Function at 0x406244
Capabilities:
Check for sandbox username or hostname
Create thread
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.004368e0
mov eax, dword [0x456070]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1214], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x1214]
push eax
push 0xffffffffffffffff
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x40669e
push dword [ebp - 0x1214]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x40669e
lea eax, [ebp - 0x121c]
push eax
mov esi, 0x459fe8
push esi
mov dword [ebp - 0x121c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ebx, str.agentUser
mov edi, str.Softwareprojonepodlp_smpcache_
call fcn.0040ced4
xor esi, esi
push esi
push esi
push esi
push 0x40621c
push 0x8000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov dword [ebp - 0x1218], esi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.0042d4e0
add esp, 0xc
push 1
push dword [ebp - 0x1218]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x406330
lea ebx, [ebp - 0x1218]
call fcn.004066d5
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.00401876
inc dword [ebp - 0x1218]
cmp dword [ebp - 0x1218], 0x3d
jle 0x4062e0
push 0x45a0f0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x45a0e8
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x4063ac
push str.__s._d_
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
push str.RegOpenCurrentUser_failed
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0xf0
push str..userenv.cpp
lea eax, [ebp - 0x1210]
push eax
push esi
call sym.poda32.exe_E7248975
add esp, 0x10
mov dword [0x45a0e8], esi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x1214], esi
je 0x4063c2
push dword [ebp - 0x1214]
call edi
call fcn.00437060
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00437890
mov edi, str.Advapi32.dll
cmp dword [0x459f94], esi
jne 0x406417
push str.GetUserNameA
push edi
mov dword [0x459f94], esi
call fcn.00438980
mov dword [0x459f90], eax
cmp eax, esi
je 0x406417
push 0x405b8a
push 0x459f90
call fcn.00437950
test eax, eax
jne 0x406417
mov dword [0x459f94], 1
cmp dword [0x459f9c], esi
jne 0x406456
push 0x44b53c
push edi
mov dword [0x459f9c], esi
call fcn.00438980
mov dword [0x459f98], eax
cmp eax, esi
je 0x406456
push 0x405c03
push 0x459f98
call fcn.00437950
test eax, eax
jne 0x406456
mov dword [0x459f9c], 1
mov ebx, str.Shell32.dll
cmp dword [0x459fa4], esi
jne 0x40649a
push str.SHGetSpecialFolderPathA
push ebx
mov dword [0x459fa4], esi
call fcn.00438980
mov dword [0x459fa0], eax
cmp eax, esi
je 0x40649a
push 0x405c3c
push 0x459fa0
call fcn.00437950
test eax, eax
jne 0x40649a
mov dword [0x459fa4], 1
cmp dword [0x459fac], esi
jne 0x4064d9
push 0x44b570
push ebx
mov dword [0x459fac], esi
call fcn.00438980
mov dword [0x459fa8], eax
cmp eax, esi
je 0x4064d9
push 0x405cd2
push 0x459fa8
call fcn.00437950
test eax, eax
jne 0x4064d9
mov dword [0x459fac], 1
mov ebx, str.Shlwapi.dll
cmp dword [0x459fb4], esi
jne 0x40651d
push 0x44b588
push ebx
mov dword [0x459fb4], esi
call fcn.00438980
mov dword [0x459fb0], eax
cmp eax, esi
je 0x40651d
push 0x405d50
push 0x459fb0
call fcn.00437950
test eax, eax
jne 0x40651d
mov dword [0x459fb4], 1
cmp dword [0x459fbc], esi
jne 0x40655c
push 0x44b5a0
push ebx
mov dword [0x459fbc], esi
call fcn.00438980
mov dword [0x459fb8], eax
cmp eax, esi
je 0x40655c
push 0x405d7c
push 0x459fb8
call fcn.00437950
test eax, eax
jne 0x40655c
mov dword [0x459fbc], 1
cmp dword [0x459fc4], esi
jne 0x40659b
push str.SHSetValueA
push ebx
mov dword [0x459fc4], esi
call fcn.00438980
mov dword [0x459fc0], eax
cmp eax, esi
je 0x40659b
push 0x405da8
push 0x459fc0
call fcn.00437950
test eax, eax
jne 0x40659b
mov dword [0x459fc4], 1
cmp dword [0x459fcc], esi
jne 0x4065da
push 0x44b5b8
push ebx
mov dword [0x459fcc], esi
call fcn.00438980
mov dword [0x459fc8], eax
cmp eax, esi
je 0x4065da
push 0x405dd4
push 0x459fc8
call fcn.00437950
test eax, eax
jne 0x4065da
mov dword [0x459fcc], 1
cmp dword [0x459fd4], esi
jne 0x406619
push str.RegOpenKeyW
push edi
mov dword [0x459fd4], esi
call fcn.00438980
mov dword [0x459fd0], eax
cmp eax, esi
je 0x406619
push 0x405e00
push 0x459fd0
call fcn.00437950
test eax, eax
jne 0x406619
mov dword [0x459fd4], 1
cmp dword [0x459fdc], esi
jne 0x406658
push 0x44b5d0
push edi
mov dword [0x459fdc], esi
call fcn.00438980
mov dword [0x459fd8], eax
cmp eax, esi
je 0x406658
push 0x405e22
push 0x459fd8
call fcn.00437950
test eax, eax
jne 0x406658
mov dword [0x459fdc], 1
cmp dword [0x459fe4], esi
jne 0x406697
push 0x44b5e0
push edi
mov dword [0x459fe4], esi
call fcn.00438980
mov dword [0x459fe0], eax
cmp eax, esi
je 0x406697
push 0x405e4b
push 0x459fe0
call fcn.00437950
test eax, eax
jne 0x406697
mov dword [0x459fe4], 1
call fcn.004372d0
jmp 0x4066c6
cmp dword [ebp - 0x1214], 0
je 0x4066b3
push dword [ebp - 0x1214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InitUserEnvironment_impersonate_failed__error_code:__d
call fcn.0040a440
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042af05
leave
ret