Function at 0x10002b70
Capabilities:
Check for peb beingdebugged flag
Extract resource via kernel32 functions
Link many functions at runtime
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x1000e76e
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x1001303c]
xor eax, esp
mov dword [esp + 0x620], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1001303c]
xor eax, esp
push eax
lea eax, [esp + 0x638]
mov dword fs:[0], eax
push 0xff
push str.LckDeskSrv.txt
push str._SystemRoot_SysWow64FseLocalLogLckDeskSrv.log
mov byte [0x10014c90], 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x43e]
push ecx
mov word [esp + 0x440], ax
call fcn.10008b50
add esp, 0xc
mov ebx, str.Loading_configuration..._r_n
call fcn.10002190
lea edx, [esp + 0x30]
push edx
push 0x10002370
xor edi, edi
push 4
mov dword [esp + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov ecx, dword [esp + 0x30]
push 0xff
lea eax, [esp + 0x438]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x434]
lea edx, [eax + 2]
jmp 0x10002c30
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10002c30
sub eax, edx
sar eax, 1
je 0x10002c82
mov ecx, 0x5c
cmp word [esp + eax*2 + 0x434], cx
je 0x10002c57
sub eax, 1
jne 0x10002c46
jmp 0x10002c82
mov edx, 0xff
sub edx, eax
add edx, edx
push edx
lea esi, [esp + eax*2 + 0x43a]
push edi
push esi
call fcn.10008b50
add esp, 0xc
push 0x32
push str.LckDeskTopLckDeskSrv.ini
push esi
call fcn.100095b0
add esp, 0xc
lea eax, [esp + 0x434]
push eax
push str.Configuration_file:__S_r_n
call fcn.100022e0
push 0x18
call fcn.10003a24
mov ecx, eax
add esp, 0xc
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x640], edi
cmp ecx, edi
je 0x10002cbd
lea eax, [esp + 0x434]
call fcn.10001010
jmp 0x10002cbf
xor eax, eax
mov dword [esp + 0x640], 0xffffffff
mov dword [0x10014c74], eax
cmp eax, edi
jne 0x10002cec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error__Failed_to_load_configuration_Error:_08x
call fcn.100022e0
add esp, 8
jmp 0x100038bb
mov ebx, str.Initializing_RDP_Wrapper..._r_n
call fcn.10002190
push str.termsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10014c70], eax
test eax, eax
jne 0x10002d23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error__Failed_to_load_Terminal_Services_library_error:_08x_r_n
call fcn.100022e0
add esp, 8
jmp 0x100038bb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100110e8
push eax
call esi
mov ecx, dword [0x10014c70]
push 0x100110f4
push ecx
mov dword [0x10014c5c], eax
call esi
mov ecx, dword [0x10014c70]
mov edx, dword [0x10014c5c]
mov dword [0x10014c58], eax
sub eax, ecx
push eax
sub edx, ecx
push edx
push ecx
push str.Base_addr:__0x_p_r_n_tSvcMain:____termsrv.dll0x_p_r_n_tSvcGlobals:_termsrv.dll0x_p_r_n
call fcn.100022e0
add esp, 0x10
push str.termsrv.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x10002dd5
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10002dd5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10002dd5
mov ecx, dword [eax + 0x30]
mov dword [0x10014c60], ecx
movzx si, byte [0x10014c60]
mov dx, word [eax + 0x36]
shr ecx, 0x10
movzx cx, cl
shl cx, 8
or cx, si
movzx ebp, cx
mov word [0x10014c64], dx
mov ax, word [eax + 0x34]
mov word [0x10014c66], ax
mov dword [esp + 0x2c], ebp
test bp, bp
jne 0x10002dee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_Failed_to_detect_Terminal_Services_version_error:_08x__r_n
call fcn.100022e0
add esp, 8
jmp 0x100038bb
movzx eax, ax
push eax
movzx eax, word [0x10014c62]
movzx ecx, dx
movzx edx, word [0x10014c60]
push ecx
push edx
push eax
push str.Version:_____d._d._d._d_r_n
call fcn.100022e0
add esp, 0x14
mov ebx, str.Freezing_threads..._r_n
call fcn.10002190
push 0
call fcn.10002390
add esp, 4
lea ecx, [esp + 0x1b]
push ecx
mov edi, str.SLPolicyHookNT60
mov esi, str.Main
call fcn.10001e10
test al, al
jne 0x10002e51
push str._ERROR__GetVariableInSection_SLPolicyHookNT60_failed_r_n
call fcn.100022e0
add esp, 4
mov byte [esp + 0x1b], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x600
cmp bp, dx
jne 0x10002f59
cmp byte [esp + 0x1b], 0
je 0x10002f59
push str.slc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10014c6c], eax
test eax, eax
jne 0x10002e9f
call edi
push eax
push str._ERROR__LoadLibrary_slc.dll_failed__error:_08x_r_n
call fcn.100022e0
add esp, 8
jmp 0x10002f59
push str.SLGetWindowsInformationDWORD
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10014c78], eax
test eax, eax
jne 0x10002ec9
call edi
push eax
push str._ERROR__GetProcAddress_slc.dll:SLGetWindowsInformationDWORD_failed__error:_08x_r_n
call fcn.100022e0
add esp, 8
jmp 0x10002f59
mov ebx, str.Hook_SLGetWindowsInformationDWORD_r_n
call fcn.10002190
mov ecx, dword [0x10014c78]
lea eax, [esp + 0x1c]
push eax
push 6
push 0x10014c84
push ecx
mov byte [0x10014c7c], 0x68
mov dword [0x10014c7d], 0x10002540
mov byte [0x10014c81], 0xc3
call esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x10002f22
mov edx, dword [0x10014c78]
push edx
call edi
push eax
push str._ERROR__Hook_SLGetWindowsInformationDWORD_ReadProcessMemory__error:_08x__SLGetWindowsInformationDWORD:_p_r_n
call fcn.100022e0
add esp, 0xc
mov ecx, dword [0x10014c78]
lea eax, [esp + 0x1c]
push eax
push 6
push 0x10014c7c
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10002f59
mov edx, dword [0x10014c78]
push edx
call edi
push eax
push str._ERROR__Hook_SLGetWindowsInformationDWORD_ReadProcessMemory__error:_08x__SLGetWindowsInformationDWORD:_p_r_n
call fcn.100022e0
add esp, 0xc
lea eax, [esp + 0x1b]
push eax
mov edi, str.SLPolicyHookNT61
mov esi, str.Main
call fcn.10001e10
test al, al
jne 0x10002f76
mov byte [esp + 0x1b], 1
mov ecx, 0x601
cmp bp, cx
jne 0x10003088
cmp byte [esp + 0x1b], 0
je 0x100030b3
push str.slc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10014c6c], eax
test eax, eax
jne 0x10002fbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__LoadLibrary_slc.dll_failed__error:_08x_r_n
call fcn.100022e0
add esp, 8
jmp 0x100030b3
push str.SLGetWindowsInformationDWORD
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10014c78], eax
test eax, eax
jne 0x10002fea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__GetProcAddress_slc.dll:SLGetWindowsInformationDWORD_failed__error:_08x_r_n
call fcn.100022e0
add esp, 8
jmp 0x100030b3
mov ebx, str.Hook_SLGetWindowsInformationDWORD_r_n
call fcn.10002190
mov eax, dword [0x10014c78]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x1c]
push edx
push 6
push 0x10014c84
push eax
mov byte [0x10014c7c], 0x68
mov dword [0x10014c7d], 0x10002540
mov byte [0x10014c81], 0xc3
call esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1000304c
mov ecx, dword [0x10014c78]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Hook_SLGetWindowsInformationDWORD_ReadProcessMemory__error:_08x__SLGetWindowsInformationDWORD:_p_r_n
call fcn.100022e0
add esp, 0xc
mov eax, dword [0x10014c78]
lea edx, [esp + 0x1c]
push edx
push 6
push 0x10014c7c
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100030b3
mov ecx, dword [0x10014c78]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Hook_SLGetWindowsInformationDWORD_ReadProcessMemory__error:_08x__SLGetWindowsInformationDWORD:_p_r_n
call fcn.100022e0
add esp, 0xc
jmp 0x100030b3
mov edx, 0x602
cmp bp, dx
jne 0x100030b3
push str.slc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SLGetWindowsInformationDWORD
push eax
mov dword [0x10014c6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10014c78], eax
xor ebx, ebx
push 0xfe
lea eax, [esp + 0x39]
push ebx
push eax
mov byte [esp + 0x40], bl
call fcn.10008b50
add esp, 0xc
push 0x100
lea ecx, [esp + 0x137]
push ebx
push ecx
call fcn.10008b50
add esp, 0xc
push 0x104
call fcn.10003a24
add esp, 4
push 0x104
mov esi, eax
push ebx
push esi
mov dword [esp + 0x34], esi
call fcn.10008b50
movzx edx, word [0x10014c66]
movzx eax, word [0x10014c64]
movzx ecx, word [0x10014c60]
add esp, 0xc
push edx
movzx edx, word [0x10014c62]
push eax
push ecx
push edx
push str._d._d._d._d
push 0x104
push esi
call fcn.10004109
mov ecx, dword [0x10014c74]
add esp, 0x1c
mov eax, esi
call fcn.10001580
test eax, eax
jne 0x10003156
push esi
push str._ERROR__Hook_Sect_not_in_ini_file_sec:_s____r_n
call fcn.100022e0
add esp, 8
mov ecx, dword [0x10014c74]
mov eax, esi
call fcn.10001580
test eax, eax
je 0x1000389a
mov eax, dword [0x10014c70]
cmp eax, ebx
je 0x10003187
mov ecx, dword [eax + 0x3c]
lea ecx, [ecx + eax + 0x18]
mov dword [0x10014c68], eax
jbe 0x10003187
cmp dword [ecx + 4], ebx
ja 0x100031a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR__Hook_Sect_GetModuleCodeSectionInfo_Failed:_08x_r_n
call fcn.100022e0
add esp, 8
jmp 0x1000389a
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x1b]
push edx
mov edi, str.LocalOnlyPatch.x86
call fcn.10001e10
test al, al
jne 0x100031c5
mov byte [esp + 0x1b], bl
push str._ERROR__Hook_Sect_not_in_ini_file_sec_LocalOnlyPatch.x86_x64_r_n
jmp 0x100032f8
cmp byte [esp + 0x1b], bl
jne 0x100031d5
push str._ERROR__Hook_Sect_not_in_ini_file_sec_LocalOnlyPatch.x86_x64_r_n
jmp 0x100032f8
mov ebx, str.Patch_CEnforcementCore::GetInstanceOfTSLicense_r_n
call fcn.10002190
push 0
push str.LocalOnlyOffset.x86
mov ecx, esi
call fcn.100020a0
mov edi, dword [esp + 0x30]
mov esi, dword [0x10014c74]
mov ebp, eax
add ebp, dword [0x10014c68]
add esp, 8
lea eax, [esp + 0x234]
push eax
mov ebx, str.LocalOnlyCode.x86
call fcn.100017a0
mov bl, al
mov byte [esp + 0x1b], bl
test bl, bl
jne 0x1000322b
push str._ERROR__Hook_Sect_not_in_ini_file_sec_LocalOnlyCode.x86_x64_r_n
call fcn.100022e0
add esp, 4
cmp ebp, dword [0x10014c68]
ja 0x10003240
push str._ERROR__Hook_Sect_not_in_ini_file_sec_LocalOnlyOffset.x86_x64_r_n
call fcn.100022e0
add esp, 4
test bl, bl
je 0x1000325e
lea esi, [esp + 0x34]
lea edi, [esp + 0x333]
call fcn.10001980
mov bl, al
mov byte [esp + 0x1b], bl
test bl, bl
jne 0x10003273
push str._ERROR__Hook_Sect_not_in_ini_file_sec_PatchCodes_r_n
call fcn.100022e0
add esp, 4
test bl, bl
je 0x10003300
cmp ebp, dword [0x10014c68]
jbe 0x10003300
movzx edx, byte [esp + 0x133]
lea ecx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x13c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [esp + 0x136]
movzx edx, byte [esp + 0x135]
push ecx
mov ecx, dword [esp + 0x20]
push edx
movzx edx, byte [esp + 0x13b]
mov esi, eax
movzx eax, byte [esp + 0x13c]
push eax
mov eax, dword [0x10014c68]
push ecx
push edx
mov ecx, ebp
sub ecx, eax
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Patch.LocalOnlyOffset_memory_bRlt:_d_Info:_08x_base:_p_cur:_p_offset:_08x_size:_d__writed:_d__value:_02x__02x__02x_..._r_n
call fcn.100022e0
add esp, 0x2c
test esi, esi
jne 0x10003300
push str._ERROR__r_n
call fcn.100022e0
add esp, 4
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x1b]
push edx
mov edi, str.SingleUserPatch.x86
call fcn.10001e10
test al, al
jne 0x10003325
mov byte [esp + 0x1b], al
push str._ERROR__Hook_Sect_not_in_ini_file_sec_SingleUserPatch.x86_x64_r_n
jmp 0x10003459
cmp byte [esp + 0x1b], 0
jne 0x10003336
push str._ERROR__Hook_Sect_not_in_ini_file_sec_SingleUserPatch.x86_x64_r_n
jmp 0x10003459
mov ebx, str.Patch_CSessionArbitrationHelper::IsSingleSessionPerUserEnabled_r_n
call fcn.10002190
mov edi, dword [esp + 0x28]
push 0
push str.SingleUserOffset.x86
mov ecx, edi
call fcn.100020a0
mov esi, dword [0x10014c74]
mov ebp, eax
add ebp, dword [0x10014c68]
add esp, 8
lea eax, [esp + 0x234]
push eax
mov ebx, str.SingleUserCode.x86
call fcn.100017a0
mov bl, al
mov byte [esp + 0x1b], bl
test bl, bl
jne 0x1000338c
push str._ERROR__Hook_Sect_not_in_ini_file_sec_SingleUserCode.x86_x64_r_n
call fcn.100022e0
add esp, 4
cmp ebp, dword [0x10014c68]
ja 0x100033a1
push str._ERROR__Hook_Sect_not_in_ini_file_sec_SingleUserOffset.x86_x64_r_n
call fcn.100022e0
add esp, 4
test bl, bl
je 0x100033bf
lea esi, [esp + 0x34]
lea edi, [esp + 0x333]
call fcn.10001980
mov bl, al
mov byte [esp + 0x1b], bl
test bl, bl
jne 0x100033d4
push str._ERROR__Hook_Sect_not_in_ini_file_sec_PatchCodes_r_n
call fcn.100022e0
add esp, 4
test bl, bl
je 0x10003461
cmp ebp, dword [0x10014c68]
jbe 0x10003461
movzx edx, byte [esp + 0x133]
lea ecx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x13c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [esp + 0x136]
movzx edx, byte [esp + 0x135]
push ecx
mov ecx, dword [esp + 0x20]
push edx
movzx edx, byte [esp + 0x13b]
mov esi, eax
movzx eax, byte [esp + 0x13c]
push eax
mov eax, dword [0x10014c68]
push ecx
push edx
mov ecx, ebp
sub ecx, eax
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Patch.SingleUserOffset_memory_bRlt:_08x_Info:_08x_base:_p_cur:_p_offset:_08x_size:_d__writed:_d__value:_02x__02x__02x_..._r_n
call fcn.100022e0
add esp, 0x2c
test esi, esi
jne 0x10003461
push str._ERROR__r_n
call fcn.100022e0
add esp, 4
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x1b]
push edx
mov edi, str.DefPolicyPatch.x86
call fcn.10001e10
test al, al
jne 0x10003486
mov byte [esp + 0x1b], al
push str._ERROR__Hook_Sect_not_in_ini_file_sec_DefPolicyPatch.x86_x64_r_n
jmp 0x100035ba
cmp byte [esp + 0x1b], 0
jne 0x10003497
push str._ERROR__Hook_Sect_not_in_ini_file_sec_DefPolicyPatch.x86_x64_r_n
jmp 0x100035ba
mov ebx, str.Patch_CDefPolicy::Query_r_n
call fcn.10002190
mov edi, dword [esp + 0x28]
push 0
push str.DefPolicyOffset.x86
mov ecx, edi
call fcn.100020a0
mov esi, dword [0x10014c74]
mov ebp, eax
add ebp, dword [0x10014c68]
add esp, 8
lea eax, [esp + 0x234]
push eax
mov ebx, str.DefPolicyCode.x86
call fcn.100017a0
mov bl, al
mov byte [esp + 0x1b], bl
test bl, bl
jne 0x100034ed
push str._ERROR__Hook_Sect_not_in_ini_file_sec_DefPolicyCode.x86_x64_r_n
call fcn.100022e0
add esp, 4
cmp ebp, dword [0x10014c68]
ja 0x10003502
push str._ERROR__Hook_Sect_not_in_ini_file_sec_DefPolicyOffset.x86_x64_r_n
call fcn.100022e0
add esp, 4
test bl, bl
je 0x10003520
lea esi, [esp + 0x34]
lea edi, [esp + 0x333]
call fcn.10001980
mov bl, al
mov byte [esp + 0x1b], bl
test bl, bl
jne 0x10003535
push str._ERROR__Hook_Sect_not_in_ini_file_sec_PatchCodes_r_n
call fcn.100022e0
add esp, 4
test bl, bl
je 0x100035c2
cmp ebp, dword [0x10014c68]
jbe 0x100035c2
movzx edx, byte [esp + 0x133]
lea ecx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x13c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [esp + 0x136]
movzx edx, byte [esp + 0x135]
push ecx
mov ecx, dword [esp + 0x20]
push edx
movzx edx, byte [esp + 0x13b]
mov esi, eax
movzx eax, byte [esp + 0x13c]
push eax
mov eax, dword [0x10014c68]
push ecx
push edx
mov ecx, ebp
sub ecx, eax
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Patch.DefPolicyOffset_memory_bRlt:_d_Info:_08x_base:_p_cur:_p_offset:_08x_size:_d__writed:_d__value:_02x__02x__02x_..._r_n
call fcn.100022e0
add esp, 0x2c
test esi, esi
jne 0x100035c2
push str._ERROR__r_n
call fcn.100022e0
add esp, 4
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x1b]
push edx
mov edi, str.SLPolicyInternal.x86
call fcn.10001e10
test al, al
jne 0x100035df
mov byte [esp + 0x1b], al
jmp 0x100035e6
cmp byte [esp + 0x1b], 0
jne 0x10003600
mov eax, 0x602
cmp word [esp + 0x2c], ax
jne 0x10003754
push str._ERROR__Hook_Sect_not_in_ini_file_sec_SLPolicyInternal.x86_x64_r_n
jmp 0x1000374c
mov ebx, str.Hook_SLGetWindowsInformationDWORDWrapper_r_n
call fcn.10002190
push 0x400
call fcn.10003a24
mov edi, dword [esp + 0x2c]
add esp, 4
push 0
push str.SLPolicyOffset.x86
mov ecx, edi
mov ebx, eax
call fcn.100020a0
mov esi, eax
add esi, dword [0x10014c68]
push ebx
mov ebp, fcn.10002630
push str.New_Win8SL
mov edx, str.SLPolicyFunc.x86
mov ecx, edi
mov byte [esp + 0x30], 0x68
mov dword [esp + 0x31], ebp
mov byte [esp + 0x35], 0xc3
call fcn.10002100
add esp, 0x10
mov ecx, str.New_Win8SL
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003682
test dl, dl
je 0x1000367e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003682
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003662
xor eax, eax
jmp 0x10003687
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000368f
mov dword [esp + 0x21], ebp
mov ecx, str.New_Win8SL_CP
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100036b6
test dl, dl
je 0x100036b2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100036b6
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003696
xor eax, eax
jmp 0x100036bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100036c7
mov dword [esp + 0x21], 0x100026d0
push ebx
call fcn.10003a89
add esp, 4
cmp esi, dword [0x10014c68]
ja 0x100036ed
push str._ERROR__Hook_Sect_not_in_ini_file_sec_SLPolicyOffset.x86_x64_r_n
call fcn.100022e0
add esp, 4
cmp esi, dword [0x10014c68]
jbe 0x10003754
lea ecx, [esp + 0x1c]
push ecx
push 6
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [esp + 0x21]
movzx edx, byte [esp + 0x20]
mov edi, eax
movzx eax, byte [esp + 0x22]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
mov eax, dword [0x10014c68]
push 6
mov ecx, esi
sub ecx, eax
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Patch.SLPolicyOffset_memory_bRlt:_d_Info:_08x_base:_p_cur:_p_offset:_08x_size:_d__writed:_d__value:_02x__02x__02x_..._r_n
call fcn.100022e0
add esp, 0x2c
test edi, edi
jne 0x10003754
push str._ERROR__r_n
call fcn.100022e0
add esp, 4
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x1b]
push edx
mov edi, str.SLInitHook.x86
mov esi, ebp
call fcn.10001e10
test al, al
je 0x10003774
cmp byte [esp + 0x1b], 0
jne 0x1000377e
push str._ERROR__Hook_Sect_not_in_ini_file_sec_SLInitHook.x86_x64_r_n
jmp 0x10003892
mov ebx, str.Hook_CSLQuery::Initialize_r_n
call fcn.10002190
push 0x400
call fcn.10003a24
add esp, 4
push 0
push str.SLInitOffset.x86
mov ecx, ebp
mov edi, eax
call fcn.100020a0
mov esi, eax
add esi, dword [0x10014c68]
push edi
mov ebx, 0x100026e0
push str.New_CSLQuery_Initialize
mov edx, str.SLInitFunc.x86
mov ecx, ebp
mov byte [esp + 0x30], 0x68
mov dword [esp + 0x31], ebx
mov byte [esp + 0x35], 0xc3
call fcn.10002100
add esp, 0x10
mov ecx, str.New_CSLQuery_Initialize
mov eax, edi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003800
test dl, dl
je 0x100037fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003800
add eax, 2
add ecx, 2
test dl, dl
jne 0x100037e0
xor eax, eax
jmp 0x10003805
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000380d
mov dword [esp + 0x21], ebx
push edi
call fcn.10003a89
add esp, 4
cmp esi, dword [0x10014c68]
ja 0x10003833
push str._ERROR__Hook_Sect_not_in_ini_file_sec_SLInitOffset.x86_x64_r_n
call fcn.100022e0
add esp, 4
cmp esi, dword [0x10014c68]
jbe 0x1000389a
lea eax, [esp + 0x1c]
push eax
push 6
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx edx, byte [esp + 0x22]
movzx ecx, byte [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
mov edi, eax
movzx eax, byte [esp + 0x25]
push eax
mov eax, dword [0x10014c68]
push ecx
push edx
push 6
mov ecx, esi
sub ecx, eax
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Patch.SLInitOffset_memory_bRlt:_d_Info:_08x_base:_p_cur:_p_offset:_08x_size:_d__writed:_d__value:_02x__02x__02x_..._r_n
call fcn.100022e0
add esp, 0x2c
test edi, edi
jne 0x1000389a
push str._ERROR__r_n
call fcn.100022e0
add esp, 4
mov edx, dword [esp + 0x28]
push edx
call fcn.10003a89
add esp, 4
mov ebx, str.Resumimg_threads..._r_n
call fcn.10002190
push 1
call fcn.10002390
add esp, 4
mov ecx, dword [esp + 0x638]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.100039ab
add esp, 0x630
ret