Function at 0x406069
Capabilities:
Check for sandbox username or hostname
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.00432340
mov eax, dword [0x451070]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1214], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x1214]
push eax
push 0xffffffffffffffff
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x4064a9
push dword [ebp - 0x1214]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4064a9
lea eax, [ebp - 0x121c]
push eax
mov esi, 0x454fe8
push esi
mov dword [ebp - 0x121c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ebx, str.agentUser
mov edi, str.Softwareprojonepodlp_smpcache_
call fcn.0040cdbc
call fcn.00405e66
xor edi, edi
mov dword [ebp - 0x1218], edi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.00428f40
add esp, 0xc
xor esi, esi
inc esi
push esi
push dword [ebp - 0x1218]
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40613f
lea ebx, [ebp - 0x1218]
call fcn.004064e0
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.00401844
inc dword [ebp - 0x1218]
cmp dword [ebp - 0x1218], 0x3d
jle 0x4060ed
push 0x4550f0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x4550e8
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x4061bb
push 0x445f64
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
push str.RegOpenCurrentUser_failed
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0xca
push str..userenv.cpp
lea eax, [ebp - 0x1210]
push eax
push edi
call sym.poda32.exe_E7248975
add esp, 0x10
mov dword [0x4550e8], edi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x1214], edi
je 0x4061d5
push dword [ebp - 0x1214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00432ac0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.004332f0
mov ebx, str.Advapi32.dll
cmp dword [0x454f94], edi
jne 0x406226
push str.GetUserNameA
push ebx
mov dword [0x454f94], edi
call fcn.004343e0
mov dword [0x454f90], eax
cmp eax, edi
je 0x406226
push 0x405b70
push 0x454f90
call fcn.004333b0
test eax, eax
jne 0x406226
mov dword [0x454f94], esi
cmp dword [0x454f9c], edi
jne 0x406261
push 0x446434
push ebx
mov dword [0x454f9c], edi
call fcn.004343e0
mov dword [0x454f98], eax
cmp eax, edi
je 0x406261
push 0x405be9
push 0x454f98
call fcn.004333b0
test eax, eax
jne 0x406261
mov dword [0x454f9c], esi
mov esi, str.Shell32.dll
cmp dword [0x454fa4], edi
jne 0x4062a5
push str.SHGetSpecialFolderPathA
push esi
mov dword [0x454fa4], edi
call fcn.004343e0
mov dword [0x454fa0], eax
cmp eax, edi
je 0x4062a5
push 0x405c22
push 0x454fa0
call fcn.004333b0
test eax, eax
jne 0x4062a5
mov dword [0x454fa4], 1
cmp dword [0x454fac], edi
jne 0x4062e4
push 0x446468
push esi
mov dword [0x454fac], edi
call fcn.004343e0
mov dword [0x454fa8], eax
cmp eax, edi
je 0x4062e4
push 0x405cb8
push 0x454fa8
call fcn.004333b0
test eax, eax
jne 0x4062e4
mov dword [0x454fac], 1
mov esi, str.Shlwapi.dll
cmp dword [0x454fb4], edi
jne 0x406328
push 0x446480
push esi
mov dword [0x454fb4], edi
call fcn.004343e0
mov dword [0x454fb0], eax
cmp eax, edi
je 0x406328
push 0x405d36
push 0x454fb0
call fcn.004333b0
test eax, eax
jne 0x406328
mov dword [0x454fb4], 1
cmp dword [0x454fbc], edi
jne 0x406367
push 0x446498
push esi
mov dword [0x454fbc], edi
call fcn.004343e0
mov dword [0x454fb8], eax
cmp eax, edi
je 0x406367
push 0x405d62
push 0x454fb8
call fcn.004333b0
test eax, eax
jne 0x406367
mov dword [0x454fbc], 1
cmp dword [0x454fc4], edi
jne 0x4063a6
push str.SHSetValueA
push esi
mov dword [0x454fc4], edi
call fcn.004343e0
mov dword [0x454fc0], eax
cmp eax, edi
je 0x4063a6
push 0x405d8e
push 0x454fc0
call fcn.004333b0
test eax, eax
jne 0x4063a6
mov dword [0x454fc4], 1
cmp dword [0x454fcc], edi
jne 0x4063e5
push 0x4464b0
push esi
mov dword [0x454fcc], edi
call fcn.004343e0
mov dword [0x454fc8], eax
cmp eax, edi
je 0x4063e5
push 0x405dba
push 0x454fc8
call fcn.004333b0
test eax, eax
jne 0x4063e5
mov dword [0x454fcc], 1
cmp dword [0x454fd4], edi
jne 0x406424
push str.RegOpenKeyW
push ebx
mov dword [0x454fd4], edi
call fcn.004343e0
mov dword [0x454fd0], eax
cmp eax, edi
je 0x406424
push 0x405de6
push 0x454fd0
call fcn.004333b0
test eax, eax
jne 0x406424
mov dword [0x454fd4], 1
cmp dword [0x454fdc], edi
jne 0x406463
push 0x4464c8
push ebx
mov dword [0x454fdc], edi
call fcn.004343e0
mov dword [0x454fd8], eax
cmp eax, edi
je 0x406463
push 0x405e08
push 0x454fd8
call fcn.004333b0
test eax, eax
jne 0x406463
mov dword [0x454fdc], 1
cmp dword [0x454fe4], edi
jne 0x4064a2
push 0x4464d8
push ebx
mov dword [0x454fe4], edi
call fcn.004343e0
mov dword [0x454fe0], eax
cmp eax, edi
je 0x4064a2
push 0x405e31
push 0x454fe0
call fcn.004333b0
test eax, eax
jne 0x4064a2
mov dword [0x454fe4], 1
call fcn.00432d30
jmp 0x4064d1
cmp dword [ebp - 0x1214], 0
je 0x4064be
push dword [ebp - 0x1214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InitUserEnvironment_impersonate_failed__error_code:__d
call fcn.0040a25d
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426962
leave
ret