Function at 0x40e561
Capabilities:
Get session user name
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
mov bl, 1
mov byte [ebp - 5], 0
jne 0x40e591
call fcn.0040ae70
mov dword [edi], eax
test eax, eax
jne 0x40e58d
xor al, al
jmp 0x40e7f2
mov byte [ebp - 5], 1
test byte [ebp + 0xc], 1
je 0x40e60c
mov ecx, dword [0x422730]
push 0x65
push 0
lea esi, [ebp - 0x118]
or eax, 0xffffffff
call fcn.00403f96
mov eax, dword [0x422728]
movzx cx, byte [eax + 8]
mov word [ebp - 0x48], cx
movzx cx, byte [eax + 9]
mov word [ebp - 0x46], cx
movzx cx, byte [eax + 0xa]
mov word [ebp - 0x44], cx
movzx ax, byte [eax + 0xb]
mov word [ebp - 0x42], ax
push 0x2711
xor eax, eax
push edi
mov ecx, esi
mov word [ebp - 0x40], ax
call fcn.0040aeef
mov bl, al
test bl, bl
je 0x40e632
cmp word [ebp - 0x48], 0
je 0x40e608
push 0x2712
push edi
lea ecx, [ebp - 0x48]
call fcn.0040aeef
mov bl, al
test bl, bl
je 0x40e632
test byte [ebp + 0xc], 2
je 0x40e632
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push 4
pop edi
mov ebx, 0x2713
mov dword [ebp - 4], 0x1030100
call fcn.0040ae83
mov edi, dword [ebp + 8]
mov bl, al
test byte [ebp + 0xc], 4
je 0x40e6a8
test bl, bl
je 0x40e7e0
call fcn.00403e92
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push 4
pop edi
mov ebx, 0x2719
call fcn.0040ae83
mov bl, al
test bl, bl
je 0x40e7dd
call fcn.00403ed1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov ebx, 0x271b
call fcn.0040ae83
mov bl, al
test bl, bl
je 0x40e7dd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov ebx, 0x271a
call fcn.0040ae83
mov edi, dword [ebp + 8]
mov bl, al
test bl, bl
je 0x40e7e0
test byte [ebp + 0xc], 8
je 0x40e74f
lea eax, [ebp - 0x168]
push eax
mov dword [ebp - 0x168], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x164]
movzx ecx, word [ebp - 0x54]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp - 0x52]
shl eax, 0x10
or eax, ecx
movzx ecx, word [ebp - 0x50]
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp - 0x4e]
shl eax, 0x10
or eax, ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
push 0x14
pop edi
mov ebx, 0x271c
call fcn.0040ae83
mov bl, al
test bl, bl
je 0x40e7dd
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push 2
pop edi
mov ebx, 0x271d
call fcn.0040ae83
mov edi, dword [ebp + 8]
mov bl, al
test bl, bl
je 0x40e7e0
test byte [ebp + 0xc], 0x10
je 0x40e7d7
mov esi, 0x103
push esi
lea eax, [ebp - 0x250]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], eax
test eax, eax
jbe 0x40e796
xor ecx, ecx
push 0x271e
mov word [ebp + eax*2 - 0x250], cx
push edi
lea ecx, [ebp - 0x250]
call fcn.0040aeef
mov bl, al
mov dword [ebp - 4], esi
test bl, bl
je 0x40e7e0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x250]
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x40e7d7
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x40e7d7
xor ecx, ecx
push 0x2721
mov word [ebp + eax*2 - 0x250], cx
push edi
lea ecx, [ebp - 0x250]
call fcn.0040aeef
mov bl, al
test bl, bl
jne 0x40e7f0
jmp 0x40e7e0
mov edi, dword [ebp + 8]
cmp byte [ebp - 5], 1
jne 0x40e7f0
push dword [edi]
call fcn.00403dc8
and dword [edi], 0
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 8