Function at 0x457cb5
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x74
mov eax, 0x4b23ab
call fcn.00476610
mov esi, ecx
xor edi, edi
mov ebx, edx
mov dword [ebp - 0x28], ebx
cmp esi, edi
jne 0x457d0b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004755ea
add ebp, 0x414
leave
ret
call fcn.0045f45e
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402530
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], edi
call fcn.0043ce97
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp - 0x2c]
call fcn.0043d4ce
push 0xe10
call fcn.00456551
pop ecx
mov ecx, esi
call fcn.00462e4c
test eax, eax
jne 0x457d79
push edi
push edi
push 0x76
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
mov dword [ebx], 1
jmp 0x457ce6
call fcn.0046d1dd
xor ebx, ebx
inc ebx
test eax, eax
je 0x457dc7
mov ecx, dword [ebp - 0x2c]
call fcn.0043cc82
test eax, eax
je 0x457dc7
lea ecx, [ebp - 0x80]
call fcn.0044ff42
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x80]
call fcn.004568df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
cmp eax, 0xb
je 0x457dc2
call fcn.0044ff14
jmp 0x457ce6
call fcn.0044ff14
call fcn.00456aed
call fcn.004560b1
mov ecx, esi
call fcn.0045f3a3
cmp eax, edi
je 0x457ce6
mov ecx, esi
call fcn.0045f3cd
cmp eax, ebx
je 0x457df8
cmp eax, 2
je 0x457df8
mov dword [ebp - 0x10], edi
cmp eax, 3
jne 0x457dfb
mov dword [ebp - 0x10], ebx
push 0x284e
lea ecx, [ebp - 0x18]
call fcn.004323e4
push dword [eax]
call fcn.004777cd
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
call fcn.00402870
mov ecx, esi
call fcn.0045f3a7
cmp eax, edi
je 0x457e42
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
cmp eax, dword [ebp - 0x14]
je 0x457e42
cmp dword [ebp - 0x10], edi
je 0x457e42
push 4
mov ecx, esi
call fcn.0045f3d4
push esi
call fcn.0045615e
pop ecx
mov ecx, esi
call fcn.0045f429
test eax, eax
jne 0x457e74
mov ecx, esi
call fcn.00457363
test eax, eax
je 0x457e74
push edi
push edi
push 0x7d
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
jmp 0x457ce6
mov ecx, esi
call fcn.00457201
test eax, eax
je 0x457e85
push edi
push edi
push 0x7e
jmp 0x457e63
mov ecx, esi
call fcn.00456f5c
test eax, eax
je 0x457e99
push edi
push edi
push 0xd5
jmp 0x457e63
push 0x4f9e18
lea ecx, [ebp - 0x1c]
call fcn.0040284b
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.00460e88
mov ecx, esi
call fcn.0045f93b
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x457edf
push dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x2c]
call fcn.0043cc96
push dword [eax]
call fcn.00455e6b
pop ecx
lea ecx, [ebp - 0x20]
call fcn.0043e0d3
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0043e55c
test eax, eax
jne 0x457f24
push edi
push edi
push 0x7f
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0043e0dc
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402870
jmp 0x457ce6
push esi
call fcn.00456930
pop ecx
test eax, eax
je 0x457f38
push edi
push edi
push 0x80
jmp 0x457efc
call fcn.00455f21
test eax, eax
je 0x457fa8
push edi
push edi
push 0x81
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x96
lea ecx, [ebp - 0x10]
call fcn.004323e4
mov dword [ebp - 0x14], eax
push pe_nt_image_headers32
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.004323e4
push ebx
mov byte [ebp - 4], 5
push 0x30
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov eax, dword [eax]
push ecx
push eax
push edi
mov ecx, esi
call fcn.004606bc
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402870
jmp 0x457f08
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x45803a
push edi
push edi
push 0x82
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
mov eax, dword [ebp - 0x28]
mov ecx, esi
mov dword [eax], ebx
call fcn.0045f429
test eax, eax
je 0x45800d
call fcn.00456c3d
test eax, eax
je 0x457f08
push 0x96
lea ecx, [ebp - 0x10]
call fcn.004323e4
mov dword [ebp - 0x14], eax
push 0xa8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.004323e4
mov byte [ebp - 4], 7
jmp 0x458032
push 0x96
lea ecx, [ebp - 0x10]
call fcn.004323e4
mov dword [ebp - 0x14], eax
push 0xa7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.004323e4
mov byte [ebp - 4], 9
push ebx
push 0x40
jmp 0x457f7c
call fcn.004562ba
test eax, eax
je 0x4580b9
mov ecx, dword [ebp - 0x2c]
call fcn.0043d1bb
test eax, eax
jne 0x4580b9
push 0x4c1188
lea ecx, [ebp - 0x10]
call fcn.00402530
push edi
push edi
push 0x83
mov byte [ebp - 4], 0xa
