Function at 0x10003510
Capabilities:
Extract resource via kernel32 functions
Get file size
Link many functions at runtime
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x818
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x1fe
push eax
mov word [esp + 0x430], ax
lea eax, [esp + 0x432]
push eax
mov byte [0x1000601e], 1
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x10002f00
push 4
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0xff
lea eax, [esp + 0x42c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
test ecx, ecx
je 0x100035db
lea esp, [esp]
cmp word [esp + ecx*2 + 0x428], 0x5c
je 0x100035a0
dec ecx
jne 0x10003590
jmp 0x100035db
mov eax, 0xff
sub eax, ecx
add eax, eax
push eax
lea esi, [esp + 0x42e]
push 0
lea esi, [esi + ecx*2]
push esi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x1000490c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, eax
push eax
push str.termserv.ini
push esi
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [esp + 0x440]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10003dd5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x10006060], eax
cmp eax, 0xffffffff
je 0x10003dd5
test eax, eax
jne 0x1000362d
xor ecx, ecx
jmp 0x10003644
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [0x10006060]
push 0
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push esi
mov dword [0x10006058], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10003dd5
call fcn.10001f60
call fcn.10002200
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.termsrv.dll
call ebp
mov dword [0x10006040], eax
test eax, eax
je 0x10003dd5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10004950
push eax
call esi
push 0x1000495c
push dword [0x10006040]
mov dword [0x10006024], eax
call esi
push str.termsrv.dll
mov dword [0x10006020], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x10003dd5
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10003dd5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10003dd5
mov edx, dword [eax + 0x30]
mov dword [0x10006038], edx
mov cx, word [eax + 0x36]
mov word [0x1000603c], cx
movzx eax, word [eax + 0x34]
shr edx, 0x10
movzx ecx, dl
mov word [0x1000603e], ax
movzx eax, byte [0x10006038]
shl cx, 8
or cx, ax
movzx ebx, cx
mov dword [esp + 0x18], ebx
test bx, bx
je 0x10003dd5
xor cl, cl
call fcn.10002f20
push 0xff
lea eax, [esp + 0x2c]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x127]
push 0xff
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov edx, str.SLPolicyHookNT60
mov ecx, str.Main
call fcn.10002590
add esp, 4
test al, al
je 0x10003791
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x12f]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntExA]
cmp dword [esp + 0x14], 0
setne al
jmp 0x10003793
mov al, 1
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, 0x600
cmp bx, cx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jne 0x10003810
test al, al
je 0x10003810
push str.slc.dll
call ebp
push str.SLGetWindowsInformationDWORD
push eax
mov dword [0x10006044], eax
call esi
mov dword [0x10006028], eax
cmp eax, 0xffffffff
je 0x10003810
lea ecx, [esp + 0x24]
push ecx
push 6
push 0x10006018
push eax
mov byte [0x1000602c], 0x68
mov dword [0x1000602d], 0x10002fd0
mov byte [0x10006031], 0xc3
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esp + 0x24]
push eax
push 6
push 0x1000602c
push dword [0x10006028]
call edi
push eax
call ebx
push 0xff
lea eax, [esp + 0x2c]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x127]
push 0xff
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov edx, str.SLPolicyHookNT61
mov ecx, str.Main
call fcn.10002590
add esp, 4
test al, al
je 0x10003875
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x12f]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntExA]
cmp dword [esp + 0x14], 0
setne al
jmp 0x10003877
mov al, 1
mov ecx, dword [esp + 0x18]
mov edx, 0x601
mov byte [esp + 0x13], al
cmp cx, dx
jne 0x100038f6
test al, al
je 0x10003919
push str.slc.dll
call ebp
push str.SLGetWindowsInformationDWORD
push eax
mov dword [0x10006044], eax
call esi
mov dword [0x10006028], eax
cmp eax, 0xffffffff
je 0x10003919
lea ecx, [esp + 0x24]
push ecx
push 6
push 0x10006018
push eax
mov byte [0x1000602c], 0x68
mov dword [0x1000602d], 0x10002fd0
mov byte [0x10006031], 0xc3
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esp + 0x24]
push eax
push 6
push 0x1000602c
push dword [0x10006028]
call edi
push eax
call ebx
jmp 0x10003919
mov eax, 0x602
cmp cx, ax
jne 0x10003919
push str.slc.dll
call ebp
push str.SLGetWindowsInformationDWORD
push eax
mov dword [0x10006044], eax
call esi
mov dword [0x10006028], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x100
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x100
mov esi, eax
push 0
push esi
call sub.ntdll.dll_memset
movzx ecx, word [0x1000603e]
movzx eax, word [0x10006038]
add esp, 0xc
push ecx
movzx ecx, word [0x1000603c]
push ecx
push eax
movzx eax, word [0x1000603a]
push eax
push str._d._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov ecx, esi
call fcn.100024c0
test eax, eax
je 0x10003dbe
mov ecx, dword [0x10006040]
test ecx, ecx
je 0x10003dbe
mov eax, dword [ecx + 0x3c]
mov dword [0x10006034], ecx
cmp dword [eax + ecx + 0x1c], 0
jbe 0x10003dbe
lea eax, [esp + 0x13]
push eax
mov edx, str.LocalOnlyPatch.x86
mov ecx, esi
call fcn.10002c20
add esp, 4
test al, al
jne 0x100039c2
mov byte [esp + 0x13], al
jmp 0x10003a5e
cmp byte [esp + 0x13], 0
je 0x10003a5e
lea eax, [esp + 0x28]
push eax
mov edx, str.LocalOnlyOffset.x86
mov ecx, esi
call fcn.100027e0
xor ecx, ecx
add esp, 4
test al, al
cmovne ecx, dword [esp + 0x12c]
mov eax, dword [0x10006034]
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x628]
push eax
mov edx, str.LocalOnlyCode.x86
mov ecx, esi
call fcn.100026c0
add esp, 4
mov byte [esp + 0x13], al
test al, al
je 0x10003a5e
lea eax, [esp + 0x228]
push eax
lea edx, [esp + 0x72b]
call fcn.100028a0
add esp, 4
mov byte [esp + 0x13], al
test al, al
je 0x10003a5e
mov ecx, dword [esp + 0x18]
cmp ecx, dword [0x10006034]
jbe 0x10003a5e
lea eax, [esp + 0x24]
push eax
movzx eax, byte [esp + 0x32b]
push eax
lea eax, [esp + 0x330]
push eax
push ecx
call edi
push eax
call ebx
lea eax, [esp + 0x13]
push eax
mov edx, str.SingleUserPatch.x86
mov ecx, esi
call fcn.10002c20
add esp, 4
test al, al
jne 0x10003a7f
mov byte [esp + 0x13], al
jmp 0x10003b1b
cmp byte [esp + 0x13], 0
je 0x10003b1b
lea eax, [esp + 0x28]
push eax
mov edx, str.SingleUserOffset.x86
mov ecx, esi
call fcn.100027e0
xor ecx, ecx
add esp, 4
test al, al
cmovne ecx, dword [esp + 0x12c]
mov eax, dword [0x10006034]
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x628]
push eax
mov edx, str.SingleUserCode.x86
mov ecx, esi
call fcn.100026c0
add esp, 4
mov byte [esp + 0x13], al
test al, al
je 0x10003b1b
lea eax, [esp + 0x228]
push eax
lea edx, [esp + 0x72b]
call fcn.100028a0
add esp, 4
mov byte [esp + 0x13], al
test al, al
je 0x10003b1b
mov ecx, dword [esp + 0x18]
cmp ecx, dword [0x10006034]
jbe 0x10003b1b
lea eax, [esp + 0x24]
push eax
movzx eax, byte [esp + 0x32b]
push eax
lea eax, [esp + 0x330]
push eax
push ecx
call edi
push eax
call ebx
lea eax, [esp + 0x13]
push eax
mov edx, str.DefPolicyPatch.x86
mov ecx, esi
call fcn.10002c20
add esp, 4
test al, al
jne 0x10003b3c
mov byte [esp + 0x13], al
jmp 0x10003bd8
cmp byte [esp + 0x13], 0
je 0x10003bd8
lea eax, [esp + 0x28]
push eax
mov edx, str.DefPolicyOffset.x86
mov ecx, esi
call fcn.100027e0
xor ecx, ecx
add esp, 4
test al, al
cmovne ecx, dword [esp + 0x12c]
mov eax, dword [0x10006034]
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x628]
push eax
mov edx, str.DefPolicyCode.x86
mov ecx, esi
call fcn.100026c0
add esp, 4
mov byte [esp + 0x13], al
test al, al
je 0x10003bd8
lea eax, [esp + 0x228]
push eax
lea edx, [esp + 0x72b]
call fcn.100028a0
add esp, 4
mov byte [esp + 0x13], al
test al, al
je 0x10003bd8
mov ecx, dword [esp + 0x18]
cmp ecx, dword [0x10006034]
jbe 0x10003bd8
lea eax, [esp + 0x24]
push eax
movzx eax, byte [esp + 0x32b]
push eax
lea eax, [esp + 0x330]
push eax
push ecx
call edi
push eax
call ebx
lea eax, [esp + 0x13]
push eax
mov edx, str.SLPolicyInternal.x86
mov ecx, esi
call fcn.10002c20
add esp, 4
test al, al
jne 0x10003bf9
mov byte [esp + 0x13], al
jmp 0x10003cde
cmp byte [esp + 0x13], 0
je 0x10003cde
push 0x400
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push eax
mov edx, str.SLPolicyOffset.x86
mov ecx, esi
call fcn.100027e0
push dword [esp + 0x18]
xor ecx, ecx
test al, al
cmovne ecx, dword [esp + 0x134]
mov eax, dword [0x10006034]
add eax, ecx
push str.New_Win8SL
mov edx, str.SLPolicyFunc.x86
mov ecx, esi
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], 0x68
mov dword [esp + 0x29], 0x10003090
mov byte [esp + 0x2d], 0xc3
call fcn.10002e90
add esp, 0xc
push str.New_Win8SL
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ecx, dword [esp + 0x1d]
mov edx, 0x10003090
test eax, eax
push str.New_Win8SL_CP
push dword [esp + 0x18]
cmovne ecx, edx
mov dword [esp + 0x25], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ecx, dword [esp + 0x1d]
test eax, eax
mov eax, dword [esp + 0x14]
mov edx, 0x10003110
cmovne ecx, edx
mov dword [esp + 0x1d], ecx
test eax, eax
je 0x10003cc0
push eax
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
cmp eax, dword [0x10006034]
jbe 0x10003cde
lea ecx, [esp + 0x24]
push ecx
push 6
lea ecx, [esp + 0x24]
push ecx
push eax
call edi
push eax
call ebx
lea eax, [esp + 0x13]
push eax
mov edx, str.SLInitHook.x86
mov ecx, esi
call fcn.10002c20
add esp, 4
test al, al
je 0x10003dbe
cmp byte [esp + 0x13], 0
je 0x10003dbe
push 0x400
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push eax
mov edx, str.SLInitOffset.x86
mov ecx, esi
call fcn.100027e0
push dword [esp + 0x18]
xor ecx, ecx
test al, al
cmovne ecx, dword [esp + 0x134]
mov eax, dword [0x10006034]
add eax, ecx
push str.New_CSLQuery_Initialize
mov edx, str.SLInitFunc.x86
mov ecx, esi
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], 0x68
mov dword [esp + 0x29], 0x10003190
mov byte [esp + 0x2d], 0xc3
call fcn.10002e90
add esp, 0xc
push str.New_CSLQuery_Initialize
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ecx, dword [esp + 0x1d]
test eax, eax
mov eax, dword [esp + 0x14]
mov edx, 0x10003190
cmovne ecx, edx
mov dword [esp + 0x1d], ecx
test eax, eax
je 0x10003da0
push eax
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
cmp eax, dword [0x10006034]
jbe 0x10003dbe
lea ecx, [esp + 0x24]
push ecx
push 6
lea ecx, [esp + 0x24]
push ecx
push eax
call edi
push eax
call ebx
test esi, esi
je 0x10003dce
push esi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov cl, 1
call fcn.10002f20
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret