Function at 0x10004000
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10004bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x1000701c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x12c]
push eax
xor bl, bl
call fcn.10002e40
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
mov dword [ebp - 4], 0
push edx
mov dword [ebp - 0x114], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov al, 0x63
mov edx, str.currentuser
lea ecx, [ebp - 0x110]
cmp byte [ebp - 0x110], al
jne 0x10004081
test al, al
je 0x10004081
mov al, byte [ecx + 1]
inc ecx
inc edx
cmp al, byte [edx]
je 0x10004074
movsx eax, byte [edx]
movsx ecx, byte [ecx]
sub ecx, eax
jne 0x1000408d
mov bl, 1
push 0xd
lea ecx, [ebp - 0x12c]
call fcn.10001f60
mov cl, byte [ebp - 0x110]
lea edx, [ebp - 0x110]
cmp cl, byte [eax]
jne 0x100040bd
lea ebx, [ebx]
test cl, cl
je 0x100040bd
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100040b0
movsx edx, byte [edx]
movsx eax, byte [eax]
sub edx, eax
jne 0x100040c9
mov bl, 1
push 0xe
lea ecx, [ebp - 0x12c]
call fcn.10001f60
mov cl, byte [ebp - 0x110]
lea edx, [ebp - 0x110]
cmp cl, byte [eax]
jne 0x100040f3
test cl, cl
je 0x100040f3
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100040e6
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x100040ff
mov bl, 1
push 0xf
lea ecx, [ebp - 0x12c]
call fcn.10001f60
mov cl, byte [ebp - 0x110]
lea edx, [ebp - 0x110]
cmp cl, byte [eax]
jne 0x1000412d
lea esp, [esp]
test cl, cl
je 0x1000412d
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004120
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10004139
mov bl, 1
push 0x10
lea ecx, [ebp - 0x12c]
call fcn.10001f60
mov cl, byte [ebp - 0x110]
lea edx, [ebp - 0x110]
cmp cl, byte [eax]
jne 0x10004163
test cl, cl
je 0x10004163
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004156
movsx eax, byte [eax]
movsx ecx, byte [edx]
sub ecx, eax
jne 0x1000416f
mov bl, 1
push 0x11
lea ecx, [ebp - 0x12c]
call fcn.10001f60
mov cl, byte [ebp - 0x110]
lea edx, [ebp - 0x110]
cmp cl, byte [eax]
jne 0x1000419d
lea esp, [esp]
test cl, cl
je 0x1000419d
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004190
movsx edx, byte [edx]
movsx eax, byte [eax]
sub edx, eax
jne 0x100041a9
mov bl, 1
push 0x12
lea ecx, [ebp - 0x12c]
call fcn.10001f60
mov cl, byte [ebp - 0x110]
lea edx, [ebp - 0x110]
cmp cl, byte [eax]
jne 0x100041d3
test cl, cl
je 0x100041d3
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x100041c6
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x100041df
mov bl, 1
push 0x13
lea ecx, [ebp - 0x12c]
call fcn.10001f60
mov cl, byte [ebp - 0x110]
lea edx, [ebp - 0x110]
cmp cl, byte [eax]
jne 0x1000420d
lea esp, [esp]
test cl, cl
je 0x1000420d
mov cl, byte [edx + 1]
inc edx
inc eax
cmp cl, byte [eax]
je 0x10004200
movsx ecx, byte [edx]
movsx edx, byte [eax]
sub ecx, edx
jne 0x10004219
mov bl, 1
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.10001130
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001b84
mov esp, ebp
pop ebp
ret