Function at 0x458193
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x14f0]
mov eax, 0x1570
call fcn.004760e0
mov eax, dword [0x4f2be0]
xor eax, ebp
mov dword [ebp + 0x14ec], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x65
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push ebx
lea ecx, [ebp - 0x80]
call fcn.0043d169
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp + 0x74]
call fcn.00402675
lea eax, [ebp + 0x74]
push eax
lea ecx, [ebp - 0x80]
call fcn.0043cd64
mov ecx, dword [ebp + 0x74]
add ecx, 0xfffffff0
call fcn.004029d4
lea ecx, [ebp - 0x80]
call fcn.0043d39b
lea ecx, [ebp - 0x80]
call fcn.0043cb6b
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45827b
push ebx
push ebx
push 0x66
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push 0x410
lea eax, [ebp + 0xab8]
push ebx
push eax
mov dword [ebp + 0xab4], ebx
call fcn.00474a10
xor eax, eax
lea edi, [ebp + 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp + 0xab4]
mov dword [ebp + 0x60], eax
lea eax, [ebp + 0x6c]
push eax
push 0x64
push 1
lea eax, [ebp + 0x58]
push eax
push ebx
push 0x4a
push esi
mov dword [ebp + 0x58], 0xe10
mov dword [ebp + 0x5c], 0x414
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push str.Q360SafeSetup
push 1
push ebx
mov dword [0x4f6a78], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4f6a78], eax
cmp eax, ebx
je 0x458317
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x458317
push ebx
push ebx
push 0x67
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push 0x96
lea ecx, [ebp + 0x68]
call fcn.00432299
mov esi, dword [eax]
push 0xa9
lea ecx, [ebp + 0x6c]
call fcn.00432299
push 0x40
push esi
push dword [eax]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.004029d4
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.004029d4
lea ecx, [ebp - 0x80]
call fcn.0043d2ef
mov ecx, dword [ebp + 0x14ec]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00474a8a
add ebp, 0x14f0
leave
ret 0x10
lea ecx, [ebp - 0x80]
call fcn.0043caed
test eax, eax
je 0x458498
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00455638
pop ecx
push ebx
push dword [ebp + 0x14f8]
mov esi, 0x4f6b00
push ebx
mov ecx, esi
call fcn.00455b73
push 0x4bffc8
push ebx
call fcn.0047ae9d
pop ecx
pop ecx
mov ecx, 0x4f6b58
call fcn.004698d9
call fcn.00455794
test eax, eax
jne 0x4583ec
push ebx
push ebx
push 0x68
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push 0x96
lea ecx, [ebp + 0x68]
call fcn.00432299
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x6c]
call fcn.00432299
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
cmp eax, 6
sete byte [ebp + 0x73]
add ecx, 0xfffffff0
call fcn.004029d4
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.004029d4
cmp byte [ebp + 0x73], bl
je 0x4583e4
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
inc ebx
jmp 0x4582f3
push dword [ebp + 0x1504]
push dword [ebp + 0x1500]
call fcn.00457c84
pop ecx
pop ecx
mov dword [ebp + 0x6c], eax
call fcn.0044cf43
push 0x4f6b90
lea ecx, [ebp + 0x74]
call fcn.00403cb4
mov edi, dword [ebp + 0x74]
cmp dword [edi - 0xc], ebx
je 0x45847b
mov eax, dword [0x4f6b8c]
cmp eax, ebx
je 0x45842d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x458458
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x458458
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x74]
call fcn.00414eac
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x74]
call fcn.0040b382
mov edi, dword [ebp + 0x74]
push edi
call fcn.00430bbb
pop ecx
mov ecx, esi
call fcn.00455e7f
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.004029d4
mov ebx, dword [ebp + 0x6c]
jmp 0x4582f3
push str.Software360Safe
lea ecx, [ebp + 0xec8]
call fcn.0043ca7a
mov esi, str.SoftwareMicrosoftWindowsCurrentVersion360Clear
push esi
lea ecx, [ebp + 0x10d4]
call fcn.0043ca7a
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion360JJX
push edi
lea ecx, [ebp + 0x12e0]
call fcn.0043ca7a
lea ecx, [ebp + 0xec8]
mov dword [ebp + 0x74], ebx
call fcn.0043ca04
lea ecx, [ebp + 0x10d4]
