Function at 0x457ff5
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x14f0]
mov eax, 0x1570
call fcn.00476b30
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x14ec], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x65
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push ebx
lea ecx, [ebp - 0x80]
call fcn.0043d410
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp + 0x74]
call fcn.0040260e
lea eax, [ebp + 0x74]
push eax
lea ecx, [ebp - 0x80]
call fcn.0043d00b
mov ecx, dword [ebp + 0x74]
add ecx, 0xfffffff0
call fcn.00402963
lea ecx, [ebp - 0x80]
call fcn.0043d642
lea ecx, [ebp - 0x80]
call fcn.0043ce45
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4580dd
push ebx
push ebx
push 0x66
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push 0x410
lea eax, [ebp + 0xab8]
push ebx
push eax
mov dword [ebp + 0xab4], ebx
call fcn.00475410
xor eax, eax
lea edi, [ebp + 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp + 0xab4]
mov dword [ebp + 0x60], eax
lea eax, [ebp + 0x6c]
push eax
push 0x64
push 1
lea eax, [ebp + 0x58]
push eax
push ebx
push 0x4a
push esi
mov dword [ebp + 0x58], 0xe10
mov dword [ebp + 0x5c], 0x414
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push str.Q360SafeSetup
push 1
push ebx
mov dword [0x4f7b94], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4f7b94], eax
cmp eax, ebx
je 0x458179
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x458179
push ebx
push ebx
push 0x67
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push 0x96
lea ecx, [ebp + 0x68]
call fcn.00432535
mov esi, dword [eax]
push 0xa9
lea ecx, [ebp + 0x6c]
call fcn.00432535
push 0x40
push esi
push dword [eax]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.00402963
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.00402963
lea ecx, [ebp - 0x80]
call fcn.0043d596
mov ecx, dword [ebp + 0x14ec]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0047548a
add ebp, 0x14f0
leave
ret 0x10
lea ecx, [ebp - 0x80]
call fcn.0043cdc4
test eax, eax
je 0x4582fa
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.004553bd
pop ecx
push ebx
push dword [ebp + 0x14f8]
mov esi, 0x4f7c20
push ebx
mov ecx, esi
call fcn.004559d5
push 0x4c0370
push ebx
call fcn.0047b7cd
pop ecx
pop ecx
mov ecx, 0x4f7c78
call fcn.0046a315
call fcn.00455519
test eax, eax
jne 0x45824e
push ebx
push ebx
push 0x68
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push 0x96
lea ecx, [ebp + 0x68]
call fcn.00432535
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x6c]
call fcn.00432535
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
cmp eax, 6
sete byte [ebp + 0x73]
add ecx, 0xfffffff0
call fcn.00402963
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.00402963
cmp byte [ebp + 0x73], bl
je 0x458246
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
inc ebx
jmp 0x458155
push dword [ebp + 0x1504]
push dword [ebp + 0x1500]
call fcn.00457ae6
pop ecx
pop ecx
mov dword [ebp + 0x6c], eax
call fcn.0044cbc2
push 0x4f7cb0
lea ecx, [ebp + 0x74]
call fcn.00403c36
mov edi, dword [ebp + 0x74]
cmp dword [edi - 0xc], ebx
je 0x4582dd
mov eax, dword [0x4f7cac]
cmp eax, ebx
je 0x45828f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4582ba
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4582ba
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x74]
call fcn.00414e7c
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x74]
call fcn.0040b33f
mov edi, dword [ebp + 0x74]
push edi
call fcn.00430ecb
pop ecx
mov ecx, esi
call fcn.00455ce1
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.00402963
mov ebx, dword [ebp + 0x6c]
jmp 0x458155
push str.Software360Safe
lea ecx, [ebp + 0xec8]
call fcn.0043cd51
mov esi, str.SoftwareMicrosoftWindowsCurrentVersion360Clear
push esi
lea ecx, [ebp + 0x10d4]
call fcn.0043cd51
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion360JJX
push edi
lea ecx, [ebp + 0x12e0]
call fcn.0043cd51
lea ecx, [ebp + 0xec8]
mov dword [ebp + 0x74], ebx
call fcn.0043ccdb
lea ecx, [ebp + 0x10d4]
mov dword [ebp + 0x6c], eax
call fcn.0043ccdb
