Function at 0x401ad0
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4dc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x80004000
mov esi, eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
push 0
push 0
push str._NT_SYMBOL_PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov ecx, str.cache_srvhttps:__msdl.microsoft.com_download_symbols
cmp eax, 0xcb
push 0
cmovne ecx, edx
push ecx
push esi
call dword [sym.imp.dbghelp.dll_SymInitializeW]
test eax, eax
jne 0x401b2e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 2
jl 0x401b43
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
lea eax, [esp + 0xa4]
jmp 0x401b64
push str._termsrv.dll
push 0x105
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0xa4]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 2
push 0
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push dword [esp + 0x7c]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
test ebx, ebx
jne 0x401ba2
lea eax, [ebx - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov dword [esp + 0x10], 0x403518
and edx, 0xfffffffc
mov edi, dword [edx + 0x3c]
add edi, edx
movzx eax, word [edi + 0x14]
mov ecx, dword [eax + edi + 0x2c]
sub ecx, dword [eax + edi + 0x24]
mov eax, 0x20b
add edx, ecx
cmp word [edi + 0x18], ax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x8c]
jne 0x401be5
push 2
push 0
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderInit]
jmp 0x401bf8
push 1
push 1
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderInit]
mov dword [esp + 0x1c], 0x40351c
add esp, 0xc
mov dword [esp + 0x1a8], 0x33c
lea eax, [esp + 0x1ac]
push 0x338
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
lea eax, [esp + 0x1ac]
push eax
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.dbghelp.dll_SymSrvGetFileIndexInfo]
test eax, eax
jne 0x401c50
mov eax, 0xfffffffa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esp + 0x7c]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push 0
push 0
lea eax, [esp + 0xa8]
push eax
push 8
push 0
push dword [esp + 0x4f4]
lea eax, [esp + 0x4e4]
push eax
lea eax, [esp + 0x3e1]
push eax
push 0
push esi
call dword [sym.imp.dbghelp.dll_SymFindFileInPath]
test eax, eax
jne 0x401cb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401ca7
push str.Symbol_not_found
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add esp, 4
mov eax, 0xfffffff9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push dword [edi + 0x50]
lea eax, [esp + 0xac]
push dword [edi + 0x34]
push dword [edi + 0x30]
push 0
push eax
push 0
push esi
call dword [sym.imp.dbghelp.dll_SymLoadModuleEx]
or eax, edx
jne 0x401ce3
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x401cfe
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
mov dword [esp + 0x88], ecx
test ecx, ecx
jne 0x401d1d
lea eax, [ecx - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x20], 0x58
mov dword [esp + 0x70], 0
movzx eax, word [ecx + 0x34]
push eax
movzx eax, word [ecx + 0x36]
push eax
movzx eax, word [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x32]
push eax
push str.__hu._hu._hu._hu__n
call fcn.00401010
mov edi, dword [sym.imp.dbghelp.dll_SymFromNameW]
lea eax, [esp + 0x34]
add esp, 0x14
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x80], 0xffffffff
push eax
push str.__imp_VerifyVersionInfoW
push esi
call edi
test eax, eax
jne 0x401d8c
lea eax, [esp + 0x20]
push eax
push str.__imp__VerifyVersionInfoW_16
push esi
call edi
test eax, eax
je 0x401daa
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x40]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
mov dword [esp + 0x80], eax
push 0x80000002
call dword [sym.imp.dbghelp.dll_SymSetOptions]
lea eax, [esp + 0x20]
push eax
push 0x4035b8
push esi
call edi
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
test eax, eax
jne 0x401de1
lea eax, [esp + 0x20]
push eax
push str._memset
push esi
call edi
test eax, eax
je 0x401ea7
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
push eax
push str.CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
push esi
call edi
test eax, eax
je 0x401e4b
push dword [esp + 0x80]
mov ecx, dword [esp + 0x5c]
push dword [esp + 0x88]
sub ecx, dword [esp + 0x48]
push dword [esp + 0x20]
mov eax, dword [esp + 0x68]
push dword [esp + 0x28]
sbb eax, dword [esp + 0x54]
push 0
push dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0xac]
call fcn.00401760
add esp, 0x20
test eax, eax
jne 0x401ea7
lea eax, [esp + 0x20]
push eax
push str.CUtils::IsSingleSessionPerUser
push esi
call edi
test eax, eax
je 0x401ea7
push dword [esp + 0x80]
mov ecx, dword [esp + 0x5c]
