Function at 0x42aa60
Capabilities:
Query or enumerate registry value
Read .ini file
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2238
call fcn.004473e0
mov ax, word [0x4d6e34]
push esi
push edi
mov word [esp + 0x18], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 1
stosw word es:[edi], ax
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push str.Path
push str.SOFTWAREClassesCLSID98E6BD24_2D93_41A5_BC6D_CB7C1507318B
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42aecc
mov dx, word [0x4d6e34]
mov ecx, 0x81
lea edi, [esp + 0x632]
mov word [esp + 0x630], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x83a]
mov word [esp + 0x838], dx
mov edx, dword [0x4d5dd4]
push ebx
rep stosd dword es:[edi], eax
push ebp
push 0
lea ecx, [esp + 0x63c]
push 0x104
push ecx
push edx
stosw word es:[edi], ax
call fcn.0040ef90
add esp, 0x10
lea eax, [esp + 0x840]
lea ecx, [esp + 0x638]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0x20]
push str.Sandboxie.ini
push edx
push 0x465844
lea eax, [esp + 0x234]
push 0x103
push eax
call ebp
mov cx, word [0x4d6e34]
xor eax, eax
mov word [esp + 0x125c], cx
mov ecx, 0x3ff
lea edi, [esp + 0x125e]
add esp, 0x14
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x840]
lea eax, [esp + 0x20]
push edx
push eax
push str._360SEBox__r_n_t_t_t_t_t_t_t_t_t_t_tEnabledy_r_n_t_t_t_t_t_t_t_t_t_t_tBoxNameTitle__r_n_t_t_t_t_t_t_t_t_t_t_tCopyLimitSilenty_r_n_t_t_t_t_t_t_t_t_t_t_tLingerProcesswuauclt.exe_r_n_t_t_t_t_t_t_t_t_t_t_tLingerProcessdevldr32.exe_r_n_t_t_t_t_t_t_t_t_t_t_tLingerProcesssyncor.exe_r_n_t_t_t_t_t_t_t_t_t_t_tLingerProcessjusched.exe_r_n_t_t_t_t_t_t_t_t_t_t_tLingerProcessacrord32.exe_r_n_t_t_t_t_t_t_t_t_t_t_tOpenPipePath360se.exe__r_n_t_t_t_t_t_t_t_t_t_t_tOpenProtectedStoragey_r_n_t_t_t_t_t_t_t_t_t_t_tOpenKeyPath360se.exe_HKEY_CURRENT_USERSoftwareMicrosoftInternet_ExplorerIntelliForms_r_n_t_t_t_t_t_t_t_t_t_t_tOpenWinClass360se.exe_32770_r_n_t_t_t_t_t_t_t_t_t_t_tOpenWinClass360se.exe_X360StartFrame_r_n_t_t_t_t_t_t_t_t_t_t_tOpenWinClass360Start.exe_X360StartFrame_r_n_t_t_t_t_t_t_t_t_t_t_tOpenIpcPath360se.exe__r_n_t_t_t_t_t_t_t_t_t_t_tReadFilePath360se.exe__s_r_n_t_t_t_t_t_t_t_t_t_t_tReadFilePath360se.exe__spasslist.dat_r_n_t_t_t_t_t_t_t_t_t_t_tOpenKeyPath360se.exe_HKEY_CURRENT_USERSoftwareMicrosoftInternet_ExplorerTypedUrls_r_n_t_t_t_t_t_t_t_t_t_t_t
lea ecx, [esp + 0x1254]
push 0x7ff
push ecx
call ebp
lea edx, [esp + 0x23c]
push 0x465008
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x42adb4
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov ebx, eax
call edi
lea eax, [esp + 0x1264]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, eax
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
lea eax, [ecx + eax + 1]
lea edi, [eax + eax]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x42ad62
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
rep stosb byte es:[edi], al
mov ax, word [0x4d6e34]
mov ecx, 0x1ff
mov word [esp + 0xa4c], ax
xor eax, eax
lea edi, [esp + 0xa4e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 1
push edi
push 2
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
push esi
lea ecx, [esp + 0xa5c]
push 0x400
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.MSVCRT.dll_fgetws]
add esp, 0x1c
test eax, eax
je 0x42ad49
lea edx, [esp + 0xa48]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp word [esp + 0xa48], 0x5b
mov edi, eax
jne 0x42acef
cmp word [esp + edi*2 + 0xa42], 0x5d
jne 0x42acef
push str.360SEBox
mov dword [esp + 0x18], 1
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
lea eax, [esp + 0xa52]
push str.360SEBox
push eax
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x42acf7
mov dword [esp + 0x14], eax
jmp 0x42ad1a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42ad1a
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xa48]
push ecx
lea eax, [ebx + edx*2]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov eax, dword [esp + 0x18]
add esp, 8
add eax, edi
mov dword [esp + 0x10], eax
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0xa48]
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xa4c]
push 0x400
push ecx
call dword [sym.imp.MSVCRT.dll_fgetws]
add esp, 0xc
test eax, eax
jne 0x42ac92
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1248]
push edx
lea ecx, [ebx + eax*2]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov edi, dword [sym.imp.MSVCRT.dll_fclose]
push esi
call edi
add esp, 4
test ebx, ebx
je 0x42adb4
lea edx, [esp + 0x228]
push 0x4675e4
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x42adab
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
shl eax, 1
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call edi
add esp, 0x14
push ebx
call fcn.0044737a
add esp, 4
mov ax, word [0x4d6e34]
mov ecx, 0x81
mov word [esp + 0x430], ax
xor eax, eax
lea edi, [esp + 0x432]
push str.Start.exe
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x434]
push ecx
push str._s_s__nosbiectrl__reload
push 0x103
push edx
stosw word es:[edi], ax
call ebp
lea eax, [esp + 0x444]
push 0
push eax
call fcn.0040f9d0
mov ecx, 0x82
xor eax, eax
mov edi, 0x4d6c1c
add esp, 0x1c
rep stosd dword es:[edi], eax
mov ecx, 0x82
mov edi, 0x4d6a14
rep stosd dword es:[edi], eax
mov ecx, 0x82
mov edi, 0x4d680c
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push str.SbieDll.dll
push ecx
push 0x465844
push 0x103
push 0x4d6c1c
call ebp
add esp, 0x14
lea edx, [esp + 0x20]
push str.Start.exe
push edx
push 0x465844
push 0x103
push 0x4d680c
call ebp
add esp, 0x14
lea eax, [esp + 0x228]
push eax
push 0x104
push 0x4d6a14
push 0x4d6e34
push str.FileRootPath
push str.GlobalSettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str._SANDBOX_
push 0x4d6a14
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
pop ebp
pop ebx
je 0x42aecc
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
push str.360SEBox
push 0x4d6a14
mov word [eax], 0
call esi
push 0x463600
push 0x4d6a14
call esi
add esp, 0x10
pop edi
pop esi
add esp, 0x2238
ret