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x96
lea ecx, [ebp - 0x14]
call fcn.004323e4
mov eax, dword [eax]
push ebx
push 0x40
push eax
push dword [ebp - 0x10]
mov ecx, esi
push edi
mov byte [ebp - 4], 0xb
call fcn.004606bc
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402870
push ebx
push edi
push edi
push str.https:__dl.360safe.com_instbeta.exe
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x457f98
mov ecx, esi
call fcn.0045f429
mov ecx, esi
test eax, eax
je 0x4580fd
call fcn.0045f430
test eax, eax
jne 0x45860a
push 0x96
lea ecx, [ebp - 0x10]
call fcn.004323e4
mov dword [ebp - 0x14], eax
push 0x97
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.004323e4
mov byte [ebp - 4], 0xd
jmp 0x458032
call fcn.0045f45e
mov ecx, eax
call fcn.0043cc20
test eax, eax
je 0x458290
mov ecx, esi
call fcn.0045f3cd
test eax, eax
jne 0x458159
push edi
push edi
push 0x84
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x96
lea ecx, [ebp - 0x10]
call fcn.004323e4
mov dword [ebp - 0x14], eax
push 0xb8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xe
call fcn.004323e4
mov byte [ebp - 4], 0xf
jmp 0x458032
mov ecx, esi
call fcn.0045f3cd
cmp eax, 3
jne 0x4581a2
push edi
push edi
push 0x85
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x96
lea ecx, [ebp - 0x10]
call fcn.004323e4
mov dword [ebp - 0x14], eax
push 0x92
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x10
call fcn.004323e4
mov byte [ebp - 4], 0x11
jmp 0x458032
mov ecx, esi
call fcn.0045f3cd
cmp eax, 4
jne 0x4581eb
push edi
push edi
push 0x86
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0x96
lea ecx, [ebp - 0x10]
call fcn.004323e4
mov dword [ebp - 0x14], eax
push 0x257
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x12
call fcn.004323e4
mov byte [ebp - 4], 0x13
jmp 0x458032
push 0x4f9e18
lea ecx, [ebp - 0x28]
call fcn.0040284b
push 0x920
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.004024ec
push 0x4b9cb8
lea ecx, [ebp - 0x28]
call fcn.0040cdc8
test eax, eax
jne 0x45826d
push 0x96
lea ecx, [ebp - 0x24]
call fcn.004323e4
mov dword [ebp - 0x14], eax
push 0xac
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x15
call fcn.004323e4
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov eax, dword [eax]
push ebx
push 0x40
push ecx
push eax
push edi
mov ecx, esi
mov byte [ebp - 4], 0x16
call fcn.004606bc
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x14
call fcn.00402870
mov ecx, esi
call fcn.0045f40d
mov ecx, esi
mov dword [eax], edi
call fcn.0045f414
mov ecx, esi
mov dword [eax], edi
call fcn.0045f41b
mov ecx, dword [ebp - 0x28]
mov dword [eax], ebx
jmp 0x4585b3
push esi
call fcn.00456c76
pop ecx
test eax, eax
jne 0x4582b8
push edi
push edi
push 0xb4
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
mov eax, dword [ebp - 0x28]
mov dword [eax], ebx
jmp 0x457f08
mov ecx, esi
call fcn.0045f3cd
test eax, eax
jne 0x4582ed
push 0x4c1134
push str.SOFTWARE360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x4d8dc0
push str.SOFTWARE360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, esi
call fcn.0045f3cd
cmp eax, edi
je 0x4585c1
jle 0x45860a
cmp eax, 2
jle 0x4583ce
cmp eax, 3
je 0x4583ab
cmp eax, 4
jne 0x45860a
push 0x257
lea ecx, [ebp - 0x30]
call fcn.004323e4
push dword [eax]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1a
call fcn.00402530
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x1c
call fcn.00402870
push 0x96
lea ecx, [ebp - 0x38]
call fcn.004323e4
mov eax, dword [eax]
push 0x40
push eax
push dword [ebp - 0x24]
mov ecx, esi
push edi
mov byte [ebp - 4], 0x1d
call fcn.00460763
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x1c
call fcn.00402870
push 0xe18
call fcn.00456551
pop ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402870
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0043e0dc
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402870
mov eax, edi
jmp 0x457ce8
push edi
push edi
push 0x85
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0xe18
call fcn.00456551
pop ecx
jmp 0x45860a
mov ecx, esi
mov dword [ebp - 0x18], edi
call fcn.0045f3cd
cmp eax, 2
jne 0x4583e3
push edi
push edi
push 0x72
jmp 0x4583f2
mov ecx, esi
call fcn.0045f3cd
cmp eax, ebx
jne 0x4583fe
push edi
push edi
push 0x73
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0xe11
call fcn.00456551
mov dword [esp], str.Close_self_protect.