push dword [esp + 0x88]
sub ecx, dword [esp + 0x48]
push dword [esp + 0x20]
mov eax, dword [esp + 0x68]
push dword [esp + 0x28]
sbb eax, dword [esp + 0x54]
push 0
push dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0xac]
call fcn.00401760
add esp, 0x20
test eax, eax
jne 0x401ea7
push str.ERROR:_SingleUserPatch_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CDefPolicy::Query
push esi
call edi
test eax, eax
je 0x401ee1
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push 0
push dword [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x9c]
call fcn.004013a0
add esp, 0x10
jmp 0x401eeb
push str.ERROR:_CDefPolicy_Query_not_found
call ebx
add esp, 4
mov eax, dword [esp + 0x88]
mov eax, dword [eax + 0x30]
cmp eax, 0x60001
jbe 0x402245
cmp eax, 0x60002
lea eax, [esp + 0x20]
push eax
jne 0x401f57
push str.SLGetWindowsInformationDWORDWrapper
push esi
call edi
test eax, eax
je 0x401f44
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.SLPolicyInternal._1_s1_nSLPolicyOffset._1_s_2_llX_nSLPolicyFunc._1_sNew_Win8SL_n
call fcn.00401050
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_SLGetWindowsInformationDWORDWrapper_not_found
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CEnforcementCore::GetInstanceOfTSLicense
push esi
call edi
test eax, eax
je 0x401fc4
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::IsLicenseTypeLocalOnly
push esi
call edi
test eax, eax
je 0x401fbd
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push 0
push dword [esp + 0x20]
lea ecx, [esp + 0x9c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.00401090
add esp, 0x18
jmp 0x401fce
push str.ERROR:_IsLicenseTypeLocalOnly_not_found
jmp 0x401fc9
push str.ERROR:_GetInstanceOfTSLicense_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::Initialize
push esi
call edi
test eax, eax
je 0x40223b
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.SLInitHook._1_s1_nSLInitOffset._1_s_2_llX_nSLInitFunc._1_sNew_CSLQuery_Initialize_n
call fcn.00401050
mov ecx, dword [esp + 0x98]
movzx eax, word [ecx + 0x34]
push eax
movzx eax, word [ecx + 0x36]
push eax
movzx eax, word [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x32]
push eax
push str._n__hu._hu._hu._hu_SLInit__n
call fcn.00401010
add esp, 0x24
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bServerSku
push esi
call edi
test eax, eax
je 0x402061
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bServerSku._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40206b
push str.ERROR:_bServerSku_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bRemoteConnAllowed
push esi
call edi
test eax, eax
je 0x4020a1
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bRemoteConnAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x4020ab
push str.ERROR:_bRemoteConnAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bFUSEnabled
push esi
call edi
test eax, eax
je 0x4020e1
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bFUSEnabled._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x4020eb
push str.ERROR:_bFUSEnabled_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bAppServerAllowed
push esi
call edi
test eax, eax
je 0x402121
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bAppServerAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40212b
push str.ERROR:_bAppServerAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bMultimonAllowed
push esi
call edi
test eax, eax
je 0x402161
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bMultimonAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40216b
push str.ERROR:_bMultimonAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::lMaxUserSessions
push esi
call edi
test eax, eax
je 0x4021a1
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.lMaxUserSessions._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x4021ab
push str.ERROR:_lMaxUserSessions_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::ulMaxDebugSessions
push esi
call edi
test eax, eax
je 0x4021e1
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.ulMaxDebugSessions._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x4021eb
push str.ERROR:_ulMaxDebugSessions_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bInitialized
push esi
call edi
test eax, eax
je 0x402228
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bInitialized._s_llX_n
call fcn.00401010
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_bInitialized_not_found
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_CSLQuery_Initialize_not_found
call ebx
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret