Function at 0x10004290
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x10004d06
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x1000801c]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov eax, dword [0x1000801c]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
xor bl, bl
call fcn.10003180
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x134], 0
push edx
mov dword [esp + 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov al, 0x63
mov edx, str.currentuser
lea ecx, [esp + 0x24]
cmp byte [esp + 0x24], al
jne 0x10004315
test al, al
je 0x10004315
mov al, byte [ecx + 1]
inc ecx
inc edx
cmp al, byte [edx]
je 0x10004308
movsx eax, byte [edx]
movsx ecx, byte [ecx]
sub ecx, eax
jne 0x10004321
mov bl, 1
push 0xd
lea ecx, [esp + 0x10]
call fcn.10001f80
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10004345
test cl, cl
je 0x10004345
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004338
movsx edx, byte [edx]
movsx eax, byte [eax]
sub edx, eax
jne 0x10004351
mov bl, 1
push 0xe
lea ecx, [esp + 0x10]
call fcn.10001f80
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10004375
test cl, cl
je 0x10004375
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004368
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10004381
mov bl, 1
push 0xf
lea ecx, [esp + 0x10]
call fcn.10001f80
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x100043a5
test cl, cl
je 0x100043a5
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004398
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x100043b1
mov bl, 1
push 0x10
lea ecx, [esp + 0x10]
call fcn.10001f80
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x100043d5
test cl, cl
je 0x100043d5
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100043c8
movsx eax, byte [eax]
movsx ecx, byte [edx]
sub ecx, eax
jne 0x100043e1
mov bl, 1
push 0x11
lea ecx, [esp + 0x10]
call fcn.10001f80
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10004405
test cl, cl
je 0x10004405
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100043f8
movsx edx, byte [edx]
movsx eax, byte [eax]
sub edx, eax
jne 0x10004411
mov bl, 1
push 0x12
lea ecx, [esp + 0x10]
call fcn.10001f80
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10004435
test cl, cl
je 0x10004435
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004428
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10004441
mov bl, 1
push 0x13
lea ecx, [esp + 0x10]
call fcn.10001f80
mov cl, byte [esp + 0x24]
lea edx, [esp + 0x24]
cmp cl, byte [eax]
jne 0x10004465
test cl, cl
je 0x10004465
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004458
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10004471
mov bl, 1
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x134], 0xffffffff
call fcn.10001180
mov al, bl
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.10001b8a
add esp, 0x12c
ret