Function at 0x458afd
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x14f4]
mov eax, 0x1574
call fcn.00476b40
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x14f0], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x65
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push ebx
lea ecx, [ebp - 0x80]
call fcn.0043d475
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp + 0x78]
call fcn.004024e0
lea eax, [ebp + 0x78]
push eax
lea ecx, [ebp - 0x80]
call fcn.0043d070
mov ecx, dword [ebp + 0x78]
add ecx, 0xfffffff0
call fcn.00402820
lea ecx, [ebp - 0x80]
call fcn.0043d6ad
lea ecx, [ebp - 0x80]
call fcn.0043ceaa
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x458be5
push ebx
push ebx
push 0x66
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push 0x410
lea eax, [ebp + 0xabc]
push ebx
push eax
mov dword [ebp + 0xab8], ebx
call fcn.00475420
xor eax, eax
lea edi, [ebp + 0x60]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp + 0xab8]
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x70]
push eax
push 0x64
push 1
lea eax, [ebp + 0x5c]
push eax
push ebx
push 0x4a
push esi
mov dword [ebp + 0x5c], 0xe10
mov dword [ebp + 0x60], 0x414
mov dword [ebp + 0x70], ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push str.Q360SafeSetup
push 1
push ebx
mov dword [0x4f7b94], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4f7b94], eax
cmp eax, ebx
je 0x458c81
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x458c81
push ebx
push ebx
push 0x67
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push 0x96
lea ecx, [ebp + 0x6c]
call fcn.004325a7
mov esi, dword [eax]
push 0xa9
lea ecx, [ebp + 0x70]
call fcn.004325a7
push 0x40
push esi
push dword [eax]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.00402820
lea ecx, [ebp - 0x80]
call fcn.0043d601
mov ecx, dword [ebp + 0x14f0]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0047549a
add ebp, 0x14f4
leave
ret 0x10
lea ecx, [ebp - 0x80]
call fcn.0043ce30
test eax, eax
je 0x458e02
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00455e3b
pop ecx
push ebx
push dword [ebp + 0x14fc]
mov esi, 0x4f7c20
push ebx
mov ecx, esi
call fcn.00456461
push 0x4c0398
push ebx
call fcn.0047b7dd
pop ecx
pop ecx
mov ecx, 0x4f7c78
call fcn.0046a387
call fcn.00455f97
test eax, eax
jne 0x458d56
push ebx
push ebx
push 0x68
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push 0x96
lea ecx, [ebp + 0x6c]
call fcn.004325a7
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x70]
call fcn.004325a7
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x70]
cmp eax, 6
sete byte [ebp + 0x77]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.00402820
cmp byte [ebp + 0x77], bl
je 0x458d4e
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
inc ebx
jmp 0x458c5d
push dword [ebp + 0x1508]
push dword [ebp + 0x1504]
call fcn.004585ee
pop ecx
pop ecx
mov dword [ebp + 0x70], eax
call fcn.0044d186
push 0x4f7cb0
lea ecx, [ebp + 0x78]
call fcn.00403cb9
mov edi, dword [ebp + 0x78]
cmp dword [edi - 0xc], ebx
je 0x458de5
mov eax, dword [0x4f7cac]
cmp eax, ebx
je 0x458d97
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x458dc2
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x458dc2
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x78]
call fcn.00414e5c
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x78]
call fcn.0040b3c8
mov edi, dword [ebp + 0x78]
push edi
call fcn.00430e2d
pop ecx
mov ecx, esi
call fcn.004567e9
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.00402820
mov ebx, dword [ebp + 0x70]
jmp 0x458c5d
push str.Software360Safe
lea ecx, [ebp + 0xecc]
call fcn.0043cdbd
mov esi, str.SoftwareMicrosoftWindowsCurrentVersion360Clear
push esi
lea ecx, [ebp + 0x10d8]
call fcn.0043cdbd
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion360JJX
push edi
lea ecx, [ebp + 0x12e4]
call fcn.0043cdbd
lea ecx, [ebp + 0xecc]
mov dword [ebp + 0x78], ebx
call fcn.0043cd47
lea ecx, [ebp + 0x10d8]
mov dword [ebp + 0x70], eax
