Function at 0x140008f14
Capabilities:
Check for sandbox username or hostname
Get common file path
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1270
call fcn.14005ad00
sub rsp, rax
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x1260], rax
lea rdx, [rsp + 0x38]
xor ebx, ebx
or ecx, 0xffffffff
mov qword [rsp + 0x38], rbx
call sub.WTSAPI32.dll_WTSQueryUserToken
cmp eax, ebx
je 0x14000943f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp eax, ebx
je 0x14000943f
lea rdx, [rsp + 0x40]
lea rcx, [0x140082e30]
mov dword [rsp + 0x40], 0x80
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r9, [0x140082e30]
lea r8, str.agentUser
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call fcn.140013dc8
mov edi, ebx
mov dword [rsp + 0x30], ebx
lea esi, [rbx + 1]
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], bx
call fcn.1400452b0
lea rdx, [rsp + 0x50]
mov r9d, esi
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, ebx
je 0x140009024
lea rdx, [rsp + 0x30]
lea rcx, [0x1400840a0]
call fcn.14000948c
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
mov r11, rax
xor eax, eax
lea rdx, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
mov r8, rcx
mov rcx, r11
call fcn.140001ce4
mov edi, dword [rsp + 0x30]
add edi, esi
cmp edi, 0x3d
mov dword [rsp + 0x30], edi
jle 0x140008fba
lea rdx, [0x140082f30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x140082e28]
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
cmp eax, ebx
je 0x1400090aa
lea rdx, str.__s._d_
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.RegOpenCurrentUser_failed
lea rcx, [rsp + 0x260]
mov r8d, 0x800
call qword [sym.imp.SHLWAPI.dll_StrNCatW]
lea r8, str..userenv.cpp
lea rdx, [rsp + 0x260]
mov r9d, 0xf0
xor ecx, ecx
call sym.gxda64.exe_E7248975
mov qword [0x140082e28], rbx
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x1400090c0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14004e050
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.14004eb00
lea rbp, str.Advapi32.dll
cmp dword [0x140082da8], ebx
jne 0x140009127
lea rdx, str.GetUserNameA
mov rcx, rbp
mov dword [0x140082da8], ebx
call fcn.1400501c0
mov qword [0x140082b98], rax
cmp rax, rbx
je 0x140009127
lea rdx, [0x140008a94]
lea rcx, [0x140082b98]
call fcn.14004ebf0
mov ecx, dword [0x140082da8]
cmp eax, ebx
cmove ecx, esi
mov dword [0x140082da8], ecx
cmp dword [0x140082dac], ebx
jne 0x140009174
lea rdx, [0x140066dd0]
mov rcx, rbp
mov dword [0x140082dac], ebx
call fcn.1400501c0
mov qword [0x140082db0], rax
cmp rax, rbx
je 0x140009174
lea rdx, [0x140008b8c]
lea rcx, [0x140082db0]
call fcn.14004ebf0
mov ecx, dword [0x140082dac]
cmp eax, ebx
cmove ecx, esi
mov dword [0x140082dac], ecx
cmp dword [0x140082dc0], ebx
jne 0x1400091c5
lea rdx, str.SHGetSpecialFolderPathA
lea rcx, str.Shell32.dll
mov dword [0x140082dc0], ebx
call fcn.1400501c0
mov qword [0x140082db8], rax
cmp rax, rbx
je 0x1400091c5
lea rdx, [0x140008bd0]
lea rcx, [0x140082db8]
call fcn.14004ebf0
mov edx, dword [0x140082dc0]
cmp eax, ebx
cmove edx, esi
mov dword [0x140082dc0], edx
cmp dword [0x140082dc4], ebx
