Function at 0x4060a1
Capabilities:
Check for sandbox username or hostname
Create thread
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.00434be0
mov eax, dword [0x454070]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1214], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x1214]
push eax
push 0xffffffffffffffff
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x4064fb
push dword [ebp - 0x1214]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4064fb
lea eax, [ebp - 0x121c]
push eax
mov esi, 0x457fe8
push esi
mov dword [ebp - 0x121c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ebx, str.agentUser
mov edi, str.Softwareprojonepodlp_smpcache_
call fcn.0040cd76
xor esi, esi
push esi
push esi
push esi
push 0x406079
push 0x8000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov dword [ebp - 0x1218], esi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.0042b7e0
add esp, 0xc
push 1
push dword [ebp - 0x1218]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40618d
lea ebx, [ebp - 0x1218]
call fcn.00406532
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.00401801
inc dword [ebp - 0x1218]
cmp dword [ebp - 0x1218], 0x3d
jle 0x40613d
push 0x4580f0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x4580e8
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x406209
push 0x448fa4
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
push str.RegOpenCurrentUser_failed
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0xe9
push str..userenv.cpp
lea eax, [ebp - 0x1210]
push eax
push esi
call sym.poda32.exe_E7248975
add esp, 0x10
mov dword [0x4580e8], esi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x1214], esi
je 0x40621f
push dword [ebp - 0x1214]
call edi
call fcn.00435360
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00435b90
mov edi, str.Advapi32.dll
cmp dword [0x457f94], esi
jne 0x406274
push str.GetUserNameA
push edi
mov dword [0x457f94], esi
call fcn.00436c80
mov dword [0x457f90], eax
cmp eax, esi
je 0x406274
push 0x405b02
push 0x457f90
call fcn.00435c50
test eax, eax
jne 0x406274
mov dword [0x457f94], 1
cmp dword [0x457f9c], esi
jne 0x4062b3
push 0x44953c
push edi
mov dword [0x457f9c], esi
call fcn.00436c80
mov dword [0x457f98], eax
cmp eax, esi
je 0x4062b3
push 0x405b7b
push 0x457f98
call fcn.00435c50
test eax, eax
jne 0x4062b3
mov dword [0x457f9c], 1
mov ebx, str.Shell32.dll
cmp dword [0x457fa4], esi
jne 0x4062f7
push str.SHGetSpecialFolderPathA
push ebx
mov dword [0x457fa4], esi
call fcn.00436c80
mov dword [0x457fa0], eax
cmp eax, esi
je 0x4062f7
push 0x405bb4
push 0x457fa0
call fcn.00435c50
test eax, eax
jne 0x4062f7
mov dword [0x457fa4], 1
cmp dword [0x457fac], esi
jne 0x406336
push 0x449570
push ebx
mov dword [0x457fac], esi
call fcn.00436c80
mov dword [0x457fa8], eax
cmp eax, esi
je 0x406336
push 0x405c4a
push 0x457fa8
call fcn.00435c50
test eax, eax
jne 0x406336
mov dword [0x457fac], 1
mov ebx, str.Shlwapi.dll
cmp dword [0x457fb4], esi
jne 0x40637a
push 0x449588
push ebx
mov dword [0x457fb4], esi
call fcn.00436c80
mov dword [0x457fb0], eax
cmp eax, esi
je 0x40637a
push 0x405cc8
push 0x457fb0
call fcn.00435c50
test eax, eax
jne 0x40637a
mov dword [0x457fb4], 1
cmp dword [0x457fbc], esi
jne 0x4063b9
push 0x4495a0
push ebx
mov dword [0x457fbc], esi
call fcn.00436c80
mov dword [0x457fb8], eax
cmp eax, esi
je 0x4063b9
push 0x405cf4
push 0x457fb8
call fcn.00435c50
test eax, eax
jne 0x4063b9
mov dword [0x457fbc], 1
cmp dword [0x457fc4], esi
jne 0x4063f8
push str.SHSetValueA
push ebx
mov dword [0x457fc4], esi
call fcn.00436c80
mov dword [0x457fc0], eax
cmp eax, esi
je 0x4063f8
push 0x405d20
push 0x457fc0
call fcn.00435c50
test eax, eax
jne 0x4063f8
mov dword [0x457fc4], 1
cmp dword [0x457fcc], esi
jne 0x406437
push 0x4495b8
push ebx
mov dword [0x457fcc], esi
call fcn.00436c80
mov dword [0x457fc8], eax
cmp eax, esi
je 0x406437
push 0x405d4c
push 0x457fc8
call fcn.00435c50
test eax, eax
jne 0x406437
mov dword [0x457fcc], 1
cmp dword [0x457fd4], esi
jne 0x406476
push str.RegOpenKeyW
push edi
mov dword [0x457fd4], esi
call fcn.00436c80
mov dword [0x457fd0], eax
cmp eax, esi
je 0x406476
push 0x405d78
push 0x457fd0
call fcn.00435c50
test eax, eax
jne 0x406476
mov dword [0x457fd4], 1
cmp dword [0x457fdc], esi
jne 0x4064b5
push 0x4495d0
push edi
mov dword [0x457fdc], esi
call fcn.00436c80
mov dword [0x457fd8], eax
cmp eax, esi
je 0x4064b5
push 0x405d9a
push 0x457fd8
call fcn.00435c50
test eax, eax
jne 0x4064b5
mov dword [0x457fdc], 1
cmp dword [0x457fe4], esi
jne 0x4064f4
push 0x4495e0
push edi
mov dword [0x457fe4], esi
call fcn.00436c80
mov dword [0x457fe0], eax
cmp eax, esi
je 0x4064f4
push 0x405dc3
push 0x457fe0
call fcn.00435c50
test eax, eax
jne 0x4064f4
mov dword [0x457fe4], 1
call fcn.004355d0
jmp 0x406523
cmp dword [ebp - 0x1214], 0
je 0x406510
push dword [ebp - 0x1214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InitUserEnvironment_impersonate_failed__error_code:__d
call fcn.0040a23a
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004291e7
leave
ret