Function at 0x40d5ed
Capabilities:
Accept command line arguments
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xd24]
sub esp, 0xda4
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0xd20], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push edi
push str._enableas
call esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40d647
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x4845f0
call fcn.00417bfd
mov ecx, eax
call fcn.0042ed08
lea ecx, [ebp - 0x2c]
call fcn.0042c1c2
xor eax, eax
jmp 0x40d8c7
call esi
push eax
call fcn.00407847
pop ecx
mov ecx, 0xc8
cmp eax, ecx
mov dword [0x482330], eax
jg 0x40d686
je 0x40d6a9
cmp eax, 2
je 0x40d678
push 4
pop edi
cmp eax, edi
je 0x40d6a9
cmp eax, 0x64
je 0x40d67c
jle 0x40d6b4
cmp eax, 0x66
jg 0x40d6b4
push 0
jmp 0x40d67e
push 2
call fcn.004129a0
pop ecx
jmp 0x40d640
cmp eax, 0xc9
jl 0x40d6b1
cmp eax, 0xcb
jle 0x40d6ad
cmp eax, 0x12c
je 0x40d6a9
cmp eax, 0x258
jne 0x40d6b1
call fcn.0040b7e9
jmp 0x40d640
push 3
jmp 0x40d67e
push 1
jmp 0x40d67e
push 4
pop edi
call fcn.004079c6
test eax, eax
jne 0x40d640
xor esi, esi
push esi
lea eax, [ebp - 0x48]
push eax
push 0x482120
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
call sub.gdiplus.dll_GdiplusStartup
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x482344
mov dword [ebp - 0x80], 0x469f28
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
call fcn.0040a5f4
call fcn.0043687d
mov ecx, eax
call fcn.00436c62
call fcn.00431bbe
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x34]
push eax
push str.360RealPro12
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov ebx, str.SOFTWARE360Safe_safemon
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
push 2
pop ecx
cmp dword [ebp - 0x20], ecx
setne al
mov dword [0x4845dc], eax
cmp eax, esi
je 0x40d778
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.360RealPro12
push ebx
push edi
mov dword [0x4845e4], 1
mov dword [ebp - 0x20], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00410fe2
mov dword [0x4845e0], eax
cmp eax, esi
jne 0x40d78c
mov dword [0x4845dc], esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.360Protect_StateChg
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x18]
call fcn.0040c3dc
push esi
push ecx
mov eax, esp
push esi
push esi
mov dword [eax], esi
push 0x475f7c
push ecx
mov eax, esp
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x1ae
mov dword [ebp - 0x24], 0x168
mov dword [eax], ecx
push esi
lea ecx, [ebp + 0x14]
call fcn.0040b9a8
lea ecx, [ebp - 0x18]
cmp eax, esi
jne 0x40d806
call fcn.0040cfe7
lea ecx, [ebp - 0x70]
call fcn.004497b8
lea ecx, [ebp - 0x7c]
call fcn.004497b8
jmp 0x40d640
push dword [0x482330]
call fcn.004284e2
push dword [ebp + 0xd30]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x18]
call fcn.0042207b
lea ecx, [ebp - 0x18]
call fcn.00420660
lea ecx, [ebp - 0x80]
call fcn.00408178
push esi
mov ecx, 0x4845e8
mov edi, eax
call fcn.0040dfa6
push esi
mov ecx, 0x4845ec
call fcn.0040dfa6
push str.sites.dll
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x1c], esi
call fcn.00408546
lea eax, [ebp - 0x1c]
push esi
push eax
push 0x46a1bc
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], eax
call fcn.0040a77f
mov ecx, dword [ebp - 0x1c]
cmp ecx, esi
jne 0x40d886
push 0x80004003
call fcn.0044c560
call fcn.00407e4b
push dword [0x482120]
call sub.gdiplus.dll_GdiplusShutdown
mov ecx, 0x482344
call fcn.0040ac84
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x40d8ad
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x18]
call fcn.0040cfe7
lea ecx, [ebp - 0x70]
call fcn.004497b8
lea ecx, [ebp - 0x7c]
call fcn.004497b8
mov eax, edi
mov ecx, dword [ebp + 0xd20]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0xd24
leave
ret