Function at 0x417f60
Capabilities:
Create process on windows
Delete file
Delete registry key
Delete registry value
Get common file path
Move file
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x5a0f3b
mov eax, dword fs:[0]
push eax
sub esp, 0xcb4
mov eax, dword [0x61ac94]
xor eax, esp
mov dword [esp + 0xcb0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61ac94]
xor eax, esp
push eax
lea eax, [esp + 0xcc8]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
mov esi, dword [esp + 0xcd8]
lea ecx, [esp + 0x14]
call fcn.00496510
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x9a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0xcdc], ebx
mov word [esp + 0xa0], ax
call fcn.004e5fc0
push 0x206
lea eax, [esp + 0x4b6]
xor edx, edx
push ebx
push eax
mov word [esp + 0x4bc], dx
call fcn.004e5fc0
add esp, 0x18
push 0x103
lea ecx, [esp + 0x4a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
lea edx, [esp + 0x98]
push esi
push edx
call fcn.004e6b69
lea eax, [esp + 0xa0]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x418030
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x418030
sub eax, edx
sar eax, 1
lea eax, [esp + eax*2 + 0x92]
mov ecx, 0x5c
cmp cx, word [eax]
jne 0x418055
xor edx, edx
mov word [eax], dx
mov esi, str.360sd.exe
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], str._bdagent.exe
mov dword [esp + 0x38], str._bdwizreg.exe
mov dword [esp + 0x3c], str._seccenter.exe
mov dword [esp + 0x40], str.uiscan.exe
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], str._vsserv.exe
mov dword [esp + 0x4c], ebx
xor edi, edi
push 0x104
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x2a4]
push ecx
call fcn.004e6b69
push 0x14
lea edx, [esp + 0x2ac]
push esi
push edx
call fcn.004e6b29
add esp, 0x14
lea eax, [esp + 0x2a0]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0040e080
lea ecx, [esp + 0x18]
call fcn.004969f0
cmp eax, 0xffffffff
je 0x4180e8
push eax
lea ecx, [esp + 0x18]
call fcn.00496610
mov esi, dword [esp + edi*4 + 0x34]
inc edi
cmp esi, ebx
jne 0x418090
push 0x616
lea edx, [esp + 0x6b2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x6b8], cx
call fcn.004e5fc0
push 2
lea eax, [esp + 0x4b4]
push eax
lea ecx, [esp + 0x6c0]
push ecx
call fcn.004e6b69
push 0xff
lea edx, [esp + 0x6cc]
push str.Program_FilesCommon_Files360safeBitDefender_Communicatorxcommsvr.exe
push edx
call fcn.004e6b69
push 2
lea eax, [esp + 0x4cc]
push eax
lea ecx, [esp + 0x8e0]
push ecx
call fcn.004e6b69
push 0xff
lea edx, [esp + 0x8ec]
push str.Program_FilesCommon_Files360safeBitDefender_Update_Servicelivesrv.exe
push edx
call fcn.004e6b69
push 2
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0xb00]
push ecx
call fcn.004e6b69
add esp, 0x48
push 0x14
lea edx, [esp + 0xac0]
push str.360sdshell.dll
push edx
call fcn.004e6b29
push 0x40
lea eax, [esp + 0x64]
push ebx
push eax
call fcn.004e5fc0
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0x18
xor eax, eax
mov ecx, 5
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x50], 0x44
mov word [esp + 0x80], cx
lea edi, [esp + 0x6ac]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edi
call fcn.0040e080
lea ecx, [esp + 0x18]
call fcn.004969f0
cmp eax, 0xffffffff
je 0x418201
push eax
lea ecx, [esp + 0x18]
call fcn.00496610
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x2a6]
push eax
mov word [esp + 0x2a8], dx
call fcn.004e5fc0
mov eax, edi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418226
sub eax, edx
sar eax, 1
cmp ebx, 2
mov esi, eax
jge 0x418278
push esi
lea ecx, [esp + 0x2a2]
push edi
push ecx
call fcn.004e6b69
mov edx, 0x22
push 0xb
lea ecx, [esp + 0x2ac]
mov eax, edx
push str.__uninstall
mov word [esp + 0x2b0], dx
push ecx
mov word [esp + esi*2 + 0x2b6], ax
call fcn.004e6b29
jmp 0x4182b2
push 4
push 0
push edi
call ebp
push 0x104
lea edx, [esp + 0x2a0]
push str.regsvr32__u__s__
push edx
call fcn.004e6b69
push esi
lea eax, [esp + 0x2cc]
push edi
push eax
call fcn.004e6b69
mov ecx, 0x22
mov word [esp + esi*2 + 0x2d4], cx
add esp, 0x18
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2bc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x418300
mov edx, dword [esp + 0x20]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
inc ebx
add edi, 0x208
cmp ebx, 3
jl 0x4181dc
push str.SOFTWAREBitDefender
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.bdagent
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea edx, [esp + 0x94]
push edx
call fcn.00417cd0
mov ecx, dword [esp + 0x1c]
add esp, 4
lea eax, [esp + 0x94]
push eax
call fcn.00417ab0
push 2
lea ecx, [esp + 0x4a8]
push ecx
lea edx, [esp + 0x9c]
push edx
call fcn.004e6b69
push 0xff
lea eax, [esp + 0xa8]
push str.Program_FilesCommon_Files360safe
push eax
call fcn.004e6b69
lea ecx, [esp + 0xac]
push ecx
call fcn.00417cd0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0x1c
push 0
push 0x17
lea edx, [esp + 0x9c]
push edx
push 0
call esi
push 0xa
lea eax, [esp + 0x98]
push 0x5bdad8
push eax
call fcn.004e6b29
lea ecx, [esp + 0xa0]
push ecx
call fcn.00417cd0
add esp, 0x10
lea edx, [esp + 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0x19
lea eax, [esp + 0x9c]
push eax
push 0
call esi
push 0x14
lea ecx, [esp + 0x98]
push 0x5bdabc
push ecx
call fcn.004e6b29
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
lea edx, [esp + 0x94]
push edx
call edi
push 0
push 0x19
lea eax, [esp + 0x9c]
push eax
push 0
call esi
push 0x14
lea ecx, [esp + 0x98]
push 0x5bdaa4
push ecx
call fcn.004e6b29
add esp, 0xc
lea edx, [esp + 0x94]
push edx
call edi
mov dword [esp + 0xcd0], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00496520
mov eax, 1
mov ecx, dword [esp + 0xcc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xcb0]
xor ecx, esp
call fcn.004e5fb0
add esp, 0xcc0
ret 4