Function at 0x458b56
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x14f0]
mov eax, 0x1570
call fcn.00476c90
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x14ec], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x65
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push ebx
lea ecx, [ebp - 0x80]
call fcn.0043d29c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp + 0x74]
call fcn.00402530
lea eax, [ebp + 0x74]
push eax
lea ecx, [ebp - 0x80]
call fcn.0043ce97
mov ecx, dword [ebp + 0x74]
add ecx, 0xfffffff0
call fcn.00402870
lea ecx, [ebp - 0x80]
call fcn.0043d4ce
lea ecx, [ebp - 0x80]
call fcn.0043cc9e
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x458c3e
push ebx
push ebx
push 0x66
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x410
lea eax, [ebp + 0xab8]
push ebx
push eax
mov dword [ebp + 0xab4], ebx
call fcn.00475570
xor eax, eax
lea edi, [ebp + 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp + 0xab4]
mov dword [ebp + 0x60], eax
lea eax, [ebp + 0x6c]
push eax
push 0x64
push 1
lea eax, [ebp + 0x58]
push eax
push ebx
push 0x4a
push esi
mov dword [ebp + 0x58], 0xe10
mov dword [ebp + 0x5c], 0x414
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push str.Q360SafeSetup
push 1
push ebx
mov dword [0x4f7bac], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4f7bac], eax
cmp eax, ebx
je 0x458cda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x458cda
push ebx
push ebx
push 0x67
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x96
lea ecx, [ebp + 0x68]
call fcn.004323e4
mov esi, dword [eax]
push 0xa9
lea ecx, [ebp + 0x6c]
call fcn.004323e4
push 0x40
push esi
push dword [eax]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.00402870
lea ecx, [ebp - 0x80]
call fcn.0043d422
mov ecx, dword [ebp + 0x14ec]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004755ea
add ebp, 0x14f0
leave
ret 0x10
lea ecx, [ebp - 0x80]
call fcn.0043cc20
test eax, eax
je 0x458e5b
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00455edd
pop ecx
push ebx
push dword [ebp + 0x14f8]
mov esi, 0x4f7c38
push ebx
mov ecx, esi
call fcn.004564d8
push 0x4c1478
push ebx
call fcn.0047b929
pop ecx
pop ecx
mov ecx, 0x4f7c90
call fcn.0046a2bd
call fcn.00456039
test eax, eax
jne 0x458daf
push ebx
push ebx
push 0x68
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x96
lea ecx, [ebp + 0x68]
call fcn.004323e4
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x6c]
call fcn.004323e4
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
cmp eax, 6
sete byte [ebp + 0x73]
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.00402870
cmp byte [ebp + 0x73], bl
je 0x458da7
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
inc ebx
jmp 0x458cb6
push dword [ebp + 0x1504]
push dword [ebp + 0x1500]
call fcn.00458647
pop ecx
pop ecx
mov dword [ebp + 0x6c], eax
call fcn.0044d56c
push 0x4f7cc8
lea ecx, [ebp + 0x74]
call fcn.00403c96
mov edi, dword [ebp + 0x74]
cmp dword [edi - 0xc], ebx
je 0x458e3e
mov eax, dword [0x4f7cc4]
cmp eax, ebx
je 0x458df0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x458e1b
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x458e1b
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x74]
call fcn.00414d79
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x74]
call fcn.0040b36f
mov edi, dword [ebp + 0x74]
push edi
call fcn.00430d71
pop ecx
mov ecx, esi
call fcn.0045680d
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.00402870
mov ebx, dword [ebp + 0x6c]
jmp 0x458cb6
push str.Software360Safe
lea ecx, [ebp + 0xec8]
call fcn.0043cbad
mov esi, str.SoftwareMicrosoftWindowsCurrentVersion360Clear
push esi
lea ecx, [ebp + 0x10d4]
call fcn.0043cbad
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion360JJX
push edi
lea ecx, [ebp + 0x12e0]
call fcn.0043cbad
lea ecx, [ebp + 0xec8]
mov dword [ebp + 0x74], ebx
call fcn.0043cb37
lea ecx, [ebp + 0x10d4]
mov dword [ebp + 0x6c], eax