lea ecx, [ebp + 0x12e0]
mov dword [ebp + 0x64], eax
call fcn.0043ccdb
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x68], eax
call fcn.0043cdc0
cmp dword [eax], ebx
jne 0x458428
cmp dword [ebp + 0x68], ebx
je 0x4583e3
push ebx
push ebx
push 0x69
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push 0x31
push 0x4c0304
push 0x4c0280
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x4583e0
call fcn.00453f85
test eax, eax
je 0x4583d7
push ebx
push ebx
push 0x6a
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
lea ecx, [ebp + 0x12e0]
call fcn.0043cd46
lea ecx, [ebp + 0x10d4]
call fcn.0043cd46
lea ecx, [ebp + 0xec8]
call fcn.0043cd46
jmp 0x458246
mov dword [ebp + 0x74], 1
jmp 0x4583e3
mov dword [ebp + 0x74], ecx
cmp dword [ebp + 0x64], ebx
jne 0x4583ed
cmp dword [ebp + 0x6c], ebx
je 0x458456
push ebx
push ebx
push 0x6b
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push 0x31
push 0x4c0304
push 0x4c0228
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x458456
push ebx
push ebx
push 0x6c
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push ebx
jmp 0x458449
cmp dword [ebp + 0x64], ebx
jne 0x458437
cmp dword [ebp + 0x68], ebx
jne 0x458437
cmp dword [ebp + 0x6c], ebx
je 0x458456
push ebx
push ebx
push 0x6c
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push 2
call fcn.004699f3
mov dword [ebp + 0x74], 1
pop ecx
push str.Software360Safe
lea ecx, [ebp + 0x78]
call fcn.0043cd51
push esi
lea ecx, [ebp + 0x490]
call fcn.0043cd51
push edi
lea ecx, [ebp + 0x69c]
call fcn.0043cd51
push ebx
push esi
lea ecx, [ebp + 0x8a8]
call fcn.0043cd72
push ebx
push edi
lea ecx, [ebp + 0x284]
call fcn.0043cd72
push ebx
lea ecx, [ebp + 0xcbc]
cmp dword [ebp + 0x74], ebx
je 0x4584a4
push esi
jmp 0x4584a5
push edi
call fcn.0043cd72
lea ecx, [ebp + 0xcbc]
call fcn.0043cd46
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.004553bd
pop ecx
push ebx
push dword [ebp + 0x14f8]
mov esi, 0x4f7c20
push ebx
mov ecx, esi
call fcn.004559d5
push 0x4c0370
push ebx
call fcn.0047b7cd
pop ecx
pop ecx
mov ecx, 0x4f7c78
call fcn.0046a315
call fcn.00455519
test eax, eax
jne 0x4585af
push ebx
push ebx
push 0x68
call fcn.00402eb7
mov ecx, eax
call fcn.00402f48
push 0x96
lea ecx, [ebp + 0x68]
call fcn.00432535
mov esi, dword [eax]
push 0xab
lea ecx, [ebp + 0x6c]
call fcn.00432535
mov eax, dword [eax]
push 4
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x6c]
cmp eax, 6
sete byte [ebp + 0x73]
add ecx, 0xfffffff0
call fcn.00402963
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.00402963
cmp byte [ebp + 0x73], bl
je 0x458576
push 1
push ebx
push ebx
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 0x284]
call fcn.0043cd46
lea ecx, [ebp + 0x8a8]
call fcn.0043cd46
lea ecx, [ebp + 0x69c]
call fcn.0043cd46
lea ecx, [ebp + 0x490]
call fcn.0043cd46
lea ecx, [ebp + 0x78]
call fcn.0043cd46
jmp 0x4583b1
lea ecx, [ebp + 0x5c]
call fcn.0046eb3e
push dword [ebp + 0x1504]
push dword [ebp + 0x1500]
call fcn.00457ae6
pop ecx
pop ecx
mov dword [ebp + 0x6c], eax
call fcn.0044cbc2
push 0x4f7cb0
lea ecx, [ebp + 0x74]
call fcn.00403c36
mov edi, dword [ebp + 0x74]
cmp dword [edi - 0xc], ebx
je 0x458646
mov eax, dword [0x4f7cac]
cmp eax, ebx
je 0x4585f8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x458623
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x458623
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0x74]
call fcn.00414e7c
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x74]
call fcn.0040b33f
mov edi, dword [ebp + 0x74]
push edi
call fcn.00430ecb
pop ecx
mov ecx, esi
call fcn.00455ce1
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [edi - 0x10]
call fcn.00402963
lea ecx, [ebp + 0x5c]
call fcn.0046eb27
lea ecx, [ebp + 0x284]
call fcn.0043cd46
lea ecx, [ebp + 0x8a8]
call fcn.0043cd46
lea ecx, [ebp + 0x69c]
call fcn.0043cd46
lea ecx, [ebp + 0x490]
call fcn.0043cd46
lea ecx, [ebp + 0x78]
call fcn.0043cd46
lea ecx, [ebp + 0x12e0]
call fcn.0043cd46
lea ecx, [ebp + 0x10d4]
call fcn.0043cd46
lea ecx, [ebp + 0xec8]
call fcn.0043cd46
jmp 0x4582f2