Function at 0x42a500
Capabilities:
Check for time delay via gettickcount
Delete registry key
Hide graphical window
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x1074
call fcn.004473e0
mov ax, word [0x4d6e34]
push ebx
push esi
push edi
mov word [esp + 0x248], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x24a]
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4d6604
rep stosd dword es:[edi], eax
push str._sInstall360sandbox.exe
lea ecx, [esp + 0x250]
xor esi, esi
push 0x103
push ecx
mov dword [esp + 0x1c], esi
stosw word es:[edi], ax
call ebx
lea edx, [esp + 0x258]
push esi
push edx
call fcn.0040ef80
add esp, 0x18
test eax, eax
je 0x42aa48
push ebp
push esi
push fcn.0042a4f0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov eax, dword [0x4d5dd4]
push 0x67
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x42a62a
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42a62a
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x3e9
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa
mov esi, eax
push 0
push 0x406
push esi
call ebp
push 0
push 0
push 0x402
push esi
call ebp
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
lea ecx, [esp + 0x34]
push 0
push ecx
call edi
test eax, eax
je 0x42a62a
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
lea ecx, [esp + 0x34]
push 0
push ecx
call edi
test eax, eax
jne 0x42a601
mov dx, word [0x4d6e34]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x65e]
mov word [esp + 0x65c], dx
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x65c]
push eax
push ecx
push edx
push str.ImagePath
push str.SYSTEMCurrentControlSetServicesSbieSvc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x103
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42a76d
cmp word [esp + 0x65c], ax
je 0x42a76d
mov ax, word [0x4d6e34]
mov ecx, 0x81
mov word [esp + 0x44], ax
xor eax, eax
lea edi, [esp + 0x46]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x48]
lea edx, [esp + 0x660]
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [esp + 0x44]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x42a6e3
mov word [eax], 0
push 0
push 1
push 0x402
push esi
call ebp
lea ecx, [esp + 0x44]
push 0x4d6604
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x42a76d
mov dx, word [0x4d6e34]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x866]
mov word [esp + 0x864], dx
lea edx, [esp + 0x864]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x44]
lea ecx, [esp + 0x24c]
push eax
push ecx
push str._s__remove__S__D_s
push 0x103
push edx
call ebx
add esp, 0x14
push str.SOFTWAREClassesCLSID98E6BD24_2D93_41A5_BC6D_CB7C1507318B
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [esp + 0x864]
push 0
push eax
call fcn.0040f9d0
add esp, 8
push 0
push 3
push 0x402
push esi
call ebp
mov dx, word [0x4d6e34]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xc76]
mov word [esp + 0xc74], dx
mov word [esp + 0xa6c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa6e]
push 0x4d6604
rep stosd dword es:[edi], eax
push str._sSandboxie.ini
lea ecx, [esp + 0xc7c]
push 0x103
push ecx
stosw word es:[edi], ax
call ebx
add esp, 0x10
lea edx, [esp + 0xa6c]
push 0x4d6604
push str._sSandBox__SANDBOX__
push 0x103
push edx
call ebx
add esp, 0x10
lea eax, [esp + 0xc74]
lea ecx, [esp + 0xa6c]
push eax
push ecx
push str.FileRootPath
push str.GlobalSettings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dx, word [0x4d6e34]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x456]
mov word [esp + 0x454], dx
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x458]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x454]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x42a85e
mov word [eax], 0
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
lea edx, [esp + 0x454]
push edx
call ebx
add esp, 4
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
shl eax, 1
push eax
lea eax, [esp + 0x458]
push eax
push 1
push 0x4d6e34
push str.SOFTWAREClassesCLSID98E6BD24_2D93_41A5_BC6D_CB7C1507318B360SE
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x4d6604
call ebx
add esp, 4
shl eax, 1
push eax
push 0x4d6604
push 1
push str.Path
push str.SOFTWAREClassesCLSID98E6BD24_2D93_41A5_BC6D_CB7C1507318B
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0xe
push 0x467b30
push 1
push 0x467b2c
push str.SOFTWAREClassesCLSID98E6BD24_2D93_41A5_BC6D_CB7C1507318B
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0xe
push 0x467b1c
push 1
push 0x467b18
push str.SOFTWAREClassesCLSID98E6BD24_2D93_41A5_BC6D_CB7C1507318B
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [esp + 0x20]
push 8
push ecx
push 3
push 0x467b14
push str.SOFTWAREClassesCLSID98E6BD24_2D93_41A5_BC6D_CB7C1507318B
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], 0x744d577c
mov dword [esp + 0x3c], 0x1c81077
call edi
mov dx, word [0x4d6e34]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe7e]
mov word [esp + 0xe7c], dx
push 0x4d6604
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x250]
lea ecx, [esp + 0xe80]
push eax
push str._s__install_bundled__S__D_s
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0xe90]
push 0
push edx
call fcn.0040f9d0
add esp, 0x1c
test eax, eax
je 0x42aa14
push 0
push 5
push 0x402
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, 0x1388
ja 0x42a9f7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42a9ce
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
call edi
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, ebx
mul ecx
shr edx, 6
add edx, 5
push edx
push 0x402
push esi
call ebp
call edi
sub eax, ebx
cmp eax, 0x1388
jbe 0x42a999
push 0
push 0xa
push 0x402
push esi
call ebp
call fcn.0042aee0
call fcn.0042aa60
mov edi, 1
jmp 0x42aa18
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
pop ebp
test esi, esi
je 0x42aa3c
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42aa3c
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x1074
ret
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1074
ret