Function at 0x449fcb
Capabilities:
Check for sandbox username or hostname
Get session user name
Get user security identifier

Disassembly:
push 0x224
mov eax, 0x4b34e7
call fcn.00469d7c
mov eax, ecx
mov dword [ebp - 0x218], eax
push 0x4cdd44
call fcn.0040286d
push 0x202
xor esi, esi
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.004821b0
add esp, 0xc
mov dword [ebp - 0x22c], 0x101
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x230]
mov dword [ebp - 0x220], esi
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], esi
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x44a09d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x44a09d
push str.GetCurrentUserSID__:_LookupAccountName___failed__1st_time_call.
lea ecx, [ebp - 0x218]
call fcn.00402829
xor ecx, ecx
mov dword [ebp - 4], esi
push 0x186a0
inc ecx
lea edx, [ebp - 0x218]
call fcn.00414da1
pop ecx
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.00402e64
xor eax, eax
jmp 0x44a248
mov eax, dword [ebp - 0x220]
inc eax
push eax
call fcn.0044f7c2
mov edi, eax
pop ecx
test edi, edi
jne 0x44a0ca
push str.GetCurrentUserSID__:failed_to_allocate_memory_for_pSid.
lea ecx, [ebp - 0x218]
call fcn.00402829
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
push esi
jmp 0x44a07c
push dword [ebp - 0x220]
push esi
push edi
call fcn.004821b0
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f7c2
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x44a13d
push str.GetCurrentUserSID__:failed_to_allocate_memory_for_wsDomainName.
lea ecx, [ebp - 0x218]
call fcn.00402829
xor ecx, ecx
mov dword [ebp - 4], 2
push esi
lea edx, [ebp - 0x218]
inc ecx
call fcn.00414da1
pop ecx
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push edi
call fcn.0044f7bd
xor eax, eax
jmp 0x44a247
mov eax, dword [ebp - 0x21c]
add eax, eax
push eax
push esi
push ebx
call fcn.004821b0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
lea eax, [ebp - 0x220]
push eax
push edi
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x44a1c5
push str.GetCurrentUserSID__:LookupAccountName___failed.
lea ecx, [ebp - 0x218]
call fcn.00402829
xor ecx, ecx
mov dword [ebp - 4], 3
push 0x186a0
lea edx, [ebp - 0x218]
inc ecx
call fcn.00414da1
pop ecx
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push edi
call fcn.0044f7bd
push ebx
call fcn.0044f7bd
xor eax, eax
jmp 0x44a246
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x44a218
push str.GetCurrentUserSID__:ConvertSidToStringSid___failed.
lea ecx, [ebp - 0x228]
call fcn.00402829
xor ecx, ecx
mov dword [ebp - 4], 4
push 0x186a0
lea edx, [ebp - 0x228]
inc ecx
call fcn.00414da1
pop ecx
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x44a238
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x218]
call fcn.0040286d
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
inc esi
push edi
call fcn.0044f7bd
push ebx
call fcn.0044f7bd
mov eax, esi
pop ecx
pop ecx
call fcn.00469d26
ret