Function at 0x100025b0
Capabilities:
Check for sandbox username or hostname
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10069008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.1002caf0
add esp, 0xc
mov dword [ebp - 0x40c], pe_nt_image_headers32
lea eax, [ebp - 0x408]
mov dword [ebp - 0x414], 0
push 0x200
push 0
push eax
call fcn.1002caf0
add esp, 0xc
cmp word [0x1006bc38], 0
jne 0x100027e7
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x10002647
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x80
push str.GetRegCurrentUserpath
push str.__s__d_:__DLL__GetUserName_Error___d_n
jmp 0x100027df
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
lea eax, [ebp - 0x208]
push eax
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100027cd
call edi
cmp eax, 0x7a
jne 0x100027cd
mov eax, dword [ebp - 0x414]
inc eax
push eax
mov dword [ebp - 0x414], eax
call fcn.10015565
add esp, 4
mov esi, eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x208]
push eax
push 0
call ebx
test eax, eax
jne 0x100026fb
call edi
push eax
push 0x92
push str.GetRegCurrentUserpath
push str.__s__d_:__DLL__LookupAccountNameW_Error___d_n
call fcn.10013380
add esp, 0x10
push esi
call fcn.1001556e
add esp, 4
jmp 0x100027e7
push esi
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov dword [ebp - 0x418], eax
test eax, eax
jne 0x10002734
call edi
push eax
push 0x99
push str.GetRegCurrentUserpath
push str.__s__d_:__DLL__GetSidIdentifierAuthority_Error___d_n
call fcn.10013380
add esp, 0x10
push esi
call fcn.1001556e
add esp, 4
jmp 0x100027e7
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 1
push str.REGISTRYUSERSS__lu_
push 0x1006bc38
call edi
mov edx, 0x1006bc38
mov ebx, eax
add esp, 0xc
lea eax, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10002755
sub edx, eax
mov eax, dword [ebp - 0x418]
sar edx, 1
movzx eax, byte [eax + 5]
push eax
lea eax, [edx*2 + 0x1006bc38]
push 0x10061a60
push eax
call edi
add esp, 0xc
add ebx, eax
xor edi, edi
push esi
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
cmp byte [eax], 0
jbe 0x100027c2
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
push dword [eax]
lea eax, [ebx*2 + 0x1006bc38]
push str.__lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
add ebx, eax
inc edi
push esi
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx eax, byte [eax]
cmp edi, eax
jl 0x10002791
push esi
call fcn.1001556e
add esp, 4
jmp 0x100027e7
call edi
push eax
push 0x8c
push str.GetRegCurrentUserpath
push str.__s__d_:__DLL__LookupAccountNameW_Error___d_n
call fcn.10013380
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, 0x1006bc38
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015557
mov esp, ebp
pop ebp
ret