Function at 0x455a6b
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x14ec]
mov eax, 0x156c
call fcn.00471870
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x14e8], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x65
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push ebx
lea ecx, [ebp - 0x80]
call fcn.0043cfe4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp + 0x70]
call fcn.004025d8
lea eax, [ebp + 0x70]
push eax
lea ecx, [ebp - 0x80]
call fcn.0043cbdd
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.0040290e
lea ecx, [ebp - 0x80]
call fcn.0043d21c
lea ecx, [ebp - 0x80]
call fcn.0043ca17
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x455b53
push ebx
push ebx
push 0x66
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push 0x410
lea eax, [ebp + 0xab4]
push ebx
push eax
mov dword [ebp + 0xab0], ebx
call fcn.004701a0
xor eax, eax
lea edi, [ebp + 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp + 0xab0]
mov dword [ebp + 0x5c], eax
lea eax, [ebp + 0x68]
push eax
push 0x64
push 1
lea eax, [ebp + 0x54]
push eax
push ebx
push 0x4a
push esi
mov dword [ebp + 0x54], 0xe10
mov dword [ebp + 0x58], 0x414
mov dword [ebp + 0x68], ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push str.Q360SafeSetup
push 1
push ebx
mov dword [0x4f17cc], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4f17cc], eax
cmp eax, ebx
je 0x455bef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x455bef
push ebx
push ebx
push 0x67
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push 0x96
lea ecx, [ebp + 0x64]
call fcn.00432171
mov esi, dword [eax]
push 0xa9
lea ecx, [ebp + 0x68]
call fcn.00432171
push 0x40
push esi
push dword [eax]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040290e
lea ecx, [ebp - 0x80]
call fcn.0043d170
mov ecx, dword [ebp + 0x14e8]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0047021a
add ebp, 0x14ec
leave
ret 0x10
lea ecx, [ebp - 0x80]
call fcn.0043c9a3
test eax, eax
je 0x455d70
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00452cce
pop ecx
push ebx
push dword [ebp + 0x14f4]
mov esi, 0x4f1850
push ebx
mov ecx, esi
call fcn.004532f4
push 0x4baf78
push ebx
call fcn.00474ea0
pop ecx
pop ecx
mov ecx, 0x4f18a0
call fcn.004673a7
call fcn.00452e2a
test eax, eax
jne 0x455cc4
push ebx
push ebx
push 0x68
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push 0x96
lea ecx, [ebp + 0x64]
call fcn.00432171
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x68]
call fcn.00432171
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x68]
cmp eax, 6
sete byte [ebp + 0x6f]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040290e
cmp byte [ebp + 0x6f], bl
je 0x455cbc
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
inc ebx
jmp 0x455bcb
push dword [ebp + 0x1500]
push dword [ebp + 0x14fc]
call fcn.0045555c
pop ecx
pop ecx
mov dword [ebp + 0x68], eax
call fcn.0044a835
push 0x4f18d8
lea ecx, [ebp + 0x70]
call fcn.00403c4d
mov edi, dword [ebp + 0x70]
cmp dword [edi - 0xc], ebx
je 0x455d53
mov eax, dword [0x4f18d4]
cmp eax, ebx
je 0x455d05
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x455d30
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x455d30
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x70]
call fcn.00414b85
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x70]
call fcn.0040b353
mov edi, dword [ebp + 0x70]
push edi
call fcn.00430998
pop ecx
mov ecx, esi
call fcn.0045364c
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.0040290e
mov ebx, dword [ebp + 0x68]
jmp 0x455bcb
push str.Software360Safe
lea ecx, [ebp + 0xec4]
call fcn.0043c942
mov esi, str.SoftwareMicrosoftWindowsCurrentVersion360Clear
push esi
lea ecx, [ebp + 0x10d0]
call fcn.0043c942
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion360JJX
push edi
lea ecx, [ebp + 0x12dc]
call fcn.0043c942
lea ecx, [ebp + 0xec4]
mov dword [ebp + 0x70], ebx
call fcn.0043c8cc
lea ecx, [ebp + 0x10d0]
mov dword [ebp + 0x68], eax
