Function at 0x4486db
Capabilities:
Check for sandbox username or hostname
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7e8
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov byte [ebx], cl
mov byte [esi], cl
cmp dword [ebp + 8], ecx
je 0x448a26
lea eax, [ebp - 0x7d8]
push eax
push 0x20019
push ecx
push str.Volatile_Environment
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edi, edi
mov ecx, eax
inc edi
test ecx, ecx
jne 0x4487a5
mov byte [ebp - 0x3ec], al
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x7e0], 0x3e8
push eax
lea eax, [ebp - 0x7e8]
push eax
push ecx
push str.Username
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x7dc], eax
test eax, eax
jne 0x448798
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp eax, edi
jb 0x448798
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 0x10]
push esi
call fcn.006311ec
add esp, 0xc
mov eax, str._s_:__Registry_Method__Found_username__s
jmp 0x4487ac
mov esi, dword [ebp - 0x7dc]
mov eax, str._s_:_Failed_to_get_Username__Error0x_.8x
jmp 0x4487ac
mov eax, str._s_:_Failed_to_open_HKEY_CURRENT_USERVolatile_Environment___Error0x_.8x
mov esi, ecx
push esi
mov esi, str.GetCurrentUserAndDomainName
push esi
push eax
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push str._s_:_Using_Registry_Method__DNS__to_get_domain_name
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x7d8]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44880b
push eax
push esi
push str._s_:_Failed_to_open_TcpipParameters_key....trying_2nd_method...__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x44894f
lea eax, [ebp - 0x7e0]
mov dword [ebp - 0x7e0], 0x3e8
push eax
lea eax, [ebp - 0x3ec]
mov byte [ebp - 0x3ec], 0
push eax
lea eax, [ebp - 0x7e8]
push eax
push 0
push str.Hostname
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x7dc], eax
test eax, eax
jne 0x448934
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp eax, edi
jb 0x44892e
lea eax, [ebp - 0x3ec]
push eax
push esi
push str._s_:__Registry_Method__Found_Hostname__s_
call fcn.00449974
add esp, 0xc
mov dword [ebp - 0x7e0], 0x3e8
lea eax, [ebp - 0x7e0]
mov byte [ebp - 0x7d4], 0
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x7e8]
push eax
push 0
push str.Domain
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x7dc], eax
test eax, eax
jne 0x4488f7
lea eax, [ebp - 0x7d4]
push eax
call fcn.00631510
pop ecx
cmp eax, edi
jb 0x4488f1
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x3ec]
push eax
push str._s._s
push dword [ebp + 0x18]
push ebx
call fcn.00445d6d
add esp, 0x14
jmp 0x448916
mov eax, dword [ebp - 0x7dc]
push eax
push esi
push str._s_:_Failed_to_get_Domain__Error0x_.8x
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 0x18]
push ebx
call fcn.006311ec
add esp, 0x18
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push esi
push str._s_:__Registry_Method__Full_domain_name__DNS_method____s_
jmp 0x448aad
mov eax, dword [ebp - 0x7dc]
push eax
push esi
push str._s_:_Failed_to_get_Hostname....trying_2nd_method...__Error0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push str._s_:_Using_Registry_Method__NETBIOS__to_get_domain_name
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x7d8]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlComputerNameActiveComputerName
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44898a
push eax
push esi
push str._s_:_Failed_to_open_ControlComputerName_key__Error0x_.8x
jmp 0x448ac6
lea eax, [ebp - 0x7e0]
mov dword [ebp - 0x7e0], 0x3e8
push eax
lea eax, [ebp - 0x7d4]
mov byte [ebp - 0x7d4], 0
push eax
lea eax, [ebp - 0x7e8]
push eax
push 0
push str.ComputerName
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7d8]
mov dword [ebp - 0x7dc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x7dc]
test eax, eax
jne 0x448a1a
lea eax, [ebp - 0x7d4]
push eax
call fcn.00631510
pop ecx
cmp eax, edi
jb 0x448a14
lea eax, [ebp - 0x7d4]
push eax
push dword [ebp + 0x18]
push ebx
call fcn.006311ec
push ebx
push esi
push str._s_:__Registry_Method__Found_domain_name__NETBIOS_method____s_
call fcn.00449974
add esp, 0x18
jmp 0x448ab5
mov eax, dword [ebp - 0x7dc]
push eax
push esi
push str._s_:_Failed_to_get_ComputerName__Error0x_.8x
jmp 0x448ac6
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x7e4], eax
lea eax, [ebp - 0x7e4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push esi
mov esi, str.GetCurrentUserAndDomainName
push esi
push str._s_:__API_Method__Found_current_username__s
call fcn.00449974
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov dword [ebp - 0x7e4], eax
lea eax, [ebp - 0x7e4]
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
xor edi, edi
inc edi
test eax, eax
je 0x448a80
cmp dword [ebp - 0x7e4], edi
jb 0x448a80
mov eax, str._s_:__API_Method__Found_domain_name_via_ComputerNameDnsDomain____s
jmp 0x448aaa
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x7e4], eax
lea eax, [ebp - 0x7e4]
push eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x448ab9
cmp dword [ebp - 0x7e4], edi
jb 0x448ab9
mov eax, str._s_:__API_Method__Found_domain_name_via_ComputerNameNetBIOS____s
push ebx
push esi
push eax
call fcn.00449974
add esp, 0xc
mov eax, edi
jmp 0x448ad0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_:_Failed_to_get_domain_name_using_both_dns_netbios_method____Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret