Function at 0x180002590
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x180025208]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov byte [0x180025ccc], 1
call fcn.180002c80
test al, al
je 0x180002c5a
lea rcx, str.Initializing_RDP_Wrapper..._r_n
mov qword [rsp + 0x380], rbx
call fcn.180003a40
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x208
call fcn.1800054c0
mov edx, 0x104
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.termsrv.dll
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x180002629
lea rcx, str.Error:_Failed_to_load_Terminal_Services_library_r_n
jmp 0x180002c4d
lea rdx, [0x1800197c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800197d8]
mov rcx, rbx
mov qword [0x180025d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, qword [0x180025d10]
lea rcx, str.Base_addr:__0x_p_r_nSvcMain:____termsrv.dll0x_p_r_nSvcGlobals:_termsrv.dll0x_p_r_n
mov qword [0x180025d18], rax
sub r8, rbx
sub rax, rbx
mov rdx, rbx
mov r9, rax
call fcn.180003a40
lea r8, [0x180025d00]
mov rcx, rbx
lea rdx, [0x180025cf8]
call fcn.1800036e0
test al, al
jne 0x18000269c
lea rcx, str.Error:_Failed_to_get_Terminal_Services_library_information_r_n
jmp 0x180002c4d
lea rdx, [0x180025d08]
lea rcx, str.termsrv.dll
call fcn.180003710
test eax, eax
je 0x180002c46
movzx edx, word [0x180025d0a]
mov rax, qword [0x180025d08]
movzx ebx, dl
shl bx, 8
movzx ecx, al
or bx, cx
je 0x180002c46
movzx ecx, word [0x180025d0e]
movzx r9d, word [0x180025d0c]
mov dword [rsp + 0x20], ecx
lea rcx, str.Version:_____d._d._d._d_r_n
mov qword [rsp + 0x388], rsi
movzx r8d, ax
mov qword [rsp + 0x390], rdi
call fcn.180003a40
lea rcx, str.Freezing_threads..._r_n
call fcn.180003a40
xor ecx, ecx
call fcn.180003880
mov rcx, qword [0x180025ce8]
lea r9, [rsp + 0x30]
lea r8, str.SLPolicyHookNT60
lea rdx, str.Main
call fcn.180001960
movzx ecx, byte [rsp + 0x30]
lea rdi, [0x180003270]
test al, al
mov esi, 1
mov eax, 0x600
cmove ecx, esi
mov byte [rsp + 0x30], cl
cmp bx, ax
jne 0x180002819
test cl, cl
je 0x180002819
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [0x180025cf0], rax
lea rdx, str.SLGetWindowsInformationDWORD
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025ce0], rax
cmp rax, 0xffffffffffffffff
je 0x180002819
lea rcx, str.Hook_SLGetWindowsInformationDWORD_r_n
call fcn.180003a40
mov word [0x180025cd0], 0xb848
mov qword [0x180025cd2], rdi
mov word [0x180025cda], 0xc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [0x180025ce0]
lea r9d, [rsi + 0xb]
mov rcx, rax
lea r8, [0x180025cc0]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [0x180025ce0]
lea r9d, [rsi + 0xb]
mov rcx, rax
lea r8, [0x180025cd0]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x180025ce8]
lea r9, [rsp + 0x30]
lea r8, str.SLPolicyHookNT61
lea rdx, str.Main
call fcn.180001960
movzx r8d, byte [rsp + 0x30]
test al, al
mov eax, 0x601
cmove r8d, esi
mov rsi, qword [rsp + 0x388]
mov byte [rsp + 0x30], r8b
cmp bx, ax
jne 0x18000291e
test r8b, r8b
je 0x180002953
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [0x180025cf0], rax
lea rdx, str.SLGetWindowsInformationDWORD
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025ce0], rax
cmp rax, 0xffffffffffffffff
je 0x180002953
lea rcx, str.Hook_SLGetWindowsInformationDWORD_r_n
call fcn.180003a40
mov word [0x180025cd0], 0xb848
mov qword [0x180025cd2], rdi
mov word [0x180025cda], 0xc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [0x180025ce0]
lea r8, [0x180025cc0]
mov rcx, rax
mov r9d, 0xc
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [0x180025ce0]