lea eax, [ebp - 0x3c]
push 0x4f7cd0
push eax
call fcn.00403a6b
push dword [eax]
mov byte [ebp - 4], 0x17
call fcn.00404d91
mov ecx, dword [ebp - 0x3c]
add esp, 0x10
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00402870
call fcn.0046972a
test eax, eax
je 0x458463
push edi
push edi
push 0x6e
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push str.cur_process_has_protect.
mov dword [ebp - 0x24], ebx
call fcn.00404d91
pop ecx
jmp 0x458479
lea eax, [ebp - 0x18]
push eax
push edi
mov ecx, esi
call fcn.0045f406
mov ecx, eax
call fcn.00436af2
mov dword [ebp - 0x24], eax
push str.Close_self_protect.
lea eax, [ebp - 0x34]
push 0x4f7cd4
push eax
call fcn.00403a6b
push dword [eax]
mov byte [ebp - 4], 0x18
call fcn.00404d91
mov ecx, dword [ebp - 0x34]
add esp, 0x10
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00402870
cmp dword [ebp - 0x24], edi
je 0x4584c9
push edi
push edi
push 0x71
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0xe12
call fcn.00456551
pop ecx
cmp dword [ebp - 0x18], edi
je 0x45851d
push edi
push edi
push 0x87
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
mov eax, dword [ebp - 0x28]
mov ecx, esi
mov dword [eax], ebx
call fcn.00456d81
push 0xe18
call fcn.00456551
mov esi, dword [ebp - 0x10]
pop ecx
cmp esi, edi
je 0x457f08
mov ecx, dword [ebp - 0x2c]
call fcn.0043cc96
mov eax, dword [eax]
mov ecx, dword [esi]
push ebx
push eax
push esi
call dword [ecx + 0x84]
jmp 0x457f08
cmp dword [ebp - 0x24], edi
jne 0x45853c
push edi
push edi
push 0xa8
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
push 0xe13
jmp 0x4584f2
xor eax, eax
push 0x40e
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call fcn.00475570
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x28]
push eax
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
neg esi
sbb esi, esi
push 0x4f9e18
lea ecx, [ebp - 0x24]
inc esi
call fcn.0040284b
xor eax, eax
cmp esi, edi
sete al
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x24]
push str.ex_d
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x24]
add esp, 0xc
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00402870
jmp 0x45860a
mov ecx, esi
call fcn.0045f45e
mov ecx, eax
call fcn.0043cc24
mov eax, dword [eax]
cmp dword [eax - 0xc], edi
je 0x4585fa
mov ecx, esi
call fcn.0045f45e
mov ecx, eax
call fcn.0043cc24
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.0045f3af
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00401c8e
jmp 0x45860a
push esi
call fcn.004576f0
pop ecx
test eax, eax
jne 0x45860a
mov eax, dword [ebp - 0x28]
mov dword [eax], ebx
mov esi, dword [ebp - 0x10]
cmp esi, edi
je 0x458626
mov ecx, dword [ebp - 0x2c]
call fcn.0043cc96
mov eax, dword [eax]
mov ecx, dword [esi]
push ebx
push eax
push esi
call dword [ecx + 0x84]
push ebx
call fcn.00455e55
pop ecx
push edi
push edi
push 0x93
call fcn.00402d9c
mov ecx, eax
call fcn.00402e2d
mov edi, ebx
jmp 0x45838d