Function at 0x406de0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete directory
Delete file
Delete registry key
Delete registry value
Get common file path
Move file
Persist via run registry key
Persist via windows service
Self delete
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x48b00b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcb8
push ebx
push ebp
mov dword [esp + 0x28], ecx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.004222a0
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x9a]
mov word [esp + 0x98], bx
mov word [esp + 0x4a8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4aa]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x4ac]
mov dword [esp + 0xcd4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0xcd8]
mov esi, dword [sym.imp.MSVCRT.dll_wcsncpy]
push 0x104
lea edx, [esp + 0x9c]
push ecx
push edx
call esi
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [esp + eax*2 + 0xa6]
add esp, 0x10
cmp word [eax], 0x5c
jne 0x406e9a
mov word [eax], bx
mov ebp, dword [sym.imp.MSVCRT.dll_wcsncat]
mov edi, 0x4afdc0
mov ecx, edi
mov dword [esp + 0x34], edi
test ecx, ecx
mov dword [esp + 0x38], str._bdagent.exe
mov dword [esp + 0x3c], str._bdwizreg.exe
mov dword [esp + 0x40], str._seccenter.exe
mov dword [esp + 0x44], str.uiscan.exe
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], str._vsserv.exe
mov dword [esp + 0x50], ebx
je 0x406f4a
lea edx, [esp + 0x34]
mov dword [esp + 0x10], edx
lea eax, [esp + 0x98]
push 0x104
lea ecx, [esp + 0x2a4]
push eax
push ecx
call esi
push 0x14
lea edx, [esp + 0x2b0]
push edi
push edx
call ebp
add esp, 0x14
lea eax, [esp + 0x2a4]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004222e0
cmp eax, 0xffffffff
je 0x406f39
push eax
lea ecx, [esp + 0x18]
call fcn.00422570
mov eax, dword [esp + 0x10]
add eax, 4
mov dword [esp + 0x10], eax
mov edi, dword [eax]
cmp edi, ebx
jne 0x406ee7
mov ecx, 0x185
xor eax, eax
lea edi, [esp + 0x6b2]
mov word [esp + 0x6b0], bx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4a8]
push 0x104
lea edx, [esp + 0x6b4]
push ecx
push edx
stosw word es:[edi], ax
call esi
push 0x101
lea eax, [esp + 0x6c4]
push str.Program_FilesCommon_Files360safeBitDefender_Communicatorxcommsvr.exe
push eax
call esi
lea ecx, [esp + 0x4c0]
push 0x104
lea edx, [esp + 0x8d4]
push ecx
push edx
call esi
push 0x101
lea eax, [esp + 0x8e4]
push str.Program_FilesCommon_Files360safeBitDefender_Update_Servicelivesrv.exe
push eax
call esi
lea ecx, [esp + 0xc8]
push 0x104
lea edx, [esp + 0xaf4]
push ecx
push edx
call esi
push 0x14
lea eax, [esp + 0xb00]
push str.360sdshell.dll
push eax
call ebp
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xa0]
add esp, 0x48
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x24], ecx
mov word [esp + 0x84], 5
lea ebx, [esp + 0x6b0]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ebx
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004222e0
cmp eax, 0xffffffff
je 0x407049
push eax
lea ecx, [esp + 0x18]
call fcn.00422570
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a2]
mov word [esp + 0x2a0], 0
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edi, eax
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 2
jge 0x4070b1
push edi
lea edx, [esp + 0x2a6]
push ebx
push edx
call esi
mov eax, 0x22
push 0xb
mov word [esp + 0x2b0], ax
mov word [esp + edi*2 + 0x2b2], ax
lea eax, [esp + 0x2b0]
push str.__uninstall
push eax
call ebp
add esp, 0x18
jmp 0x4070e9
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x104
lea ecx, [esp + 0x2a4]
push str.regsvr32__u__s__
push ecx
call esi
push edi
lea edx, [esp + 0x2d0]
push ebx
push edx
call esi
add esp, 0x18
mov word [esp + edi*2 + 0x2c0], 0x22
lea eax, [esp + 0x18]
lea ecx, [esp + 0x54]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x2bc]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407134
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x18]
push edx
call edi
mov eax, dword [esp + 0x10]
add ebx, 0x208
inc eax
cmp eax, 3
mov dword [esp + 0x10], eax
jl 0x407024
lea eax, [esp + 0x2c]
push 4
push eax
push 4
push str.DeleteFlag
push str.SYSTEMCurrentControlSetServicesVSSERV
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x44], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.SOFTWAREBitDefender
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.bdagent
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [esp + 0x98]
push ecx
call fcn.004074b0
mov ecx, dword [esp + 0x34]
add esp, 4
lea edx, [esp + 0x98]
push edx
call fcn.004072d0
lea eax, [esp + 0x4a8]
push 0x104
lea ecx, [esp + 0x9c]
push eax
push ecx
call esi
push 0x101
lea edx, [esp + 0xac]
push str.Program_FilesCommon_Files360safe
push edx
call esi
lea eax, [esp + 0xb0]
push eax
call fcn.004074b0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0x1c
lea ecx, [esp + 0x98]
push 0
push 0x17
push ecx
push 0
call esi
push 0xa
lea edx, [esp + 0x9c]
push 0x4afa54
push edx
call ebp
lea eax, [esp + 0xa4]
push eax
call fcn.004074b0
add esp, 0x10
lea ecx, [esp + 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
lea edx, [esp + 0x9c]
push 0x19
push edx
push 0
call esi
push 0x14
lea eax, [esp + 0x9c]
push 0x4afa38
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
lea ecx, [esp + 0x98]
push ecx
call edi
push 0
lea edx, [esp + 0x9c]
push 0x19
push edx
push 0
call esi
push 0x14
lea eax, [esp + 0x9c]
push 0x4afa20
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x98]
push ecx
call edi
lea ecx, [esp + 0x14]
mov dword [esp + 0xcd0], 0xffffffff
call fcn.004222d0
mov ecx, dword [esp + 0xcc8]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xcc4
ret 4