Function at 0x405037
Capabilities:
Check for sandbox username or hostname
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.0042f9e0
mov eax, dword [0x44d060]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1214], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x1214]
push eax
push 0xffffffffffffffff
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x405477
push dword [ebp - 0x1214]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x405477
lea eax, [ebp - 0x121c]
push eax
mov esi, 0x451028
push esi
mov dword [ebp - 0x121c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ebx, str.agentUser
mov edi, str.Softwareprojonepodlp_smpcache_
call fcn.0040baae
call fcn.00404e36
xor edi, edi
mov dword [ebp - 0x1218], edi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.00426910
add esp, 0xc
xor esi, esi
inc esi
push esi
push dword [ebp - 0x1218]
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40510d
lea ebx, [ebp - 0x1218]
call fcn.004054ae
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.004026d7
inc dword [ebp - 0x1218]
cmp dword [ebp - 0x1218], 0x3d
jle 0x4050bb
push 0x451130
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x451128
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x405189
push 0x44301c
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
push str.RegOpenCurrentUser_failed
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0xca
push str..userenv.cpp
lea eax, [ebp - 0x1210]
push eax
push edi
call sym.poda32.exe_E7248975
add esp, 0x10
mov dword [0x451128], edi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x1214], edi
je 0x4051a3
push dword [ebp - 0x1214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00430160
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00430990
mov ebx, str.Advapi32.dll
cmp dword [0x450fd4], edi
jne 0x4051f4
push str.GetUserNameA
push ebx
mov dword [0x450fd4], edi
call fcn.00431a80
mov dword [0x450fd0], eax
cmp eax, edi
je 0x4051f4
push 0x404b40
push 0x450fd0
call fcn.00430a50
test eax, eax
jne 0x4051f4
mov dword [0x450fd4], esi
cmp dword [0x450fdc], edi
jne 0x40522f
push 0x44309c
push ebx
mov dword [0x450fdc], edi
call fcn.00431a80
mov dword [0x450fd8], eax
cmp eax, edi
je 0x40522f
push 0x404bb9
push 0x450fd8
call fcn.00430a50
test eax, eax
jne 0x40522f
mov dword [0x450fdc], esi
mov esi, str.Shell32.dll
cmp dword [0x450fe4], edi
jne 0x405273
push str.SHGetSpecialFolderPathA
push esi
mov dword [0x450fe4], edi
call fcn.00431a80
mov dword [0x450fe0], eax
cmp eax, edi
je 0x405273
push 0x404bf2
push 0x450fe0
call fcn.00430a50
test eax, eax
jne 0x405273
mov dword [0x450fe4], 1
cmp dword [0x450fec], edi
jne 0x4052b2
push 0x4430d0
push esi
mov dword [0x450fec], edi
call fcn.00431a80
mov dword [0x450fe8], eax
cmp eax, edi
je 0x4052b2
push 0x404c88
push 0x450fe8
call fcn.00430a50
test eax, eax
jne 0x4052b2
mov dword [0x450fec], 1
mov esi, str.Shlwapi.dll
cmp dword [0x450ff4], edi
jne 0x4052f6
push 0x4430e8
push esi
mov dword [0x450ff4], edi
call fcn.00431a80
mov dword [0x450ff0], eax
cmp eax, edi
je 0x4052f6
push 0x404d06
push 0x450ff0
call fcn.00430a50
test eax, eax
jne 0x4052f6
mov dword [0x450ff4], 1
cmp dword [0x450ffc], edi
jne 0x405335
push 0x443100
push esi
mov dword [0x450ffc], edi
call fcn.00431a80
mov dword [0x450ff8], eax
cmp eax, edi
je 0x405335
push 0x404d32
push 0x450ff8
call fcn.00430a50
test eax, eax
jne 0x405335
mov dword [0x450ffc], 1
cmp dword [0x451004], edi
jne 0x405374
push str.SHSetValueA
push esi
mov dword [0x451004], edi
call fcn.00431a80
mov dword [0x451000], eax
cmp eax, edi
je 0x405374
push 0x404d5e
push 0x451000
call fcn.00430a50
test eax, eax
jne 0x405374
mov dword [0x451004], 1
cmp dword [0x45100c], edi
jne 0x4053b3
push 0x443118
push esi
mov dword [0x45100c], edi
call fcn.00431a80
mov dword [0x451008], eax
cmp eax, edi
je 0x4053b3
push 0x404d8a
push 0x451008
call fcn.00430a50
test eax, eax
jne 0x4053b3
mov dword [0x45100c], 1
cmp dword [0x451014], edi
jne 0x4053f2
push str.RegOpenKeyW
push ebx
mov dword [0x451014], edi
call fcn.00431a80
mov dword [0x451010], eax
cmp eax, edi
je 0x4053f2
push 0x404db6
push 0x451010
call fcn.00430a50
test eax, eax
jne 0x4053f2
mov dword [0x451014], 1
cmp dword [0x45101c], edi
jne 0x405431
push 0x443130
push ebx
mov dword [0x45101c], edi
call fcn.00431a80
mov dword [0x451018], eax
cmp eax, edi
je 0x405431
push 0x404dd8
push 0x451018
call fcn.00430a50
test eax, eax
jne 0x405431
mov dword [0x45101c], 1
cmp dword [0x451024], edi
jne 0x405470
push str.RegCreateKeyExW
push ebx
mov dword [0x451024], edi
call fcn.00431a80
mov dword [0x451020], eax
cmp eax, edi
je 0x405470
push 0x404e01
push 0x451020
call fcn.00430a50
test eax, eax
jne 0x405470
mov dword [0x451024], 1
call fcn.004303d0
jmp 0x40549f
cmp dword [ebp - 0x1214], 0
je 0x40548c
push dword [ebp - 0x1214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InitUserEnvironment_impersonate_failed__error_code:__d
call fcn.004092c1
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004241ea
leave
ret