Function at 0x42fd80
Capabilities:
Check for time delay via gettickcount
Check if file exists
Delete file
Delete service
Get common file path
Move file
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5a32b8
mov eax, dword fs:[0]
push eax
sub esp, 0x780
mov eax, dword [0x61ac94]
xor eax, esp
mov dword [esp + 0x77c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61ac94]
xor eax, esp
push eax
lea eax, [esp + 0x794]
mov dword fs:[0], eax
mov dword [esp + 0x2c], ecx
mov bl, byte [esp + 0x7a4]
test bl, bl
je 0x42ffbc
push 0
call fcn.0047b4a0
add esp, 4
test eax, eax
jne 0x42ffbc
mov ecx, 0x15
mov esi, 0x5c07e8
lea edi, [esp + 0x530]
rep movsd dword es:[edi], dword [esi]
push 4
lea eax, [esp + 0x2c]
push eax
push 4
push 0x5beb80
lea ecx, [esp + 0x540]
push ecx
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, 3
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], ebx
mov dword [esp + 0x30], 1
call esi
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push 0x5beab0
lea eax, [esp + 0x540]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x592]
push edx
mov word [esp + 0x594], cx
call fcn.004e5fc0
add esp, 0xc
push 0x104
lea eax, [esp + 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers360AvFlt.sys
push 0x208
lea ecx, [esp + 0x590]
push ecx
call fcn.0041c780
push 4
push 0
lea edx, [esp + 0x590]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x24]
call fcn.0044e0a0
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x7a0], 0
call fcn.0044fe00
call fcn.00418b00
test eax, eax
je 0x42ffa1
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0040e2c0
push str.WscControl.exe
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x7b0], 1
call fcn.0040d150
add esp, 0x14
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x79c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ff1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42ff79
mov edx, dword [esp + 0x14]
push edx
call fcn.004887d0
add esp, 4
test eax, eax
je 0x42ff79
call fcn.004781a0
test eax, eax
je 0x42ff60
call fcn.00478410
test eax, eax
jne 0x42ff60
push 0x3e8
push eax
mov eax, dword [esp + 0x1c]
push str._unregav__unregas
push eax
jmp 0x42ff71
mov ecx, dword [esp + 0x14]
push 0x3e8
push 0
push str._unregav
push ecx
call fcn.00476eb0
add esp, 0x10
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x79c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ffa1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x79c], 0xffffffff
call fcn.0044e0b0
mov bl, byte [esp + 0x7a4]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebp, eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sub eax, ebp
cmp eax, 0x7530
jae 0x430031
push 0
call fcn.0047b4a0
add esp, 4
test eax, eax
je 0x430031
lea ecx, [esp + 0x30]
call fcn.0048ed90
xor ecx, ecx
test bl, bl
sete cl
mov dword [esp + 0x79c], 4
inc ecx
push ecx
lea ecx, [esp + 0x34]
call fcn.00491390
push 0x3e8
call edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x79c], 0xffffffff
call fcn.00418900
call esi
sub eax, ebp
cmp eax, 0x7530
jb 0x42ffd7
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
xor ebx, ebx
push ebx
push str.Q360SDClass
call esi
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x430072
jmp 0x430050
mov edx, ebx
inc ebx
cmp edx, 5
jge 0x430072
push 0
push 0
push 0x12
push eax
call ebp
push 0x64
call edi
push 0
push str.Q360SDClass
call esi
test eax, eax
jne 0x430050
push 0
push str.Q360DepClass
call esi
test eax, eax
je 0x430088
push 0
push 0
push 0x12
push eax
call ebp
call fcn.00478410
test eax, eax
jne 0x430132
push eax
push str.Q360SafeMonClass
call esi
test eax, eax
je 0x4300b0
push 0x168
push 0x168
push 0x10
push eax
call ebp
push 0
push str.Q360FWMainClass
call esi
test eax, eax
je 0x4300c6
push 0
push 0
push 0x10
push eax
call ebp
lea ecx, [esp + 0x14]
call fcn.00496510
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.360tray.exe
mov dword [esp + 0x7a8], 5
call fcn.0040e080
lea ecx, [esp + 0x1c]
call fcn.00496760
cmp eax, 0xffffffff
je 0x430105
push eax
lea ecx, [esp + 0x18]
call fcn.00496610
mov dword [esp + 0x18], vtable.C360KrnlSvcHelper.0
lea ecx, [esp + 0x18]
mov byte [esp + 0x79c], 6
call fcn.0041df20
lea ecx, [esp + 0x14]
mov dword [esp + 0x79c], 0xffffffff
call fcn.00496520
push str.360sd.exe_360rp.exe_360rps.exe_360Quart.exe_360Restore.exe__t_t_t_t_t_t_t_tLiveUpdate360.exe_360sdupd.exe_360nq.exe__t_t_t_t_t_t_t_t360QBack.exe_ProcTree.exe_feedback.exe__t_t_t_t_t_t_t_t360FileGuard.exe_PopWndTracker.exe_dep360.exe__t_t_t_t_t_t_t_t360QMachine.exe_xpbackup.exe
lea ecx, [esp + 0x20]
call fcn.0040e080
mov ebx, 7
lea ecx, [esp + 0x20]
mov dword [esp + 0x79c], ebx
call fcn.00496510
mov eax, dword [esp + 0x1c]
push 0
push 1
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
mov byte [esp + 0x7ac], 8
call fcn.0040c050
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esi], eax
call fcn.00496b50
lea ecx, [esp + 0x20]
mov byte [esp + 0x79c], bl
call fcn.00496520
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x79c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4301c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x4301e9
push 0x10000
push str.360rp
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp byte [esp + 0x7a4], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x430204
test esi, esi
je 0x43020b
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test esi, esi
je 0x43020b
push esi
call ebx
test edi, edi
je 0x430212
push edi
call ebx
mov ecx, dword [esp + 0x2c]
call fcn.0042f7c0
mov ecx, dword [esp + 0x794]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x77c]
xor ecx, esp
call fcn.004e5fb0
add esp, 0x78c
ret 4