Function at 0x40e8c0
Capabilities:
Check for sandbox username or hostname
Get session user name
Get user security identifier

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x118
push ebp
xor ebp, ebp
cmp eax, ebp
push edi
jne 0x40e8dd
pop edi
xor eax, eax
pop ebp
add esp, 0x118
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x20], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x40e92a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GetCurrentUserSid__GetUserName_errcode___d
call fcn.00411930
add esp, 8
xor eax, eax
pop edi
pop ebp
add esp, 0x118
ret
lea edx, [esp + 0x14]
push esi
lea eax, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x18]
push ebp
push ecx
lea edx, [esp + 0x30]
push ebp
push edx
push ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov esi, eax
cmp esi, ebp
jne 0x40e969
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40ea1e
mov eax, dword [esp + 0x10]
push ebx
push eax
call sub.MFC42.DLL_operatornew
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x40ea38
mov ecx, dword [esp + 0x14]
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
push eax
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x40ea49
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebp
push edx
lea eax, [esp + 0x34]
push ebx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov esi, eax
test esi, esi
je 0x40ea5a
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esp + 0x18], eax
je 0x40ea68
push str.ConvertSidToStringSidA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ea78
mov ecx, dword [esp + 0x12c]
push ecx
push ebx
call eax
mov esi, eax
test esi, esi
je 0x40ea88
jmp 0x40ea9c
push eax
push str._GetCurrentUserSid__LookupAccountName_errcode___d
call fcn.00411930
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebp
add esp, 0x118
ret
push str._GetCurrentUserSid__sidBuffer__NULL
call fcn.00411930
add esp, 4
xor esi, esi
jmp 0x40eaa9
push str._GetCurrentUserSid__domainBuffer__NULL
call fcn.00411930
add esp, 4
xor esi, esi
jmp 0x40ea9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GetCurrentUserSid__LookupAccountName2_errcode___d
jmp 0x40ea94
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GetCurrentUserSid__LoadLibrary_errcode___d
jmp 0x40ea94
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GetCurrentUserSid__GetProcAddress_errcode___d
jmp 0x40ea94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GetCurrentUserSid__pfnConvertSidToStringSidA_errcode___d
call fcn.00411930
add esp, 8
test ebp, ebp
je 0x40eaa9
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
test ebx, ebx
je 0x40eab6
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x18]
pop ebx
test eax, eax
je 0x40eac6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
pop edi
pop ebp
add esp, 0x118
ret