mov dword [ebp + 0x6c], eax
call fcn.0043ca04
lea ecx, [ebp + 0x12e0]
mov dword [ebp + 0x64], eax
call fcn.0043ca04
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x68], eax
call fcn.0043cae9
cmp dword [eax], ebx
jne 0x4585c6
cmp dword [ebp + 0x68], ebx
je 0x458581
push ebx
push ebx
push 0x69
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push 0x31
push 0x4bff5c
push 0x4bfed8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x45857e
call fcn.004541cc
test eax, eax
je 0x458575
push ebx
push ebx
push 0x6a
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
lea ecx, [ebp + 0x12e0]
call fcn.0043ca6f
lea ecx, [ebp + 0x10d4]
call fcn.0043ca6f
lea ecx, [ebp + 0xec8]
call fcn.0043ca6f
jmp 0x4583e4
mov dword [ebp + 0x74], 1
jmp 0x458581
mov dword [ebp + 0x74], ecx
cmp dword [ebp + 0x64], ebx
jne 0x45858b
cmp dword [ebp + 0x6c], ebx
je 0x4585f4
push ebx
push ebx
push 0x6b
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push 0x31
push 0x4bff5c
push 0x4bfe80
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x4585f4
push ebx
push ebx
push 0x6c
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push ebx
jmp 0x4585e7
cmp dword [ebp + 0x64], ebx
jne 0x4585d5
cmp dword [ebp + 0x68], ebx
jne 0x4585d5
cmp dword [ebp + 0x6c], ebx
je 0x4585f4
push ebx
push ebx
push 0x6c
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push 2
call fcn.00468fb6
mov dword [ebp + 0x74], 1
pop ecx
push str.Software360Safe
lea ecx, [ebp + 0x78]
call fcn.0043ca7a
push esi
lea ecx, [ebp + 0x490]
call fcn.0043ca7a
push edi
lea ecx, [ebp + 0x69c]
call fcn.0043ca7a
push ebx
push esi
lea ecx, [ebp + 0x8a8]
call fcn.0043ca9b
push ebx
push edi
lea ecx, [ebp + 0x284]
call fcn.0043ca9b
push ebx
lea ecx, [ebp + 0xcbc]
cmp dword [ebp + 0x74], ebx
je 0x458642
push esi
jmp 0x458643
push edi
call fcn.0043ca9b
lea ecx, [ebp + 0xcbc]
call fcn.0043ca6f
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00455638
pop ecx
push ebx
push dword [ebp + 0x14f8]
mov esi, 0x4f6b00
push ebx
mov ecx, esi
call fcn.00455b73
push 0x4bffc8
push ebx
call fcn.0047ae9d
pop ecx
pop ecx
mov ecx, 0x4f6b58
call fcn.004698d9
call fcn.00455794
test eax, eax
jne 0x45874d
push ebx
push ebx
push 0x68
call fcn.00402f1e
mov ecx, eax
call fcn.00402faf
push 0x96
lea ecx, [ebp + 0x68]
call fcn.00432299
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x6c]
call fcn.00432299
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
cmp eax, 6
sete byte [ebp + 0x73]
add ecx, 0xfffffff0
call fcn.004029d4
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.004029d4
cmp byte [ebp + 0x73], bl
je 0x458714
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 0x284]
call fcn.0043ca6f
lea ecx, [ebp + 0x8a8]
call fcn.0043ca6f
lea ecx, [ebp + 0x69c]
call fcn.0043ca6f
lea ecx, [ebp + 0x490]
call fcn.0043ca6f
lea ecx, [ebp + 0x78]
call fcn.0043ca6f
jmp 0x45854f
lea ecx, [ebp + 0x5c]
call fcn.0046dfc7
push dword [ebp + 0x1504]
push dword [ebp + 0x1500]
call fcn.00457c84
pop ecx
pop ecx
mov dword [ebp + 0x6c], eax
call fcn.0044cf43
push 0x4f6b90
lea ecx, [ebp + 0x74]
call fcn.00403cb4
mov edi, dword [ebp + 0x74]
cmp dword [edi - 0xc], ebx
je 0x4587e4
mov eax, dword [0x4f6b8c]
cmp eax, ebx
je 0x458796
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4587c1
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4587c1
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x74]
call fcn.00414eac
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x74]
call fcn.0040b382
mov edi, dword [ebp + 0x74]
push edi
call fcn.00430bbb
pop ecx
mov ecx, esi
call fcn.00455e7f
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.004029d4
lea ecx, [ebp + 0x5c]
call fcn.0046dfb0
lea ecx, [ebp + 0x284]
call fcn.0043ca6f
lea ecx, [ebp + 0x8a8]
call fcn.0043ca6f
lea ecx, [ebp + 0x69c]
call fcn.0043ca6f
lea ecx, [ebp + 0x490]
call fcn.0043ca6f
lea ecx, [ebp + 0x78]
call fcn.0043ca6f
lea ecx, [ebp + 0x12e0]
call fcn.0043ca6f
lea ecx, [ebp + 0x10d4]
call fcn.0043ca6f
lea ecx, [ebp + 0xec8]
call fcn.0043ca6f
jmp 0x458490