call fcn.0043cb37
lea ecx, [ebp + 0x12e0]
mov dword [ebp + 0x64], eax
call fcn.0043cb37
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x68], eax
call fcn.0043cc1c
cmp dword [eax], ebx
jne 0x458f89
cmp dword [ebp + 0x68], ebx
je 0x458f44
push ebx
push ebx
push 0x69
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x31
push 0x4c140c
push 0x4c1388
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x458f41
call fcn.00454819
test eax, eax
je 0x458f38
push ebx
push ebx
push 0x6a
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
lea ecx, [ebp + 0x12e0]
call fcn.0043cba2
lea ecx, [ebp + 0x10d4]
call fcn.0043cba2
lea ecx, [ebp + 0xec8]
call fcn.0043cba2
jmp 0x458da7
mov dword [ebp + 0x74], 1
jmp 0x458f44
mov dword [ebp + 0x74], ecx
cmp dword [ebp + 0x64], ebx
jne 0x458f4e
cmp dword [ebp + 0x6c], ebx
je 0x458fb7
push ebx
push ebx
push 0x6b
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x31
push 0x4c140c
push 0x4c1330
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x458fb7
push ebx
push ebx
push 0x6c
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push ebx
jmp 0x458faa
cmp dword [ebp + 0x64], ebx
jne 0x458f98
cmp dword [ebp + 0x68], ebx
jne 0x458f98
cmp dword [ebp + 0x6c], ebx
je 0x458fb7
push ebx
push ebx
push 0x6c
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 2
call fcn.0046999b
mov dword [ebp + 0x74], 1
pop ecx
push str.Software360Safe
lea ecx, [ebp + 0x78]
call fcn.0043cbad
push esi
lea ecx, [ebp + 0x490]
call fcn.0043cbad
push edi
lea ecx, [ebp + 0x69c]
call fcn.0043cbad
push ebx
push esi
lea ecx, [ebp + 0x8a8]
call fcn.0043cbce
push ebx
push edi
lea ecx, [ebp + 0x284]
call fcn.0043cbce
push ebx
lea ecx, [ebp + 0xcbc]
cmp dword [ebp + 0x74], ebx
je 0x459005
push esi
jmp 0x459006
push edi
call fcn.0043cbce
lea ecx, [ebp + 0xcbc]
call fcn.0043cba2
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00455edd
pop ecx
push ebx
push dword [ebp + 0x14f8]
mov esi, 0x4f7c38
push ebx
mov ecx, esi
call fcn.004564d8
push 0x4c1478
push ebx
call fcn.0047b929
pop ecx
pop ecx
mov ecx, 0x4f7c90
call fcn.0046a2bd
call fcn.00456039
test eax, eax
jne 0x459110
push ebx
push ebx
push 0x68
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x96
lea ecx, [ebp + 0x68]
call fcn.004323e4
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x6c]
call fcn.004323e4
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
cmp eax, 6
sete byte [ebp + 0x73]
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.00402870
cmp byte [ebp + 0x73], bl
je 0x4590d7
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 0x284]
call fcn.0043cba2
lea ecx, [ebp + 0x8a8]
call fcn.0043cba2
lea ecx, [ebp + 0x69c]
call fcn.0043cba2
lea ecx, [ebp + 0x490]
call fcn.0043cba2
lea ecx, [ebp + 0x78]
call fcn.0043cba2
jmp 0x458f12
lea ecx, [ebp + 0x5c]
call fcn.0046eb2f
push dword [ebp + 0x1504]
push dword [ebp + 0x1500]
call fcn.00458647
pop ecx
pop ecx
mov dword [ebp + 0x6c], eax
call fcn.0044d56c
push 0x4f7cc8
lea ecx, [ebp + 0x74]
call fcn.00403c96
mov edi, dword [ebp + 0x74]
cmp dword [edi - 0xc], ebx
je 0x4591a7
mov eax, dword [0x4f7cc4]
cmp eax, ebx
je 0x459159
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x459184
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x459184
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x74]
call fcn.00414d79
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x74]
call fcn.0040b36f
mov edi, dword [ebp + 0x74]
push edi
call fcn.00430d71
pop ecx
mov ecx, esi
call fcn.0045680d
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.00402870
lea ecx, [ebp + 0x5c]
call fcn.0046eb18
lea ecx, [ebp + 0x284]
call fcn.0043cba2
lea ecx, [ebp + 0x8a8]
call fcn.0043cba2
lea ecx, [ebp + 0x69c]
call fcn.0043cba2
lea ecx, [ebp + 0x490]
call fcn.0043cba2
lea ecx, [ebp + 0x78]
call fcn.0043cba2
lea ecx, [ebp + 0x12e0]
call fcn.0043cba2
lea ecx, [ebp + 0x10d4]
call fcn.0043cba2
lea ecx, [ebp + 0xec8]
call fcn.0043cba2
jmp 0x458e53