call fcn.0043cd47
lea ecx, [ebp + 0x12e4]
mov dword [ebp + 0x68], eax
call fcn.0043cd47
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x6c], eax
call fcn.0043ce2c
cmp dword [eax], ebx
jne 0x458f30
cmp dword [ebp + 0x6c], ebx
je 0x458eeb
push ebx
push ebx
push 0x69
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push 0x31
push 0x4c032c
push 0x4c02a8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x458ee8
call fcn.00454a36
test eax, eax
je 0x458edf
push ebx
push ebx
push 0x6a
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
lea ecx, [ebp + 0x12e4]
call fcn.0043cdb2
lea ecx, [ebp + 0x10d8]
call fcn.0043cdb2
lea ecx, [ebp + 0xecc]
call fcn.0043cdb2
jmp 0x458d4e
mov dword [ebp + 0x78], 1
jmp 0x458eeb
mov dword [ebp + 0x78], ecx
cmp dword [ebp + 0x68], ebx
jne 0x458ef5
cmp dword [ebp + 0x70], ebx
je 0x458f5e
push ebx
push ebx
push 0x6b
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push 0x31
push 0x4c032c
push 0x4c0250
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x458f5e
push ebx
push ebx
push 0x6c
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push ebx
jmp 0x458f51
cmp dword [ebp + 0x68], ebx
jne 0x458f3f
cmp dword [ebp + 0x6c], ebx
jne 0x458f3f
cmp dword [ebp + 0x70], ebx
je 0x458f5e
push ebx
push ebx
push 0x6c
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push 2
call fcn.00469a65
mov dword [ebp + 0x78], 1
pop ecx
push str.Software360Safe
lea ecx, [ebp + 0x7c]
call fcn.0043cdbd
push esi
lea ecx, [ebp + 0x494]
call fcn.0043cdbd
push edi
lea ecx, [ebp + 0x6a0]
call fcn.0043cdbd
push ebx
push esi
lea ecx, [ebp + 0x8ac]
call fcn.0043cdde
push ebx
push edi
lea ecx, [ebp + 0x288]
call fcn.0043cdde
push ebx
lea ecx, [ebp + 0xcc0]
cmp dword [ebp + 0x78], ebx
je 0x458fac
push esi
jmp 0x458fad
push edi
call fcn.0043cdde
lea ecx, [ebp + 0xcc0]
call fcn.0043cdb2
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00455e3b
pop ecx
push ebx
push dword [ebp + 0x14fc]
mov esi, 0x4f7c20
push ebx
mov ecx, esi
call fcn.00456461
push 0x4c0398
push ebx
call fcn.0047b7dd
pop ecx
pop ecx
mov ecx, 0x4f7c78
call fcn.0046a387
call fcn.00455f97
test eax, eax
jne 0x4590b7
push ebx
push ebx
push 0x68
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push 0x96
lea ecx, [ebp + 0x6c]
call fcn.004325a7
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x70]
call fcn.004325a7
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x70]
cmp eax, 6
sete byte [ebp + 0x77]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.00402820
cmp byte [ebp + 0x77], bl
je 0x45907e
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 0x288]
call fcn.0043cdb2
lea ecx, [ebp + 0x8ac]
call fcn.0043cdb2
lea ecx, [ebp + 0x6a0]
call fcn.0043cdb2
lea ecx, [ebp + 0x494]
call fcn.0043cdb2
lea ecx, [ebp + 0x7c]
call fcn.0043cdb2
jmp 0x458eb9
lea ecx, [ebp + 0x60]
call fcn.0046eb97
push dword [ebp + 0x1508]
push dword [ebp + 0x1504]
call fcn.004585ee
pop ecx
pop ecx
mov dword [ebp + 0x70], eax
call fcn.0044d186
push 0x4f7cb0
lea ecx, [ebp + 0x78]
call fcn.00403cb9
mov edi, dword [ebp + 0x78]
cmp dword [edi - 0xc], ebx
je 0x45914e
mov eax, dword [0x4f7cac]
cmp eax, ebx
je 0x459100
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45912b
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45912b
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x78]
call fcn.00414e5c
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x78]
call fcn.0040b3c8
mov edi, dword [ebp + 0x78]
push edi
call fcn.00430e2d
pop ecx
mov ecx, esi
call fcn.004567e9
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.00402820
lea ecx, [ebp + 0x60]
call fcn.0046eb80
lea ecx, [ebp + 0x288]
call fcn.0043cdb2
lea ecx, [ebp + 0x8ac]
call fcn.0043cdb2
lea ecx, [ebp + 0x6a0]
call fcn.0043cdb2
lea ecx, [ebp + 0x494]
call fcn.0043cdb2
lea ecx, [ebp + 0x7c]
call fcn.0043cdb2
lea ecx, [ebp + 0x12e4]
call fcn.0043cdb2
lea ecx, [ebp + 0x10d8]
call fcn.0043cdb2
lea ecx, [ebp + 0xecc]
call fcn.0043cdb2
jmp 0x458dfa