Function at 0x10001790
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x1000c420
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x10011d50]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov eax, dword [0x10011d50]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
xor bl, bl
call fcn.10003e10
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x138], 0
mov dword [esp + 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov al, 0x63
mov edx, str.currentuser
lea ecx, [esp + 0x24]
cmp byte [esp + 0x24], al
jne 0x10001814
test al, al
je 0x10001814
mov al, byte [ecx + 1]
inc ecx
inc edx
cmp al, byte [edx]
je 0x10001807
movsx edx, byte [edx]
movsx eax, byte [ecx]
sub eax, edx
jne 0x10001820
mov bl, 1
push 0xd
lea ecx, [esp + 0x10]
call fcn.10003730
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10001844
test cl, cl
je 0x10001844
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001837
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10001850
mov bl, 1
push 0xe
lea ecx, [esp + 0x10]
call fcn.10003730
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10001874
test cl, cl
je 0x10001874
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001867
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10001880
mov bl, 1
push 0xf
lea ecx, [esp + 0x10]
call fcn.10003730
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x100018a4
test cl, cl
je 0x100018a4
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001897
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x100018b0
mov bl, 1
push 0x10
lea ecx, [esp + 0x10]
call fcn.10003730
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x100018d4
test cl, cl
je 0x100018d4
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100018c7
movsx eax, byte [eax]
movsx ecx, byte [edx]
sub ecx, eax
jne 0x100018e0
mov bl, 1
push 0x11
lea ecx, [esp + 0x10]
call fcn.10003730
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10001904
test cl, cl
je 0x10001904
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100018f7
movsx edx, byte [edx]
movsx eax, byte [eax]
sub edx, eax
jne 0x10001910
mov bl, 1
push 0x12
lea ecx, [esp + 0x10]
call fcn.10003730
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10001934
test cl, cl
je 0x10001934
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001927
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10001940
mov bl, 1
push 0x13
lea ecx, [esp + 0x10]
call fcn.10003730
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10001964
test cl, cl
je 0x10001964
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10001957
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10001970
mov bl, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x130], 0xffffffff
call fcn.10003e00
mov al, bl
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.100051e2
add esp, 0x12c
ret