Function at 0x404ff7
Capabilities:
Check for sandbox username or hostname
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.00430970
mov eax, dword [0x44e060]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1214], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x1214]
push eax
push 0xffffffffffffffff
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x405437
push dword [ebp - 0x1214]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x405437
lea eax, [ebp - 0x121c]
push eax
mov esi, 0x451fc0
push esi
mov dword [ebp - 0x121c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ebx, str.agentUser
mov edi, str.Softwareprojonepodlp_smpcache_
call fcn.0040bcec
call fcn.00404dfe
xor edi, edi
mov dword [ebp - 0x1218], edi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.004278a0
add esp, 0xc
xor esi, esi
inc esi
push esi
push dword [ebp - 0x1218]
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4050cd
lea ebx, [ebp - 0x1218]
call fcn.0040546e
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.004026da
inc dword [ebp - 0x1218]
cmp dword [ebp - 0x1218], 0x3d
jle 0x40507b
push 0x4520c8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x4520c0
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x405149
push 0x44409c
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
push str.RegOpenCurrentUser_failed
lea eax, [ebp - 0x1210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0xca
push str..userenv.cpp
lea eax, [ebp - 0x1210]
push eax
push edi
call sym.poda32.exe_E7248975
add esp, 0x10
mov dword [0x4520c0], edi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x1214], edi
je 0x405163
push dword [ebp - 0x1214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00431100
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00431930
mov ebx, str.Advapi32.dll
cmp dword [0x451f6c], edi
jne 0x4051b4
push str.GetUserNameA
push ebx
mov dword [0x451f6c], edi
call fcn.00432a20
mov dword [0x451f68], eax
cmp eax, edi
je 0x4051b4
push 0x404b08
push 0x451f68
call fcn.004319f0
test eax, eax
jne 0x4051b4
mov dword [0x451f6c], esi
cmp dword [0x451f74], edi
jne 0x4051ef
push 0x44411c
push ebx
mov dword [0x451f74], edi
call fcn.00432a20
mov dword [0x451f70], eax
cmp eax, edi
je 0x4051ef
push 0x404b81
push 0x451f70
call fcn.004319f0
test eax, eax
jne 0x4051ef
mov dword [0x451f74], esi
mov esi, str.Shell32.dll
cmp dword [0x451f7c], edi
jne 0x405233
push str.SHGetSpecialFolderPathA
push esi
mov dword [0x451f7c], edi
call fcn.00432a20
mov dword [0x451f78], eax
cmp eax, edi
je 0x405233
push 0x404bba
push 0x451f78
call fcn.004319f0
test eax, eax
jne 0x405233
mov dword [0x451f7c], 1
cmp dword [0x451f84], edi
jne 0x405272
push 0x444150
push esi
mov dword [0x451f84], edi
call fcn.00432a20
mov dword [0x451f80], eax
cmp eax, edi
je 0x405272
push 0x404c50
push 0x451f80
call fcn.004319f0
test eax, eax
jne 0x405272
mov dword [0x451f84], 1
mov esi, str.Shlwapi.dll
cmp dword [0x451f8c], edi
jne 0x4052b6
push 0x444168
push esi
mov dword [0x451f8c], edi
call fcn.00432a20
mov dword [0x451f88], eax
cmp eax, edi
je 0x4052b6
push 0x404cce
push 0x451f88
call fcn.004319f0
test eax, eax
jne 0x4052b6
mov dword [0x451f8c], 1
cmp dword [0x451f94], edi
jne 0x4052f5
push 0x444180
push esi
mov dword [0x451f94], edi
call fcn.00432a20
mov dword [0x451f90], eax
cmp eax, edi
je 0x4052f5
push 0x404cfa
push 0x451f90
call fcn.004319f0
test eax, eax
jne 0x4052f5
mov dword [0x451f94], 1
cmp dword [0x451f9c], edi
jne 0x405334
push str.SHSetValueA
push esi
mov dword [0x451f9c], edi
call fcn.00432a20
mov dword [0x451f98], eax
cmp eax, edi
je 0x405334
push 0x404d26
push 0x451f98
call fcn.004319f0
test eax, eax
jne 0x405334
mov dword [0x451f9c], 1
cmp dword [0x451fa4], edi
jne 0x405373
push 0x444198
push esi
mov dword [0x451fa4], edi
call fcn.00432a20
mov dword [0x451fa0], eax
cmp eax, edi
je 0x405373
push 0x404d52
push 0x451fa0
call fcn.004319f0
test eax, eax
jne 0x405373
mov dword [0x451fa4], 1
cmp dword [0x451fac], edi
jne 0x4053b2
push str.RegOpenKeyW
push ebx
mov dword [0x451fac], edi
call fcn.00432a20
mov dword [0x451fa8], eax
cmp eax, edi
je 0x4053b2
push 0x404d7e
push 0x451fa8
call fcn.004319f0
test eax, eax
jne 0x4053b2
mov dword [0x451fac], 1
cmp dword [0x451fb4], edi
jne 0x4053f1
push 0x4441b0
push ebx
mov dword [0x451fb4], edi
call fcn.00432a20
mov dword [0x451fb0], eax
cmp eax, edi
je 0x4053f1
push 0x404da0
push 0x451fb0
call fcn.004319f0
test eax, eax
jne 0x4053f1
mov dword [0x451fb4], 1
cmp dword [0x451fbc], edi
jne 0x405430
push str.RegCreateKeyExW
push ebx
mov dword [0x451fbc], edi
call fcn.00432a20
mov dword [0x451fb8], eax
cmp eax, edi
je 0x405430
push 0x404dc9
push 0x451fb8
call fcn.004319f0
test eax, eax
jne 0x405430
mov dword [0x451fbc], 1
call fcn.00431370
jmp 0x40545f
cmp dword [ebp - 0x1214], 0
je 0x40544c
push dword [ebp - 0x1214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InitUserEnvironment_impersonate_failed__error_code:__d
call fcn.00409297
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042515e
leave
ret