Function at 0x425eea
Capabilities:
Get session user name
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4cc
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
push edi
mov bl, 1
mov byte [esp + 0x13], 0
jne 0x425f1f
call fcn.004339de
mov dword [esi], eax
test eax, eax
jne 0x425f1a
xor al, al
jmp 0x4262bd
mov byte [esp + 0x13], 1
test byte [ebp + 0xc], 1
mov edi, 0x20000
je 0x425f94
lea eax, [esp + 0xc8]
push eax
call fcn.0041967a
push 0x2711
push esi
lea ecx, [esp + 0xd4]
call fcn.00433a9f
mov bl, al
test bl, bl
je 0x426010
push 0x2725
push esi
mov ecx, 0x401c58
call fcn.00433add
mov bl, al
test bl, bl
je 0x426010
lea eax, [esp + 0x1c]
push eax
call fcn.004197fa
cmp word [esp + 0x1c], 0
je 0x425f90
push 0x2712
push esi
lea ecx, [esp + 0x24]
call fcn.00433a9f
mov bl, al
test bl, bl
je 0x426010
test byte [ebp + 0xc], 2
je 0x425fb9
lea eax, [esp + 0xc]
push eax
push edi
push 0x2713
push 4
pop ebx
mov eax, esi
mov dword [esp + 0x18], 0x1030501
call fcn.004339f2
mov bl, al
test bl, bl
je 0x426010
test byte [ebp + 0xc], 0x80
je 0x425fe3
call fcn.00430ede
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0x2728
push 4
pop ebx
mov eax, esi
call fcn.004339f2
mov bl, al
test bl, bl
je 0x426010
test dword [ebp + 0xc], 0x100
je 0x426010
call fcn.00413c15
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0x2729
push 4
pop ebx
mov eax, esi
call fcn.004339f2
mov bl, al
test byte [ebp + 0xc], 4
je 0x42608f
test bl, bl
je 0x4262aa
call fcn.0042c187
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0x2719
push 4
pop ebx
mov eax, esi
call fcn.004339f2
mov bl, al
test bl, bl
je 0x4262aa
call fcn.0042c1af
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0x271b
push 4
pop ebx
mov eax, esi
call fcn.004339f2
mov bl, al
test bl, bl
je 0x4262aa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0x271a
push 4
pop ebx
mov eax, esi
call fcn.004339f2
mov bl, al
test bl, bl
je 0x4262aa
test byte [ebp + 0xc], 8
je 0x4260ec
lea esi, [esp + 0x14]
call fcn.00413aec
mov eax, esi
push eax
mov eax, dword [ebp + 8]
push edi
push 0x271c
push 6
pop ebx
call fcn.004339f2
mov bl, al
test bl, bl
je 0x4262a7
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebp + 8]
push edi
push 0x271d
push 2
pop ebx
call fcn.004339f2
mov esi, dword [ebp + 8]
mov bl, al
test bl, bl
je 0x4262aa
test byte [ebp + 0xc], 0x10
je 0x42628b
push 0x103
lea eax, [esp + 0x2d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp + 0xc], eax
test eax, eax
je 0x426240
xor ecx, ecx
push 0x271e
mov word [esp + eax*2 + 0x2d4], cx
push esi
lea ecx, [esp + 0x2d8]
call fcn.00433a9f
mov bl, al
xor eax, eax
mov word [esp + 0xc8], ax
push 0x80
lea eax, [esp + 0x4c]
push eax
push 3
lea eax, [esp + 0x2dc]
push eax
call fcn.0042e82d
lea ecx, [esp + 0xc8]
call fcn.0042cc28
lea edx, [esp + eax*2 + 0xc8]
or eax, 0xffffffff
lea ecx, [esp + 0x48]
call fcn.0042c426
lea ecx, [esp + 0xc8]
call fcn.0042cc28
lea edx, [esp + eax*2 + 0xc8]
mov edi, 0x40a2f8
or eax, 0xffffffff
mov ecx, edi
call fcn.0042c426
push 0x80
lea eax, [esp + 0x4c]
push eax
push 1
lea eax, [esp + 0x2dc]
push eax
call fcn.0042e82d
lea ecx, [esp + 0xc8]
call fcn.0042cc28
lea edx, [esp + eax*2 + 0xc8]
or eax, 0xffffffff
lea ecx, [esp + 0x48]
call fcn.0042c426
lea ecx, [esp + 0xc8]
call fcn.0042cc28
lea edx, [esp + eax*2 + 0xc8]
or eax, 0xffffffff
mov ecx, edi
call fcn.0042c426
push 0x80
lea eax, [esp + 0x4c]
push eax
push 2
lea eax, [esp + 0x2dc]
push eax
call fcn.0042e82d
lea ecx, [esp + 0xc8]
call fcn.0042cc28
lea edx, [esp + eax*2 + 0xc8]
or eax, 0xffffffff
lea ecx, [esp + 0x48]
call fcn.0042c426
push 0x2724
push esi
lea ecx, [esp + 0xd0]
call fcn.00433a9f
mov dword [esp + 0xc], 0x104
test bl, bl
je 0x4262aa
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2d4]
push eax
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x42628b
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42628b
xor ecx, ecx
push 0x271f
mov word [esp + eax*2 + 0x2d4], cx
push esi
lea ecx, [esp + 0x2d8]
call fcn.00433a9f
mov bl, al
test bl, bl
je 0x4262aa
test byte [ebp + 0xc], 0x20
je 0x4262bb
push 2
push esi
call fcn.00425e36
push 0x17
push esi
call fcn.00425e36
jmp 0x4262bb
mov esi, dword [ebp + 8]
cmp byte [esp + 0x13], 1
jne 0x4262bb
push dword [esi]
call fcn.0042c085
and dword [esi], 0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8