Function at 0x401a40
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x80004000
mov esi, eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
push 0
push 0
push str._NT_SYMBOL_PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov ecx, str.cache_srvhttps:__msdl.microsoft.com_download_symbols
cmp eax, 0xcb
push 0
cmovne ecx, edx
push ecx
push esi
call dword [sym.imp.dbghelp.dll_SymInitializeW]
test eax, eax
jne 0x401a9e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 2
jl 0x401ab3
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
lea eax, [esp + 0x8c]
jmp 0x401ad4
push str._termsrv.dll
push 0x105
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x8c]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 2
push 0
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push dword [esp + 0x1c]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
test ebx, ebx
jne 0x401b12
lea eax, [ebx - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov dword [esp + 0xc], 0x403518
and edx, 0xfffffffc
mov edi, dword [edx + 0x3c]
add edi, edx
movzx eax, word [edi + 0x14]
mov ecx, dword [eax + edi + 0x2c]
sub ecx, dword [eax + edi + 0x24]
mov eax, 0x20b
add edx, ecx
cmp word [edi + 0x18], ax
mov dword [esp + 0x18], edx
lea eax, [esp + 0x7c]
jne 0x401b55
push 2
push 0
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderInit]
mov eax, dword [edi + 0x30]
jmp 0x401b6b
push 1
push 1
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderInit]
mov eax, dword [edi + 0x34]
mov dword [esp + 0x18], 0x40351c
mov edi, dword [edi + 0x50]
add esp, 0xc
mov dword [esp + 0x10], eax
lea eax, [esp + 0x194]
mov dword [esp + 0x190], 0x33c
push 0x338
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
lea eax, [esp + 0x194]
push eax
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.dbghelp.dll_SymSrvGetFileIndexInfo]
test eax, eax
jne 0x401bca
mov eax, 0xfffffffa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push 0
push 0
lea eax, [esp + 0x90]
push eax
push 8
push 0
push dword [esp + 0x4dc]
lea eax, [esp + 0x4cc]
push eax
lea eax, [esp + 0x3c9]
push eax
push 0
push esi
call dword [sym.imp.dbghelp.dll_SymFindFileInPath]
test eax, eax
jne 0x401c2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401c21
push str.Symbol_not_found
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add esp, 4
mov eax, 0xfffffff9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
push 0
push dword [esp + 0x20]
lea eax, [esp + 0x9c]
push 0
push eax
push 0
push esi
call dword [sym.imp.dbghelp.dll_SymLoadModuleEx]
or eax, edx
jne 0x401c5b
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x401c76
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
mov dword [esp + 0x78], ecx
test ecx, ecx
jne 0x401c92
lea eax, [ecx - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x20], 0x58
mov dword [esp + 0x70], 0
movzx eax, word [ecx + 0x34]
push eax
movzx eax, word [ecx + 0x36]
push eax
movzx eax, word [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x32]
push eax
push str.__hu._hu._hu._hu__n
call fcn.00401010
mov ebx, dword [sym.imp.dbghelp.dll_SymFromNameW]
lea eax, [esp + 0x34]
add esp, 0x14
or edi, 0xffffffff
mov dword [esp + 0x14], edi
push eax
push str.__imp_VerifyVersionInfoW
push esi
call ebx
test eax, eax
jne 0x401cf2
lea eax, [esp + 0x20]
push eax
push str.__imp__VerifyVersionInfoW_16
push esi
call ebx
test eax, eax
je 0x401cfe
mov edi, dword [esp + 0x58]
sub edi, dword [esp + 0x40]
mov dword [esp + 0x14], edi
cmp dword [esp + 0x80], 1
jne 0x401d10
add edi, dword [esp + 0x10]
mov dword [esp + 0x14], edi
push 0x80000002
call dword [sym.imp.dbghelp.dll_SymSetOptions]
lea eax, [esp + 0x20]
push eax
push 0x4035b8
push esi
call ebx
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
test eax, eax
jne 0x401d47
lea eax, [esp + 0x20]
push eax
push str._memset
push esi
call ebx
test eax, eax
je 0x401dcd
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push str.CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
push esi
call ebx
test eax, eax
je 0x401d8b
push dword [esp + 0x14]
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 0x80]
push dword [esp + 0x14]
sub edx, dword [esp + 0x48]
push dword [esp + 0x20]
call fcn.00401700
add esp, 0xc
test eax, eax
jne 0x401dcd
lea eax, [esp + 0x20]
push eax
push str.CUtils::IsSingleSessionPerUser
push esi
call ebx
test eax, eax
je 0x401dcd
push dword [esp + 0x14]
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 0x80]
push dword [esp + 0x14]
sub edx, dword [esp + 0x48]
push dword [esp + 0x20]
call fcn.00401700
add esp, 0xc
test eax, eax
jne 0x401dcd
push str.ERROR:_SingleUserPatch_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CDefPolicy::Query
push esi
call ebx
test eax, eax
je 0x401df5
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0x7c]
push dword [esp + 0x18]
sub edx, dword [esp + 0x44]
call fcn.00401370
jmp 0x401dfc
push str.ERROR:_CDefPolicy_Query_not_found
call edi
mov eax, dword [esp + 0x7c]
add esp, 4
mov eax, dword [eax + 0x30]
cmp eax, 0x60001
jbe 0x402138
cmp eax, 0x60002
lea eax, [esp + 0x20]
push eax
jne 0x401e68
push str.SLGetWindowsInformationDWORDWrapper
push esi
call ebx
test eax, eax
je 0x401e55
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.SLPolicyInternal._1_s1_nSLPolicyOffset._1_s_2_llX_nSLPolicyFunc._1_sNew_Win8SL_n
call fcn.00401a00
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_SLGetWindowsInformationDWORDWrapper_not_found
call edi
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CEnforcementCore::GetInstanceOfTSLicense
push esi
call ebx
test eax, eax
je 0x401eb7
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::IsLicenseTypeLocalOnly
push esi
call ebx
test eax, eax
je 0x401eb0
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x7c]
sub eax, dword [esp + 0x40]
mov edx, dword [esp + 0x10]
push eax
push dword [esp + 0x1c]
call fcn.00401050
add esp, 8
jmp 0x401ec1
push str.ERROR:_IsLicenseTypeLocalOnly_not_found
jmp 0x401ebc
push str.ERROR:_GetInstanceOfTSLicense_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::Initialize
push esi
call ebx
test eax, eax
je 0x40212e
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.SLInitHook._1_s1_nSLInitOffset._1_s_2_llX_nSLInitFunc._1_sNew_CSLQuery_Initialize_n
call fcn.00401a00
mov ecx, dword [esp + 0x88]
movzx eax, word [ecx + 0x34]
push eax
movzx eax, word [ecx + 0x36]
push eax
movzx eax, word [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x32]
push eax
push str._n__hu._hu._hu._hu_SLInit__n
call fcn.00401010
add esp, 0x24
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bServerSku
push esi
call ebx
test eax, eax
je 0x401f54
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.bServerSku._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401f5e
push str.ERROR:_bServerSku_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bRemoteConnAllowed
push esi
call ebx
test eax, eax
je 0x401f94
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.bRemoteConnAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401f9e
push str.ERROR:_bRemoteConnAllowed_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bFUSEnabled
push esi
call ebx
test eax, eax
je 0x401fd4
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.bFUSEnabled._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401fde
push str.ERROR:_bFUSEnabled_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bAppServerAllowed
push esi
call ebx
test eax, eax
je 0x402014
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.bAppServerAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40201e
push str.ERROR:_bAppServerAllowed_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bMultimonAllowed
push esi
call ebx
test eax, eax
je 0x402054
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.bMultimonAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40205e
push str.ERROR:_bMultimonAllowed_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::lMaxUserSessions
push esi
call ebx
test eax, eax
je 0x402094
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.lMaxUserSessions._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40209e
push str.ERROR:_lMaxUserSessions_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::ulMaxDebugSessions
push esi
call ebx
test eax, eax
je 0x4020d4
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.ulMaxDebugSessions._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x4020de
push str.ERROR:_ulMaxDebugSessions_not_found
call edi
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bInitialized
push esi
call ebx
test eax, eax
je 0x40211b
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x14]
push str.bInitialized._s_llX_n
call fcn.00401010
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_bInitialized_not_found
call edi
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_CSLQuery_Initialize_not_found
call edi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret