Function at 0x10003d60
Capabilities:
Extract resource via kernel32 functions
Get file size
Link many functions at runtime
Print debug messages
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023234
mov eax, dword fs:[0]
push eax
sub esp, 0xef8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x200
lea eax, [ebp - 0x410]
mov dword [ebp - 0x414], 0
push 0
push eax
mov byte [0x10030e98], 1
call fcn.1000baa0
add esp, 0xc
push str.Loading_configuration..._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, eax
mov dword [ebp - 0xedc], ecx
cmp ecx, 0xffffffff
je 0x10003e22
push 2
push 0
push 0
push ecx
call esi
push 0
lea eax, [ebp - 0x418]
push eax
push 0x1a
push str.Loading_configuration..._r_n
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xedc]
mov dword [ebp - 0xedc], 0
push eax
push 0x10002b80
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0xff
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003e61
sub ecx, edx
sar ecx, 1
je 0x10003ec4
cmp word [ebp + ecx*2 - 0x410], 0x5c
je 0x10003e84
sub ecx, 1
jne 0x10003e72
jmp 0x10003ec4
mov eax, 0xff
lea esi, [ebp - 0x40e]
sub eax, ecx
lea esi, [esi + ecx*2]
add eax, eax
push eax
push 0
push esi
call fcn.1000baa0
movups xmm0, xmmword [str.rdpwrap.ini]
mov eax, dword [0x1002bd58]
add esp, 0xc
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
mov ax, word [0x1002bd5c]
mov word [esi + 0x14], ax
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x400
call fcn.10009692
lea ecx, [ebp - 0x410]
mov dword [ebp - 0xedc], eax
push ecx
push str.Configuration_file:__S_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0x414], eax
cmp eax, 0xffffffff
je 0x10003f58
push 2
push 0
push 0
push eax
call esi
mov edx, dword [ebp - 0xedc]
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003f30
push 0
lea eax, [ebp - 0x418]
sub ecx, esi
mov esi, dword [ebp - 0x414]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xedc]
call fcn.1000969b
push 0x18
call fcn.100096d1
mov esi, eax
add esp, 8
mov dword [ebp - 0x418], esi
push 0
push 0x80
push 3
push 0
push 3
mov dword [ebp - 4], 0
lea eax, [ebp - 0x410]
xorps xmm0, xmm0
mov dword [ebp - 0x414], 0
push 0x80000000
movups xmmword [esi], xmm0
push eax
movq qword [esi + 0x10], xmm0
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x10004072
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x10004072
push eax
call fcn.10009692
add esp, 4
mov dword [esi + 4], eax
lea ecx, [ebp - 0x414]
push 0
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10004072
mov edx, dword [esi]
xor eax, eax
mov ecx, 1
test edx, edx
je 0x10004015
mov edi, dword [esi + 4]
cmp byte [edi + eax], 0xd
jne 0x10004010
cmp byte [edi + eax + 1], 0xa
jne 0x10004010
inc ecx
inc eax
cmp eax, edx
jb 0x10004002
lea eax, [ecx + 1]
mov dword [esi + 8], ecx
mov ecx, 4
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.10009692
mov dword [esi + 0xc], eax
xor edx, edx
add esp, 4
mov edi, 1
mov dword [eax], 0
cmp dword [esi], edx
jbe 0x1000406b
mov eax, dword [esi + 4]
cmp byte [edx + eax], 0xd
jne 0x10004066
cmp byte [edx + eax + 1], 0xa
jne 0x10004066
cmp edi, dword [esi + 8]
jae 0x1000406b
mov eax, dword [esi + 0xc]
lea ecx, [edx + 2]
mov dword [eax + edi*4], ecx
inc edi
inc edx
cmp edx, dword [esi]
jb 0x10004047
mov ecx, esi
call fcn.10001180
push 0x1fe
lea eax, [ebp - 0x6d8]
mov dword [ebp - 4], 0xffffffff
push 0
push eax
mov dword [0x10030eb8], esi
call fcn.1000baa0
add esp, 0xc
lea eax, [ebp - 0x6d8]
mov ecx, esi
push eax
push str.LogFile
push str.Main
call fcn.10001650
test al, al
je 0x1000416c
push 0x1fe
lea eax, [ebp - 0xed8]
push 0
push eax
call fcn.1000baa0
lea ecx, [ebp - 0x6d8]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100040d4
sub ecx, edx
lea eax, [ebp - 0x6d8]
push ecx
push eax
lea eax, [ebp - 0xed8]
push eax
call fcn.1000bc00
lea ecx, [ebp - 0x5d9]
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004100
sub ecx, edx
lea eax, [ebp - 0x5d9]
push ecx
push eax
lea eax, [ebp - 0xdd9]
push eax
call fcn.1000bc00
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1000baa0
push 0xff
lea eax, [ebp - 0xdd9]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.10011dc8
add esp, 0x24
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x210]
lea ecx, [ecx + 2]
mov word [ecx + 0x1002fa66], ax
test ax, ax
jne 0x10004150
jmp 0x10004201
lea eax, [ebp - 0xedc]
mov dword [ebp - 0xedc], 0
push eax
push 0x10002b80
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0xff
push str._rdpwrap.txt
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, str._rdpwrap.txt
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100041b0
sub ecx, edx
sar ecx, 1
je 0x10004201
cmp word [ecx*2 + str._rdpwrap.txt], 0x5c
je 0x100041d3
sub ecx, 1
jne 0x100041c1
jmp 0x10004201
mov esi, 0xff
sub esi, ecx
je 0x10004201
lea edx, [ecx*2 + 0x1002fa6a]
xor eax, eax
mov ecx, esi
mov edi, edx
shr ecx, 1
rep stosd dword es:[edi], eax
push str.rdpwrap.txt
adc ecx, ecx
push esi
rep stosw word es:[edi], ax
push edx
call fcn.10011ac1
add esp, 0xc
push str.Initializing_RDP_Wrapper..._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xedc], eax
cmp eax, 0xffffffff
je 0x1000426d
push 2
push 0
push 0
push eax
call edi
push 0
lea eax, [ebp - 0x418]
push eax
push 0x1d
push str.Initializing_RDP_Wrapper..._r_n
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.termsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10030eb4], eax
test eax, eax
jne 0x100042dc
push str.Error:_Failed_to_load_Terminal_Services_library_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x100053b7
push 2
push 0
push 0
push esi
call edi
push 0
lea eax, [ebp - 0x418]
push eax
push 0x31
push str.Error:_Failed_to_load_Terminal_Services_library_r_n
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100053b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002be10
push eax
call esi
push 0x1002be1c
push dword [0x10030eb4]
mov dword [0x10030ea0], eax
call esi
push 0x1000
mov dword [0x10030e9c], eax
call fcn.10009692
push 0xb0
lea eax, [ebp - 0x4d8]
push 0
push eax
call fcn.1000baa0
add esp, 0xc
lea ecx, [ebp - 0x4d8]
call fcn.10006010
mov edx, str.Base_addr:__0x
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c8]
call fcn.100083a0
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx + eax + 0x14], ecx
push ecx
mov ecx, eax
call fcn.100063c0
mov edx, 0x1002be38
mov ecx, eax
call fcn.100083a0
mov edx, str.SvcMain:____termsrv.dll0x
mov ecx, eax
call fcn.100083a0
mov esi, eax
mov eax, dword [0x10030ea0]
sub eax, dword [0x10030eb4]
push eax
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + esi + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx + esi + 0x14], ecx
mov ecx, esi
call fcn.10006570
mov edx, 0x1002be38
mov ecx, eax
call fcn.100083a0
mov edx, str.SvcGlobals:_termsrv.dll0x
mov ecx, eax
call fcn.100083a0
mov edi, eax
mov eax, dword [0x10030e9c]
sub eax, dword [0x10030eb4]
push eax
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, dword [esi + edi + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [esi + edi + 0x14], ecx
mov ecx, edi
call fcn.10006570
mov edx, 0x1002be38
mov ecx, eax
call fcn.100083a0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov edi, 0xf
mov dword [ebp - 0xee8], 0
movups xmmword [ebp - 0xef8], xmm0
mov dword [ebp - 0xee4], edi
mov byte [ebp - 0xef8], 0
mov dword [ebp - 0x414], 2
mov edx, dword [ebp - 0x484]
mov eax, edx
and al, 0x22
movq qword [ebp - 0xf04], xmm0
mov dword [ebp - 0xefc], 0
cmp al, 2
je 0x10004475
mov eax, dword [ebp - 0x4a0]
mov ecx, dword [eax]
test ecx, ecx
je 0x10004475
mov eax, dword [ebp - 0x4b0]
cmp ecx, dword [ebp - 0x488]
cmovb ecx, dword [ebp - 0x488]
mov edx, dword [eax]
sub ecx, edx
jmp 0x100044a8
test dl, 4
jne 0x1000449c
mov eax, dword [ebp - 0x4a4]
mov esi, dword [eax]
test esi, esi
je 0x1000449c
mov eax, dword [ebp - 0x4b4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x494]
mov ecx, dword [eax]
sub ecx, edx
add ecx, esi
jmp 0x100044a8
mov ecx, dword [ebp - 0xf00]
mov edx, dword [ebp - 0xf04]
test edx, edx
je 0x100044bf
push ecx
push edx
lea ecx, [ebp - 0xef8]
call fcn.10008060
mov edi, dword [ebp - 0xee4]
mov dword [ebp - 4], 1
lea eax, [ebp - 0xef8]
cmp edi, 0xf
cmova eax, dword [ebp - 0xef8]
push eax
mov dword [ebp - 0x414], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xedc], eax
cmp eax, 0xffffffff
je 0x10004560
push 2
push 0
push 0
push eax
call esi
mov edx, dword [ebp - 0x414]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x414], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004530
sub ecx, dword [ebp - 0x414]
lea eax, [ebp - 0x418]
push 0
push eax
push ecx
push edx
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xee4]
cmp ecx, 0xf
jbe 0x1000459a
mov edx, dword [ebp - 0xef8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004590
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100053d2
push ecx
push edx
call fcn.100096a0
add esp, 8
push str.termsrv.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x414], eax
test eax, eax
je 0x1000529e
push 0x10
push 1
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1000529e
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000529e
mov edx, dword [eax + 0x30]
mov dword [0x10030ea4], edx
mov cx, word [eax + 0x36]
mov word [0x10030ea8], cx
mov ax, word [eax + 0x34]
mov word [0x10030eaa], ax
mov eax, edx
shr eax, 0x10
movzx ecx, al
shl cx, 8
movzx eax, dl
or cx, ax
movzx eax, cx
mov dword [ebp - 0x414], eax
test ax, ax
je 0x1000529e
push 0x400
call fcn.10009692
movzx ecx, word [0x10030eaa]
push ecx
movzx ecx, word [0x10030ea8]
push ecx
movzx ecx, word [0x10030ea4]
push ecx
movzx ecx, word [0x10030ea6]
push ecx
push str.Version:_____d._d._d._d_r_n
push eax
mov dword [ebp - 0xedc], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push dword [ebp - 0xedc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0xee0], eax
cmp eax, 0xffffffff
je 0x100046d6
push 2
push 0
push 0
push eax
call esi
mov edx, dword [ebp - 0xedc]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x418], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100046a6
sub ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x41c]
push 0
push eax
push ecx
push edx
push dword [ebp - 0xee0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xee0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xedc]
call fcn.1000969b
add esp, 4
push str.Freezing_threads..._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0xee0], eax
cmp eax, 0xffffffff
je 0x10004744
push 2
push 0
push 0
push eax
call esi
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x15
push str.Freezing_threads..._r_n
push dword [ebp - 0xee0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xee0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor cl, cl
call fcn.10002bc0
push 0x1fe
lea eax, [ebp - 0xad8]
push 0
push eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0xad8]
add esp, 0xc
push eax
push str.SLPolicyHookNT60
push str.Main
call fcn.10001650
test al, al
je 0x1000479b
push 0xa
lea eax, [ebp - 0x9d9]
push 0
push eax
call fcn.1000f70f
add esp, 0xc
test eax, eax
setne cl
jmp 0x1000479d
mov cl, 1
mov eax, 0x600
cmp word [ebp - 0x414], ax
jne 0x1000489b
test cl, cl
je 0x1000489b
push str.slc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SLGetWindowsInformationDWORD
push eax
mov dword [0x10030eb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030ebc], eax
cmp eax, 0xffffffff
je 0x1000489b
push str.Hook_SLGetWindowsInformationDWORD_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0xee0], eax
cmp eax, 0xffffffff
je 0x10004841
push 2
push 0
push 0
push eax
call esi
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x23
push str.Hook_SLGetWindowsInformationDWORD_r_n
push dword [ebp - 0xee0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xee0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x420]
mov byte [0x10030ec0], 0x68
push eax
push 6
push 0x10030ec8
push dword [0x10030ebc]
mov dword [0x10030ec1], 0x10002df0
mov byte [0x10030ec5], 0xc3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x420]
push eax
push 6
push 0x10030ec0
push dword [0x10030ebc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x1fe
lea eax, [ebp - 0x6d8]
push 0
push eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x6d8]
add esp, 0xc
push eax
push str.SLPolicyHookNT61
push str.Main
call fcn.10001650
test al, al
je 0x100048eb
push 0xa
lea eax, [ebp - 0x5d9]
push 0
push eax
call fcn.1000f70f
add esp, 0xc
test eax, eax
setne cl
jmp 0x100048ed
mov cl, 1
mov eax, dword [ebp - 0x414]
mov edx, 0x601
cmp ax, dx
jne 0x100049e9
test cl, cl
je 0x10004a14
push str.slc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SLGetWindowsInformationDWORD
push eax
mov dword [0x10030eb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030ebc], eax
cmp eax, 0xffffffff
je 0x10004a14
push str.Hook_SLGetWindowsInformationDWORD_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0x418], eax
cmp eax, 0xffffffff
je 0x1000498f
push 2
push 0
push 0
push eax
call esi
mov esi, dword [ebp - 0x418]
lea eax, [ebp - 0x41c]
push 0
push eax
push 0x23
push str.Hook_SLGetWindowsInformationDWORD_r_n
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x420]
push eax
push 6
push 0x10030ec8
push dword [0x10030ebc]
mov byte [0x10030ec0], 0x68
mov dword [0x10030ec1], 0x10002df0
mov byte [0x10030ec5], 0xc3
call esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x420]
push eax
push 6
push 0x10030ec0
push dword [0x10030ebc]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x10004a14
mov ecx, 0x602
cmp ax, cx
jne 0x10004a14
push str.slc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SLGetWindowsInformationDWORD
push eax
mov dword [0x10030eb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030ebc], eax
push pe_nt_image_headers32
call fcn.10009692
push pe_nt_image_headers32
mov esi, eax
push 0
push esi
call fcn.1000baa0
movzx ecx, word [0x10030eaa]
movzx eax, word [0x10030ea4]
push ecx
movzx ecx, word [0x10030ea8]
push ecx
push eax
movzx eax, word [0x10030ea6]
push eax
push str._d._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x10030eb8]
add esp, 0x28
push esi
call fcn.10001580
test eax, eax
je 0x10005236
mov ecx, dword [0x10030eb4]
test ecx, ecx
je 0x10005236
mov eax, dword [ecx + 0x3c]
mov dword [0x10030eac], ecx
cmp dword [eax + ecx + 0x1c], 0
jbe 0x10005236
push 0x1fe
lea eax, [ebp - 0x8d8]
push 0
push eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x8d8]
add esp, 0xc
push eax
push str.LocalOnlyPatch.x86
push esi
call fcn.10001650
test al, al
je 0x10004bdd
push 0xa
lea eax, [ebp - 0x7d9]
push 0
push eax
call fcn.1000f70f
add esp, 0xc
test eax, eax
je 0x10004bdd
push str.Patch_CEnforcementCore::GetInstanceOfTSLicense_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0x414], eax
cmp eax, 0xffffffff
je 0x10004b47
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x30
push str.Patch_CEnforcementCore::GetInstanceOfTSLicense_r_n
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x5e4]
push eax
push str.LocalOnlyOffset.x86
push esi
call fcn.10001820
xor ecx, ecx
test al, al
mov eax, dword [0x10030eac]
cmovne ecx, dword [ebp - 0x4e1]
add eax, ecx
mov ecx, dword [0x10030eb8]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0xad8]
push eax
push str.LocalOnlyCode.x86
push esi
call fcn.10001770
test al, al
je 0x10004bdd
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebp - 0x9d9]
push eax
push ecx
call fcn.10001900
test al, al
je 0x10004bdd
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [0x10030eac]
jbe 0x10004bdd
lea eax, [ebp - 0x420]
push eax
movzx eax, byte [ebp - 0xbd9]
push eax
lea eax, [ebp - 0xbd8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x1fe
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
push str.SingleUserPatch.x86
push esi
call fcn.10001650
test al, al
je 0x10004d28
push 0xa
lea eax, [ebp - 0x111]
push 0
push eax
call fcn.1000f70f
add esp, 0xc
test eax, eax
je 0x10004d28
push str.Patch_CSessionArbitrationHelper::IsSingleSessionPerUserEnabled_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0x414], eax
cmp eax, 0xffffffff
je 0x10004c92
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x40
push str.Patch_CSessionArbitrationHelper::IsSingleSessionPerUserEnabled_r_n
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x5e4]
push eax
push str.SingleUserOffset.x86
push esi
call fcn.10001820
xor ecx, ecx
test al, al
mov eax, dword [0x10030eac]
cmovne ecx, dword [ebp - 0x4e1]
add eax, ecx
mov ecx, dword [0x10030eb8]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0xad8]
push eax
push str.SingleUserCode.x86
push esi
call fcn.10001770
test al, al
je 0x10004d28
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebp - 0x9d9]
push eax
push ecx
call fcn.10001900
test al, al
je 0x10004d28
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [0x10030eac]
jbe 0x10004d28
lea eax, [ebp - 0x420]
push eax
movzx eax, byte [ebp - 0xbd9]
push eax
lea eax, [ebp - 0xbd8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x1fe
lea eax, [ebp - 0x8d8]
push 0
push eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x8d8]
add esp, 0xc
push eax
push str.DefPolicyPatch.x86
push esi
call fcn.10001650
test al, al
je 0x10004e73
push 0xa
lea eax, [ebp - 0x7d9]
push 0
push eax
call fcn.1000f70f
add esp, 0xc
test eax, eax
je 0x10004e73
push str.Patch_CDefPolicy::Query_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0x414], eax
cmp eax, 0xffffffff
je 0x10004ddd
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x19
push str.Patch_CDefPolicy::Query_r_n
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x5e4]
push eax
push str.DefPolicyOffset.x86
push esi
call fcn.10001820
xor ecx, ecx
test al, al
mov eax, dword [0x10030eac]
cmovne ecx, dword [ebp - 0x4e1]
add eax, ecx
mov ecx, dword [0x10030eb8]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0xad8]
push eax
push str.DefPolicyCode.x86
push esi
call fcn.10001770
test al, al
je 0x10004e73
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebp - 0x9d9]
push eax
push ecx
call fcn.10001900
test al, al
je 0x10004e73
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [0x10030eac]
jbe 0x10004e73
lea eax, [ebp - 0x420]
push eax
movzx eax, byte [ebp - 0xbd9]
push eax
lea eax, [ebp - 0xbd8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x1fe
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
push str.SLPolicyInternal.x86
push esi
call fcn.10001650
test al, al
je 0x10005055
push 0xa
lea eax, [ebp - 0x111]
push 0
push eax
call fcn.1000f70f
add esp, 0xc
test eax, eax
je 0x10005055
push str.Hook_SLGetWindowsInformationDWORDWrapper_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0x414], eax
cmp eax, 0xffffffff
je 0x10004f28
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x2a
push str.Hook_SLGetWindowsInformationDWORDWrapper_r_n
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
call fcn.10009692
mov ecx, dword [0x10030eb8]
add esp, 4
mov dword [ebp - 0xedc], eax
lea eax, [ebp - 0x5e4]
push eax
push str.SLPolicyOffset.x86
push esi
call fcn.10001820
xor ecx, ecx
mov byte [ebp - 0x428], 0x68
test al, al
mov dword [ebp - 0x427], fcn.10003090
mov eax, dword [0x10030eac]
cmovne ecx, dword [ebp - 0x4e1]
push 0x400
push 0
push dword [ebp - 0xedc]
add eax, ecx
mov byte [ebp - 0x423], 0xc3
mov dword [ebp - 0x418], eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x8d8]
add esp, 0xc
push eax
push str.SLPolicyFunc.x86
push esi
call fcn.10001770
test al, al
lea ecx, [ebp - 0x7d9]
mov edx, str.New_Win8SL
cmove ecx, edx
push ecx
push 0x400
push dword [ebp - 0xedc]
call fcn.10011a67
mov eax, dword [ebp - 0xedc]
add esp, 0xc
mov ecx, str.New_Win8SL_CP
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10005000
test dl, dl
je 0x10004ffc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10005000
add eax, 2
add ecx, 2
test dl, dl
jne 0x10004fe0
xor ecx, ecx
jmp 0x10005005
sbb ecx, ecx
or ecx, 1
mov eax, dword [ebp - 0x427]
test ecx, ecx
push dword [ebp - 0xedc]
mov edx, 0x10003300
cmovne eax, edx
mov dword [ebp - 0x427], eax
call fcn.1000969b
mov eax, dword [ebp - 0x418]
add esp, 4
cmp eax, dword [0x10030eac]
jbe 0x10005055
lea ecx, [ebp - 0x420]
push ecx
push 6
lea ecx, [ebp - 0x428]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x1fe
lea eax, [ebp - 0x8d8]
push 0
push eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x8d8]
add esp, 0xc
push eax
push str.SLInitHook.x86
push esi
call fcn.10001650
test al, al
je 0x10005236
push 0xa
lea eax, [ebp - 0x7d9]
push 0
push eax
call fcn.1000f70f
add esp, 0xc
test eax, eax
je 0x10005236
push str.Hook_CSLQuery::Initialize_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov dword [ebp - 0x414], eax
cmp eax, 0xffffffff
je 0x1000510a
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x1b
push str.Hook_CSLQuery::Initialize_r_n
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
call fcn.10009692
mov ecx, dword [0x10030eb8]
add esp, 4
mov dword [ebp - 0xedc], eax
lea eax, [ebp - 0x5e4]
push eax
push str.SLInitOffset.x86
push esi
call fcn.10001820
xor ecx, ecx
mov byte [ebp - 0x428], 0x68
test al, al
mov dword [ebp - 0x427], 0x10003310
mov eax, dword [0x10030eac]
cmovne ecx, dword [ebp - 0x4e1]
push 0x400
push 0
push dword [ebp - 0xedc]
add eax, ecx
mov byte [ebp - 0x423], 0xc3
mov dword [ebp - 0x418], eax
call fcn.1000baa0
mov ecx, dword [0x10030eb8]
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
push str.SLInitFunc.x86
push esi
call fcn.10001770
test al, al
lea ecx, [ebp - 0x111]
mov edx, str.New_CSLQuery_Initialize
cmove ecx, edx
push ecx
push 0x400
push dword [ebp - 0xedc]
call fcn.10011a67
mov eax, dword [ebp - 0xedc]
add esp, 0xc
mov ecx, str.New_CSLQuery_Initialize
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100051e1
test dl, dl
je 0x100051dd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100051e1
add eax, 2
add ecx, 2
test dl, dl
jne 0x100051c1
xor ecx, ecx
jmp 0x100051e6
sbb ecx, ecx
or ecx, 1
mov eax, dword [ebp - 0x427]
test ecx, ecx
push dword [ebp - 0xedc]
mov edx, 0x10003310
cmovne eax, edx
mov dword [ebp - 0x427], eax
call fcn.1000969b
mov eax, dword [ebp - 0x418]
add esp, 4
cmp eax, dword [0x10030eac]
jbe 0x10005236
lea ecx, [ebp - 0x420]
push ecx
push 6
lea ecx, [ebp - 0x428]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call fcn.1000969b
add esp, 4
push str.Resumimg_threads..._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x10005295
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x15
push str.Resumimg_threads..._r_n
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, 1
call fcn.10002bc0
jmp 0x100052f0
push str.Error:_Failed_to_detect_Terminal_Services_version_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x100052f0
push 2
push 0
push 0
push edi
call esi
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x33
push str.Error:_Failed_to_detect_Terminal_Services_version_r_n
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4d8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x4dc], eax
lea ecx, [ebp - 0x4c0]
call fcn.10005c80
mov eax, dword [ebp - 0x4d8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_iostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ebp + ecx - 0x4dc], eax
mov eax, dword [ebp - 0x4c8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x4cc], eax
mov eax, dword [ebp - 0x4d8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x4dc], eax
lea eax, [ebp - 0x470]
mov dword [ebp - 4], 3
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1000ae3e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10009684
mov esp, ebp
pop ebp
ret
call fcn.100119e3
int3