Function at 0x42d9a3
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push 0x290
mov eax, 0x502a32
call fcn.004df416
mov eax, dword [ebp + 8]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x280], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x278]
call fcn.004037c8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x27c]
call fcn.004037c8
mov byte [ebp - 4], 2
mov esi, 0x5af3f8
mov dword [ebp - 0x29c], esi
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x280]
mov edi, 0x5af400
push edi
call fcn.004013dd
push edi
lea ecx, [ebp + 0xc]
call fcn.004036be
test eax, eax
jne 0x42da51
mov byte [ebp - 4], 2
mov dword [ebp - 0x29c], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x27c]
call fcn.004010f8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x278]
call fcn.004010f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004010f8
xor eax, eax
call fcn.004df460
ret 0xc
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x26c]
push eax
push str.SOFTWAREClassesApplicationsiexplore.exe_shellopencommand
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x288], 0x258
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x26c]
push eax
mov dword [ebp - 0x270], ebx
call fcn.004d9ab0
test eax, eax
pop ecx
jle 0x42dabf
mov eax, dword [ebp - 0x270]
lea eax, [ebp + eax - 0x26c]
cmp byte [eax], 0x25
jne 0x42daa4
mov byte [eax], bl
inc dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
push eax
call fcn.004d9ab0
cmp dword [ebp - 0x270], eax
pop ecx
jl 0x42da90
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x278]
call fcn.004013dd
push edi
lea ecx, [ebp - 0x278]
call fcn.004036be
test eax, eax
jne 0x42db08
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push str.Whitebox_download:_ieloc_is_null
call fcn.004014b0
mov byte [ebp - 4], 4
push 1
mov byte [ebp - 4], 3
call fcn.004066ca
jmp 0x42da14
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.0040350d
add esp, 0xc
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x27c]
call fcn.004038a3
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x270]
call fcn.004010f8
push 6
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edi, eax
cmp edi, 0x1f
ja 0x42dbac
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push str.CWhiteBox::Download
call fcn.004014b0
mov byte [ebp - 4], 6
push 0x35
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
push str..WhiteBox.cpp
call fcn.004014b0
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push str.WinExec_failed
call fcn.004014b0
mov byte [ebp - 4], 8
push edi
mov byte [ebp - 4], 3
call fcn.00406096
jmp 0x42da14
push ebx
push 0x3f
lea ecx, [ebp + 0xc]
call fcn.0042d92e
cmp eax, ebx
jle 0x42dbe7
push eax
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040f236
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp + 0xc]
call fcn.004038a3
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x270]
call fcn.004010f8
mov edi, dword [ebp - 0x274]
mov dword [ebp - 0x270], ebx
add edi, 4
lea eax, [ebp - 0x284]
push eax
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.004037f2
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.0042e7b0
cmp al, bl
jne 0x42dc3b
cmp dword [ebp - 0x270], 0x64
jge 0x42dc42
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x270]
jmp 0x42dbf6
cmp dword [ebp - 0x270], 0x64
jne 0x42dc60
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push str.timeout_waiting_for_window
call fcn.004014b0
mov byte [ebp - 4], 0xb
jmp 0x42daf8
push dword [ebp - 0x284]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42dc7b
push dword [ebp - 0x284]
call fcn.0043e86b
push edi
call fcn.0042ef12
test al, al
jne 0x42dce3
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push str.timeout_waiting_for_document
call fcn.004014b0
mov byte [ebp - 4], 0xc
push 1
mov byte [ebp - 4], 3
call fcn.004066ca
xor edi, edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x29c], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x27c]
call fcn.004010f8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x278]
call fcn.004010f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004010f8
mov eax, edi
jmp 0x42da49
push dword [ebp - 0x280]
lea eax, [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.004037f2
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.0042eb0e
cmp al, bl
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
je 0x42dd35
push str.whitebox_download_successful
call fcn.004014b0
mov byte [ebp - 4], 0xe
push 2
mov byte [ebp - 4], 3
call fcn.004066ca
xor edi, edi
inc edi
jmp 0x42dd80
push str.CWhiteBox::Download
call fcn.004014b0
mov byte [ebp - 4], 0xf
push 0x5f
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
push str..WhiteBox.cpp
call fcn.004014b0
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push str.get_body_failed
call fcn.004014b0
mov byte [ebp - 4], 0x11
push 1
mov byte [ebp - 4], 3
call fcn.00406096
xor edi, edi
cmp dword [ebp - 0x284], ebx
je 0x42dca9
push ebx
push ebx
push 0x10
push dword [ebp - 0x284]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x42dca9