lea r8, [0x180025cd0]
mov rcx, rax
mov r9d, 0xc
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180002953
mov eax, 0x602
cmp bx, ax
jne 0x180002953
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [0x180025cf0], rax
lea rdx, str.SLGetWindowsInformationDWORD
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025ce0], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.1800054c0
movzx ecx, word [0x180025d0c]
lea rdx, str._d._d._d._d
movzx eax, word [0x180025d0e]
movzx r9d, word [0x180025d08]
movzx r8d, word [0x180025d0a]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [0x180025ce8]
lea rdx, [rsp + 0x50]
call fcn.1800022f0
test al, al
je 0x180002c29
cmp qword [0x180025cf8], 0
je 0x180002c29
cmp qword [0x180025d00], 0
je 0x180002c29
lea rax, str.Patch_CEnforcementCore::GetInstanceOfTSLicense_r_n
lea r9, str.LocalOnlyCode.x64
mov qword [rsp + 0x20], rax
lea r8, str.LocalOnlyOffset.x64
lea rdx, str.LocalOnlyPatch.x64
lea rcx, [rsp + 0x50]
call fcn.1800034b0
lea rax, str.Patch_CSessionArbitrationHelper::IsSingleSessionPerUserEnabled_r_n
lea r9, str.SingleUserCode.x64
mov qword [rsp + 0x20], rax
lea r8, str.SingleUserOffset.x64
lea rdx, str.SingleUserPatch.x64
lea rcx, [rsp + 0x50]
call fcn.1800034b0
lea rax, str.Patch_CDefPolicy::Query_r_n
lea r9, str.DefPolicyCode.x64
mov qword [rsp + 0x20], rax
lea r8, str.DefPolicyOffset.x64
lea rdx, str.DefPolicyPatch.x64
lea rcx, [rsp + 0x50]
call fcn.1800034b0
mov rcx, qword [0x180025ce8]
lea r9, [rsp + 0x30]
lea r8, str.SLPolicyInternal.x64
lea rdx, [rsp + 0x50]
call fcn.180001960
test al, al
je 0x180002b3e
cmp byte [rsp + 0x30], 0
je 0x180002b3e
lea rcx, str.Hook_SLGetWindowsInformationDWORDWrapper_r_n
call fcn.180003a40
mov ecx, 0x400
call fcn.180003bb4
mov rcx, qword [0x180025ce8]
lea r8, str.SLPolicyOffset.x64
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rbx, rax
call fcn.180003790
mov rcx, qword [0x180025ce8]
lea r9, str.New_Win8SL
mov edi, eax
lea r8, str.SLPolicyFunc.x64
add rdi, qword [0x180025cf8]
lea rax, [0x1800033c0]
mov dword [rsp + 0x28], 0x400
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x3a], rax
mov word [rsp + 0x38], 0xb848
mov word [rsp + 0x42], 0xc350
mov qword [rsp + 0x20], rbx
call fcn.1800037e0
mov rcx, rbx
call fcn.180003bac
cmp rdi, qword [0x180025cf8]
jbe 0x180002b3e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x180025ce8]
lea r9, [rsp + 0x30]
lea r8, str.SLInitHook.x64
lea rdx, [rsp + 0x50]
call fcn.180001960
test al, al
je 0x180002c29
cmp byte [rsp + 0x30], 0
je 0x180002c29
lea rcx, str.Hook_CSLQuery::Initialize_r_n
call fcn.180003a40
mov ecx, 0x400
call fcn.180003bb4
mov rcx, qword [0x180025ce8]
lea r8, str.SLInitOffset.x64
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rbx, rax
call fcn.180003790
mov rcx, qword [0x180025ce8]
lea r9, str.New_CSLQuery_Initialize
mov edi, eax
lea r8, str.SLInitFunc.x64
add rdi, qword [0x180025cf8]
lea rax, [0x180002ea0]
mov dword [rsp + 0x28], 0x400
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x3a], rax
mov word [rsp + 0x38], 0xb848
mov word [rsp + 0x42], 0xc350
mov qword [rsp + 0x20], rbx
call fcn.1800037e0
mov rcx, rbx
call fcn.180003bac
cmp rdi, qword [0x180025cf8]
jbe 0x180002c29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Resumimg_threads..._r_n
call fcn.180003a40
mov cl, 1
call fcn.180003880
mov rdi, qword [rsp + 0x390]
jmp 0x180002c52
lea rcx, str.Error:_Failed_to_detect_Terminal_Services_version_r_n
call fcn.180003a40
mov rbx, qword [rsp + 0x380]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.180003c50
add rsp, 0x370
pop rbp
ret