call fcn.0043c8cc
lea ecx, [ebp + 0x12dc]
mov dword [ebp + 0x60], eax
call fcn.0043c8cc
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x64], eax
call fcn.0043c99f
cmp dword [eax], ebx
jne 0x455e9e
cmp dword [ebp + 0x64], ebx
je 0x455e59
push ebx
push ebx
push 0x69
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push 0x31
push 0x4b97e0
push 0x4bae98
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x455e56
call fcn.0045187a
test eax, eax
je 0x455e4d
push ebx
push ebx
push 0x6a
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
lea ecx, [ebp + 0x12dc]
call fcn.0043c937
lea ecx, [ebp + 0x10d0]
call fcn.0043c937
lea ecx, [ebp + 0xec4]
call fcn.0043c937
jmp 0x455cbc
mov dword [ebp + 0x70], 1
jmp 0x455e59
mov dword [ebp + 0x70], ecx
cmp dword [ebp + 0x60], ebx
jne 0x455e63
cmp dword [ebp + 0x68], ebx
je 0x455ecc
push ebx
push ebx
push 0x6b
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push 0x31
push 0x4b97e0
push 0x4bae40
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x455ecc
push ebx
push ebx
push 0x6c
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push ebx
jmp 0x455ebf
cmp dword [ebp + 0x60], ebx
jne 0x455ead
cmp dword [ebp + 0x64], ebx
jne 0x455ead
cmp dword [ebp + 0x68], ebx
je 0x455ecc
push ebx
push ebx
push 0x6c
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push 2
call fcn.00466a6d
mov dword [ebp + 0x70], 1
pop ecx
push str.Software360Safe
lea ecx, [ebp + 0x74]
call fcn.0043c942
push esi
lea ecx, [ebp + 0x48c]
call fcn.0043c942
push edi
lea ecx, [ebp + 0x698]
call fcn.0043c942
push ebx
push esi
lea ecx, [ebp + 0x8a4]
call fcn.0043c963
push ebx
push edi
lea ecx, [ebp + 0x280]
call fcn.0043c963
push ebx
lea ecx, [ebp + 0xcb8]
cmp dword [ebp + 0x70], ebx
je 0x455f1a
push esi
jmp 0x455f1b
push edi
call fcn.0043c963
lea ecx, [ebp + 0xcb8]
call fcn.0043c937
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00452cce
pop ecx
push ebx
push dword [ebp + 0x14f4]
mov esi, 0x4f1850
push ebx
mov ecx, esi
call fcn.004532f4
push 0x4baf78
push ebx
call fcn.00474ea0
pop ecx
pop ecx
mov ecx, 0x4f18a0
call fcn.004673a7
call fcn.00452e2a
test eax, eax
jne 0x456025
push ebx
push ebx
push 0x68
call fcn.00402e62
mov ecx, eax
call fcn.00402ef3
push 0x96
lea ecx, [ebp + 0x64]
call fcn.00432171
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x68]
call fcn.00432171
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x68]
cmp eax, 6
sete byte [ebp + 0x6f]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040290e
cmp byte [ebp + 0x6f], bl
je 0x455fec
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 0x280]
call fcn.0043c937
lea ecx, [ebp + 0x8a4]
call fcn.0043c937
lea ecx, [ebp + 0x698]
call fcn.0043c937
lea ecx, [ebp + 0x48c]
call fcn.0043c937
lea ecx, [ebp + 0x74]
call fcn.0043c937
jmp 0x455e27
lea ecx, [ebp + 0x58]
call fcn.0046baed
push dword [ebp + 0x1500]
push dword [ebp + 0x14fc]
call fcn.0045555c
pop ecx
pop ecx
mov dword [ebp + 0x68], eax
call fcn.0044a835
push 0x4f18d8
lea ecx, [ebp + 0x70]
call fcn.00403c4d
mov edi, dword [ebp + 0x70]
cmp dword [edi - 0xc], ebx
je 0x4560bc
mov eax, dword [0x4f18d4]
cmp eax, ebx
je 0x45606e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x456099
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x456099
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x70]
call fcn.00414b85
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x70]
call fcn.0040b353
mov edi, dword [ebp + 0x70]
push edi
call fcn.00430998
pop ecx
mov ecx, esi
call fcn.0045364c
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.0040290e
lea ecx, [ebp + 0x58]
call fcn.0046bad6
lea ecx, [ebp + 0x280]
call fcn.0043c937
lea ecx, [ebp + 0x8a4]
call fcn.0043c937
lea ecx, [ebp + 0x698]
call fcn.0043c937
lea ecx, [ebp + 0x48c]
call fcn.0043c937
lea ecx, [ebp + 0x74]
call fcn.0043c937
lea ecx, [ebp + 0x12dc]
call fcn.0043c937
lea ecx, [ebp + 0x10d0]
call fcn.0043c937
lea ecx, [ebp + 0xec4]
call fcn.0043c937
jmp 0x455d68