jne 0x140009216
lea rdx, [0x140066e08]
lea rcx, str.Shell32.dll
mov dword [0x140082dc4], ebx
call fcn.1400501c0
mov qword [0x140082dc8], rax
cmp rax, rbx
je 0x140009216
lea rdx, [0x140008cd0]
lea rcx, [0x140082dc8]
call fcn.14004ebf0
mov ecx, dword [0x140082dc4]
cmp eax, ebx
cmove ecx, esi
mov dword [0x140082dc4], ecx
lea rdi, str.Shlwapi.dll
cmp dword [0x140082dd8], ebx
jne 0x14000926a
lea rdx, [0x140066e20]
mov rcx, rdi
mov dword [0x140082dd8], ebx
call fcn.1400501c0
mov qword [0x140082dd0], rax
cmp rax, rbx
je 0x14000926a
lea rdx, [0x140008db0]
lea rcx, [0x140082dd0]
call fcn.14004ebf0
mov ecx, dword [0x140082dd8]
cmp eax, ebx
cmove ecx, esi
mov dword [0x140082dd8], ecx
cmp dword [0x140082ddc], ebx
jne 0x1400092b7
lea rdx, [0x140066e40]
mov rcx, rdi
mov dword [0x140082ddc], ebx
call fcn.1400501c0
mov qword [0x140082de0], rax
cmp rax, rbx
je 0x1400092b7
lea rdx, [0x140008de4]
lea rcx, [0x140082de0]
call fcn.14004ebf0
mov ecx, dword [0x140082ddc]
cmp eax, ebx
cmove ecx, esi
mov dword [0x140082ddc], ecx
cmp dword [0x140082df0], ebx
jne 0x140009304
lea rdx, str.SHSetValueA
mov rcx, rdi
mov dword [0x140082df0], ebx
call fcn.1400501c0
mov qword [0x140082de8], rax
cmp rax, rbx
je 0x140009304
lea rdx, [0x140008e18]
lea rcx, [0x140082de8]
call fcn.14004ebf0
mov edx, dword [0x140082df0]
cmp eax, ebx
cmove edx, esi
mov dword [0x140082df0], edx
cmp dword [0x140082df4], ebx
jne 0x140009351
lea rdx, [0x140066e60]
mov rcx, rdi
mov dword [0x140082df4], ebx
call fcn.1400501c0
mov qword [0x140082df8], rax
cmp rax, rbx
je 0x140009351
lea rdx, [0x140008e48]
lea rcx, [0x140082df8]
call fcn.14004ebf0
mov ecx, dword [0x140082df4]
cmp eax, ebx
cmove ecx, esi
mov dword [0x140082df4], ecx
cmp dword [0x140082e08], ebx
jne 0x14000939e
lea rdx, str.RegOpenKeyW
mov rcx, rbp
mov dword [0x140082e08], ebx
call fcn.1400501c0
mov qword [0x140082e00], rax
cmp rax, rbx
je 0x14000939e
lea rdx, [0x140008e78]
lea rcx, [0x140082e00]
call fcn.14004ebf0
mov ecx, dword [0x140082e08]
cmp eax, ebx
cmove ecx, esi
mov dword [0x140082e08], ecx
cmp dword [0x140082e0c], ebx
jne 0x1400093eb
lea rdx, [0x140066e80]
mov rcx, rbp
mov dword [0x140082e0c], ebx
call fcn.1400501c0
mov qword [0x140082e10], rax
cmp rax, rbx
je 0x1400093eb
lea rdx, [0x140008e90]
lea rcx, [0x140082e10]
call fcn.14004ebf0
mov edx, dword [0x140082e0c]
cmp eax, ebx
cmove edx, esi
mov dword [0x140082e0c], edx
cmp dword [0x140082e20], ebx
jne 0x140009438
lea rdx, [0x140066e90]
mov rcx, rbp
mov dword [0x140082e20], ebx
call fcn.1400501c0
mov qword [0x140082e18], rax
cmp rax, rbx
je 0x140009438
lea rdx, [0x140008eb8]
lea rcx, [0x140082e18]
call fcn.14004ebf0
mov ecx, dword [0x140082e20]
cmp eax, ebx
cmove ecx, esi
mov dword [0x140082e20], ecx
call fcn.14004e320
jmp 0x140009463
mov rcx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x14000944f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InitUserEnvironment_impersonate_failed__error_code:__d
mov edx, eax
call fcn.140010258
mov rcx, qword [rsp + 0x1260]
xor rcx, rsp
call fcn.140042a40
lea r11, [rsp + 0x1270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret