Function at 0x40f570
Capabilities:
Check for sandbox username or hostname
Check if file exists
Get file attributes
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x440008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x202
mov dword [ebp - 8], 0x101
call fcn.0041a9c3
mov esi, eax
add esp, 4
test esi, esi
je 0x40f5e4
push edi
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40f5da
push 0x20
mov dword [ebp - 0xc], 0x10
call fcn.0041a9c3
mov edi, eax
add esp, 4
test edi, edi
je 0x40f5da
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x40f5f3
push edi
call fcn.0041a9ce
add esp, 4
push esi
call fcn.0041a9ce
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041396d
mov esp, ebp
pop ebp
ret
call fcn.0040f4e0
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40f61e
push esi
call fcn.0041a9ce
push edi
call fcn.0041a9ce
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041396d
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push str.Wilber
push esi
call ebx
test eax, eax
jne 0x40f65c
push 2
push 0x4381d8
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x40f655
push 2
push 0x4381e0
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x40f65c
mov ecx, 1
jmp 0x40f65e
xor ecx, ecx
mov edx, str.Checking_whether_username_is_Wilber_and_NetBIOS_name_starts_with_SC_or_SW
call fcn.00411900
push str.admin
push esi
call ebx
test eax, eax
jne 0x40f68a
push str.SystemIT
push edi
call ebx
xor ecx, ecx
test eax, eax
mov eax, 1
cmove ecx, eax
jmp 0x40f68c
xor ecx, ecx
mov edx, str.Checking_whether_username_is_admin_and_NetBIOS_name_is_SystemIT
call fcn.00411900
push str.admin
push esi
call ebx
test eax, eax
jne 0x40f6ba
push str.KLONE_X64_PC
push dword [ebp - 0x14]
call ebx
xor ecx, ecx
test eax, eax
mov eax, 1
cmove ecx, eax
jmp 0x40f6bc
xor ecx, ecx
mov edx, str.Checking_whether_username_is_admin_and_DNS_hostname_is_KLONE_X64_PC
call fcn.00411900
push str.John
push esi
mov dword [ebp - 0x10], 0
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
jne 0x40f708
push str.C:_take_screenshot.ps1
call ebx
cmp eax, 0xffffffff
je 0x40f708
test al, 0x10
jne 0x40f708
mov ecx, str.C:loaddll.exe
call fcn.00411e60
xor edx, edx
test eax, eax
mov eax, 1
cmovne edx, eax
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov edx, str.Checking_whether_username_is_John_and_two_sandbox_files_exist
call fcn.00411900
push str.C:email.doc
mov dword [ebp - 0x10], 0
call ebx
cmp eax, 0xffffffff
je 0x40f763
test al, 0x10
jne 0x40f763
push str.C:email.htm
call ebx
cmp eax, 0xffffffff
je 0x40f763
test al, 0x10
jne 0x40f763
mov ecx, str.C:123email.doc
call fcn.00411e60
test eax, eax
je 0x40f763
mov ecx, str.C:123email.docx
call fcn.00411e60
xor edx, edx
test eax, eax
mov eax, 1
cmovne edx, eax
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov edx, str.Checking_whether_four_known_sandbox_email_file_paths_exist
call fcn.00411900
push str.C:_a_foobar.bmp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f7ae
test al, 0x10
jne 0x40f7ae
push str.C:_a_foobar.doc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f7ae
test al, 0x10
jne 0x40f7ae
mov ecx, str.C:_a_foobar.gif
call fcn.00411e60
test eax, eax
mov eax, 1
cmovne ebx, eax
mov edx, str.Checking_whether_three_known_sandbox_foobar_files_exist
mov ecx, ebx
call fcn.00411900
push esi
call fcn.0041a9ce
push edi
call fcn.0041a9ce
push dword [ebp - 0x14]
call fcn.0041a9ce
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.0041396d
mov esp, ebp
pop ebp
ret