 0x50]
mov ecx, 4
cmove eax, ecx
push 0x453
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [edi + 0x70], eax
mov ecx, dword [edi + 0x5c]
push 0x18b50
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x467
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b51
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x468
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b52
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x44f
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b59
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x485
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b53
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x450
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
add esp, 4
push 0x18e70
mov ecx, dword [edi + 0x5c]
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x469
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x470
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e71
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x46c
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x46d
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x1925a
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x486
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18e72
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push 0x487
push dword [edi + 4]
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b58
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push dword [eax]
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov ecx, dword [edi + 0x5c]
add esp, 4
push 0x18b55
call fcn.0041a580
push eax
lea ecx, [ebp - 0x210]
call fcn.004031f0
push dword [eax]
push dword [edi + 0x70]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call fcn.0041ad86
mov edx, 3
call fcn.00403270
add esp, 4
push 1
push 0
push 0x160c
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x430270]
mov ecx, edi
call esi
push ecx
mov edx, 2
call fcn.00403270
add esp, 4
mov bl, al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.modechrome
push eax
call fcn.0041be14
add esp, 8
test eax, eax
setne byte [ebp - 0x212]
test bl, bl
jne 0x4052a4
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerActiveX
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4052a4
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0x104
push eax
call fcn.0041c660
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x43d488
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405298
push 0x470
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
mov byte [ebp - 0x211], 0
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPlugin
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40533f
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0x104
push eax
call fcn.0041c660
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x43d488
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405333
push 0x46d
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 0x211], 1
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x220]
xor bh, bh
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPepper
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4053d0
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0x104
push eax
call fcn.0041c660
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x43d488
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4053c4
push 0x487
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov bh, 1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x405402
push 0x469
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x470
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [ebp - 0x212], 0
jne 0x405425
test bl, bl
je 0x40541c
cmp byte [ebp - 0x211], 0
jne 0x40541c
test bh, bh
je 0x405425
mov ecx, edi
call fcn.004059c0
jmp 0x40542c
mov ecx, edi
call fcn.00405aa0
test bl, bl
mov ecx, edi
sete al
movzx eax, al
push eax
call fcn.00405670
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ad75
mov esp, ebp
pop ebp
ret 8