Function at 0x4157ed
Capabilities:
Accept command line arguments
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4498b7
mov eax, dword fs:[0]
push eax
sub esp, 0x644
mov eax, dword [0x45a258]
xor eax, esp
mov dword [esp + 0x63c], eax
push ebx
push esi
mov eax, dword [0x45a258]
xor eax, esp
push eax
lea eax, [esp + 0x650]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.0041b8d9
xor ebx, ebx
cmp edi, ebx
je 0x415843
lea ecx, [edi + 0x28]
jmp 0x415845
xor ecx, ecx
push ecx
mov esi, eax
call fcn.0041b85d
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4158a4
lea eax, [esp + 0x20]
push eax
push str.SeDebugPrivilege
push ebx
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebx
push ebx
push 0x10
lea eax, [esp + 0x28]
push eax
push ebx
push dword [esp + 0x24]
mov dword [esp + 0x40], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x4158ad
lea eax, [edi + 0x24]
jmp 0x4158af
xor eax, eax
mov dword [edi + 0x610], eax
lea eax, [edi + 0x5c4]
mov dword [edi + 0x648], eax
cmp dword [0x45ead8], ebx
je 0x4158f1
lea eax, [edi + 0x24]
push eax
lea esi, [edi + 0x538]
call fcn.0040913b
test eax, eax
je 0x4158e9
push 1
push edi
call fcn.0041802a
jmp 0x415c4e
or eax, 0xffffffff
jmp 0x415c50
push edi
call fcn.00415f47
lea ecx, [edi + 0x944]
call fcn.0041bbf5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str._360inifix
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x415926
mov dword [0x46057c], 1
push ebx
push 0x40
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, edi
call fcn.004161c9
mov esi, str._start
push esi
push dword [esp + 0x14]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x41598f
call fcn.0040ef84
test eax, eax
jne 0x415963
mov byte [edi + 0x5bc], 1
push str.softmgr360speedld.exe
call fcn.0040e111
pop ecx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push 0x41578c
push ebx
push ebx
call fcn.0042ea5a
add esp, 0x18
cmp eax, ebx
je 0x41598f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push 0x40e
mov word [esp + 0x238], ax
lea eax, [esp + 0x23a]
push ebx
push eax
call fcn.0042dec0
add esp, 0xc
mov eax, str.UtilsSiteUIProxy.dll
lea ecx, [esp + 0x234]
call fcn.0040d605
lea eax, [esp + 0x234]
push eax
call fcn.004063b3
pop ecx
mov ecx, eax
cmp ecx, ebx
je 0x415a07
mov eax, dword [0x45ea68]
cmp eax, ebx
jne 0x4159f8
push str.GetSmartInitializer
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x4159f1
xor eax, eax
jmp 0x4159f8
call eax
mov dword [0x45ea68], eax
mov dword [edi + 0x958], eax
cmp eax, ebx
je 0x415a07
mov ecx, dword [eax]
push eax
call dword [ecx]
lea eax, [edi + 0x24]
push eax
mov dword [esp + 0x18], eax
lea eax, [edi + 0x538]
push eax
call fcn.00408d4c
cmp dword [0x460570], ebx
je 0x415a4e
cmp dword [0x460430], 5
jne 0x415a4e
cmp dword [0x460434], 2
jne 0x415a4e
push str.Utils360SecLogon360SrvDaemonIn64.exe
xor esi, esi
call fcn.0040e111
mov dword [esp], str.Utils360SecLogon360SrvDaemonIn.exe
call fcn.0040e111
pop ecx
cmp dword [0x45eac0], ebx
je 0x415a66
push ebx
push ebx
push 0xd62
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push 0x1388
push 0xa8
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
push 0x206
mov word [esp + 0x30], ax
lea eax, [esp + 0x32]
push ebx
push eax
call fcn.0042dec0
add esp, 0xc
mov eax, str.tcfg.dll
lea ecx, [esp + 0x2c]
call fcn.0040d605
lea eax, [esp + 0x2c]
push eax
call fcn.0041b76e
mov esi, eax
call fcn.0041b7e5
lea esi, [edi + 0x944]
mov ecx, esi
call fcn.0041bcc2
cmp dword [edi + 0x57c], ebx
jne 0x415adb
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push str.true
push str.TrayPerformanceMode
call dword [eax + 0x20]
cmp dword [0x46055c], ebx
jne 0x415af0
push esi
call fcn.0041c5e1
mov ecx, edi
call fcn.00416495
push str._showtrayicon
push dword [esp + 0x14]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x415b0c
push dword [edi + 4]
call fcn.00422744
pop ecx
cmp dword [0x46055c], ebx
jne 0x415b7e
call fcn.0040ec78
test eax, eax
je 0x415b4a
push 0xc3f5
lea eax, [esp + 0x14]
push eax
call fcn.0040291c
mov dword [esp + 0x658], ebx
mov edx, dword [eax]
xor ecx, ecx
call fcn.00415017
or dword [esp + 0x658], 0xffffffff
mov eax, dword [esp + 0x10]
jmp 0x415b76
push 0x1f
lea eax, [esp + 0x1c]
push eax
call fcn.0040291c
mov dword [esp + 0x658], 1
mov edx, dword [eax]
xor ecx, ecx
call fcn.00415017
or dword [esp + 0x658], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00406004
mov eax, dword [0x460430]
cmp eax, 0xa
jne 0x415b95
cmp dword [0x460434], ebx
jne 0x415ba9
xor eax, eax
inc eax
jmp 0x415bab
cmp eax, 6
jne 0x415ba9
mov eax, dword [0x460434]
cmp eax, 2
je 0x415b90
cmp eax, 3
jmp 0x415b8e
xor eax, eax
mov byte [edi + 0x65], al
cmp dword [0x460558], ebx
je 0x415bc0
push 1
push dword [edi + 4]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
push str.RegisterSuspendResumeNotification
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x415be7
push ebx
push dword [edi + 4]
call eax
mov dword [edi + 0x960], eax
mov eax, edi
call fcn.00415c73
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push 0x45f57c
push str.CLSID_IPCS_MISC.1
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esi]
push 0x45f578
push str.CLSID_IPCS_DDMANAGE.1
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esi]
push 0x45f580
push str.CLSID_IPCS_DEEPSCAN.2
mov ecx, esi
call dword [eax + 0x30]
mov esi, 0x45f5f0
call fcn.004109a2
call fcn.0040d49e
cmp dword [0x45f580], ebx
je 0x415c4e
call fcn.00414662
push dword [0x45f580]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
xor eax, eax
mov ecx, dword [esp + 0x650]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x63c]
xor ecx, esp
call fcn.0042deb1
mov esp, ebp
pop ebp
ret