Function at 0x4222fc
Capabilities:
Check for sandbox username or hostname
Get session user name
Get user security identifier

Disassembly:
push 0x22c
mov eax, 0x44d8bf
call fcn.0043676f
push 0x457ce8
mov dword [ebp - 0x220], ecx
call fcn.00402111
xor eax, eax
push 0x200
mov word [ebp - 0x218], ax
xor esi, esi
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.00434dc0
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x238], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
lea eax, [ebp - 0x228]
push eax
push esi
lea eax, [ebp - 0x218]
push eax
push esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], esi
call edi
test eax, eax
jne 0x4223da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4223da
push str.GetCurrentUserSID__:_LookupAccountName___failed__1st_time_call.
lea ecx, [ebp - 0x21c]
call fcn.00402148
push 0x186a0
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 4], esi
push 1
call fcn.0040e1e3
mov ecx, dword [ebp - 0x21c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025ca
xor eax, eax
call fcn.004367f2
ret
mov eax, dword [ebp - 0x228]
inc eax
push eax
call fcn.00423146
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x42240f
push str.GetCurrentUserSID__:failed_to_allocate_memory_for_pSid.
lea ecx, [ebp - 0x21c]
call fcn.00402148
push esi
xor eax, eax
lea ecx, [ebp - 0x21c]
inc eax
push ecx
mov dword [ebp - 4], eax
push eax
jmp 0x4223bc
push dword [ebp - 0x228]
push esi
push ebx
call fcn.00434dc0
mov eax, dword [ebp - 0x224]
add esp, 0xc
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423146
pop ecx
mov dword [ebp - 0x21c], eax
cmp eax, esi
jne 0x42248c
push str.GetCurrentUserSID__:failed_to_allocate_memory_for_wsDomainName.
lea ecx, [ebp - 0x21c]
call fcn.00402148
push esi
lea eax, [ebp - 0x21c]
push eax
push 1
mov dword [ebp - 4], 2
call fcn.0040e1e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025ca
push ebx
call fcn.0042313b
pop ecx
jmp 0x4223d2
mov ecx, dword [ebp - 0x224]
add ecx, ecx
push ecx
push esi
push eax
call fcn.00434dc0
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x21c]
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push esi
call edi
test eax, eax
jne 0x42251a
push str.GetCurrentUserSID__:LookupAccountName___failed.
lea ecx, [ebp - 0x220]
call fcn.00402148
push 0x186a0
lea eax, [ebp - 0x220]
push eax
push 1
mov dword [ebp - 4], 3
call fcn.0040e1e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x220]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025ca
push ebx
call fcn.0042313b
pop ecx
push dword [ebp - 0x21c]
jmp 0x422481
lea eax, [ebp - 0x22c]
push eax
push ebx
mov dword [ebp - 0x22c], esi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x42258a
push str.GetCurrentUserSID__:ConvertSidToStringSid___failed.
lea ecx, [ebp - 0x230]
call fcn.00402148
push 0x186a0
lea eax, [ebp - 0x230]
push eax
push 1
mov dword [ebp - 4], 4
call fcn.0040e1e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x230]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025ca
push ebx
call fcn.0042313b
pop ecx
push dword [ebp - 0x21c]
call fcn.0042313b
pop ecx
mov eax, esi
jmp 0x4223d4
push dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x220]
call fcn.00402111
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
inc esi
jmp 0x422570