Function at 0x402892
Capabilities:
Check for sandbox and av modules
Check for sandbox username or hostname
Check if file exists
Check if process is running under wine
Execute anti-debugging instructions
Get file attributes
Get session user name

Disassembly:
push 0x218
mov eax, 0x4250f1
call fcn.00411623
mov dword [ebp - 0x220], ecx
mov ebx, dword [ebp + 8]
and dword [ebp - 0x224], 0
and dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x21c], ebx
xor esi, esi
call fcn.00402bc2
push ecx
push ecx
lea ecx, [ebp - 0x214]
call fcn.004032a3
mov edx, 0x42cb74
lea ecx, [ebp - 0x204]
mov byte [ebp - 4], 1
call fcn.00403ca0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x11c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x42cff0
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x402944
push 0x42cff8
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x402944
push 0x42d000
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
je 0x402947
xor esi, esi
inc esi
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x42d008
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x402991
push 0x42d010
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x402991
push 0x42cff0
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
je 0x402994
add esi, 2
push 0x42d018
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4029a6
add esi, 4
mov ecx, dword [ebp - 0x220]
call fcn.00402df0
test al, al
je 0x4029b8
add esi, 8
call fcn.00402f09
test al, al
je 0x4029c4
add esi, 0x10
and dword [ebp - 0x11c], 0
and dword [ebp - 0x218], 0
rdtsc
mov dword [ebp - 0x11c], eax
rdtsc
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x11c]
cmp eax, 0x64
seta al
test al, al
je 0x4029fb
add esi, 0x20
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [eax], 0xff
jne 0x402a1b
cmp byte [eax + 1], 0x25
jne 0x402a1b
mov eax, dword [eax + 2]
mov eax, dword [eax]
cmp byte [eax], 0x8b
jne 0x402a1e
cmp byte [eax + 1], 0xff
jne 0x402a1e
add esi, 0x40
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x42cf74
call edi
cmp eax, 0xffffffff
jne 0x402a48
push 0x42cf9c
call edi
cmp eax, 0xffffffff
jne 0x402a48
push 0x42cfc4
call edi
cmp eax, 0xffffffff
je 0x402a4b
sub esi, 0xffffff80
push 0x42d024
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x402a6d
push 0x42d034
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
setne al
jmp 0x402a6f
xor al, al
test al, al
je 0x402a79
add esi, 0x100
mov ecx, dword [ebp - 0x220]
call fcn.00402faa
test al, al
je 0x402a8e
add esi, 0x200
push esi
lea eax, [ebp - 0x134]
push eax
call fcn.004027a9
mov byte [ebp - 4], 2
cmp dword [ebp - 0x124], 9
ja 0x402af5
and dword [ebp - 0x13c], 0
push 0xa
pop edi
sub edi, dword [ebp - 0x124]
mov dword [ebp - 0x138], 0xf
mov byte [ebp - 0x14c], 0
mov byte [ebp - 4], 3
xor esi, esi
cmp esi, edi
jae 0x402ae6
mov edx, 0x42cb6c
lea ecx, [ebp - 0x204]
call fcn.00403ca0
inc esi
jmp 0x402acf
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 2
call fcn.00402331
lea edx, [ebp - 0x134]
lea ecx, [ebp - 0x204]
call fcn.00403e55
mov edx, 0x42cb80
lea ecx, [ebp - 0x204]
call fcn.00403ca0
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x214]
call fcn.00403380
and dword [ebx + 0x10], 0
lea eax, [ebp - 0x164]
mov dword [ebx + 0x14], 0xf
push eax
mov ecx, ebx
mov byte [ebx], 0
call fcn.004022e3
lea ecx, [ebp - 0x164]
call fcn.00402331
lea ecx, [ebp - 0x134]
call fcn.00402331
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0
call fcn.00403351
lea eax, [ebp - 0x1ac]
push eax
mov dword [ebp - 0x1ac], 0x42d30c
call fcn.0040c25d
pop ecx
mov eax, ebx
jmp 0x402ba0
call fcn.00411575
ret 4