Function at 0x401560
Capabilities:
Extract resource via kernel32 functions
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x77c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x80000c02
mov edi, eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
xor esi, esi
push esi
push esi
push str._NT_SYMBOL_PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
mov ecx, str.cache_srvhttps:__msdl.microsoft.com_download_symbols
push esi
cmovne ecx, esi
push ecx
push edi
call dword [sym.imp.dbghelp.dll_SymInitializeW]
test eax, eax
jne 0x4015bb
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 2
jl 0x4015d0
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
lea eax, [esp + 0xa4]
jmp 0x4015f1
push str._termsrv.dll
push 0x104
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0xa4]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 2
push 0
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
jne 0x40161a
lea eax, [esi - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, esi
mov dword [esp + 0x10], 0x4034d8
and ebx, 0xfffffffc
mov edx, dword [ebx + 0x3c]
add edx, ebx
movzx eax, word [edx + 0x14]
mov ecx, dword [eax + edx + 0x2c]
sub ecx, dword [eax + edx + 0x24]
mov eax, 0x20b
add ebx, ecx
cmp word [edx + 0x18], ax
mov dword [esp + 0x1c], ebx
lea eax, [esp + 0x8c]
jne 0x40165d
push 2
push 0
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderInit]
jmp 0x401670
push 1
push 1
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderInit]
mov dword [esp + 0x1c], 0x4034dc
add esp, 0xc
lea eax, [esp + 0xa0]
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push edi
call dword [sym.imp.dbghelp.dll_SymLoadModuleEx]
or eax, edx
jne 0x4016a0
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x4016bb
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
mov dword [esp + 0x88], ecx
test ecx, ecx
jne 0x4016da
lea eax, [ecx - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x28], 0x58
mov dword [esp + 0x78], 0
movzx eax, word [ecx + 0x34]
push eax
movzx eax, word [ecx + 0x36]
push eax
movzx eax, word [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x32]
push eax
push str.__hu._hu._hu._hu__n
call fcn.00401010
mov esi, dword [sym.imp.dbghelp.dll_SymFromNameW]
lea eax, [esp + 0x3c]
add esp, 0x14
push eax
push 0x4034f4
push edi
call esi
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
test eax, eax
jne 0x40173d
lea eax, [esp + 0x28]
push eax
push str._memset
push edi
call esi
test eax, eax
je 0x4017e7
mov eax, dword [esp + 0x60]
sub eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
push str.CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
push edi
call esi
test eax, eax
je 0x401799
push dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
push dword [esp + 0x18]
sub ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x6c]
sbb eax, dword [esp + 0x54]
push 0
push dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0xa4]
call fcn.00401390
add esp, 0x18
test eax, eax
jne 0x4017e7
lea eax, [esp + 0x28]
push eax
push str.CUtils::IsSingleSessionPerUser
push edi
call esi
test eax, eax
je 0x4017e7
push dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
push dword [esp + 0x18]
sub ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x6c]
sbb eax, dword [esp + 0x54]
push 0
push dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0xa4]
call fcn.00401390
add esp, 0x18
test eax, eax
jne 0x4017e7
push str.ERROR:_SingleUserPatch_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CDefPolicy::Query
push edi
call esi
test eax, eax
je 0x4019f8
mov esi, dword [esp + 0x1c]
xor eax, eax
sub esi, dword [esp + 0x48]
mov dword [esp + 0x84], eax
sbb eax, dword [esp + 0x4c]
add esi, dword [esp + 0x60]
mov dword [esp + 0x18], 0x80
adc eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1a8]
push eax
push 0x80
lea eax, [esp + 0x94]
mov dword [esp + 0x88], esi
push esi
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderDecodeBuffer]
add esp, 0x10
test eax, eax
js 0x401903
cmp byte [esp + 0x1c0], 3
jne 0x4018b7
cmp dword [esp + 0x1ac], 0x67
jne 0x4018b7
mov ecx, dword [esp + 0x1cc]
mov eax, dword [esp + 0x234]
cmp ecx, 2
jne 0x401896
cmp dword [esp + 0x210], 0x63c
jne 0x401896
cmp dword [esp + 0x214], 0
jne 0x401896
cmp eax, 1
je 0x40190d
cmp eax, 2
jne 0x4018b7
cmp dword [esp + 0x278], 0x320
jne 0x4018b7
cmp dword [esp + 0x27c], 0
jne 0x4018b7
cmp ecx, 1
je 0x401928
movzx ecx, byte [esp + 0x1b0]
mov eax, ecx
mov dword [esp + 0x84], ecx
cdq
add esi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x80], esi
adc dword [esp + 0x14], edx
sub eax, ecx
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x18], eax
push ecx
push eax
lea eax, [esp + 0x94]
push esi
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderDecodeBuffer]
add esp, 0x10
test eax, eax
jns 0x401853
push str.ERROR:_DefPolicyPatch_patten_not_found
jmp 0x4019fd
push dword [esp + 0x254]
mov esi, dword [sym.imp.Zydis.dll_ZydisRegisterGetString]
call esi
add esp, 4
push dword [esp + 0x1f8]
jmp 0x401941
push dword [esp + 0x1ec]
mov esi, dword [sym.imp.Zydis.dll_ZydisRegisterGetString]
call esi
add esp, 4
push dword [esp + 0x260]
mov dword [esp + 0x28], eax
call esi
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x1ac]
mov esi, dword [esp + 0x84]
add esp, 4
mov dword [esp + 0x20], eax
movzx eax, byte [esp + 0x1b0]
sub ecx, eax
add eax, esi
push edx
push ecx
push eax
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderDecodeBuffer]
add esp, 0x10
test eax, eax
js 0x401903
mov eax, dword [esp + 0x1ac]
cmp eax, 0x13b
jne 0x4019ab
sub esi, dword [esp + 0x84]
mov eax, str._jmp
mov ecx, dword [esp + 0x14]
sbb ecx, 0
jmp 0x4019c6
cmp eax, 0x140
je 0x4019bd
cmp eax, 0x25b
jne 0x401903
mov ecx, dword [esp + 0x14]
mov eax, 0x403148
sub esi, dword [esp + 0x1c]
push eax
push dword [esp + 0x24]
sbb ecx, 0
mov eax, str.DefPolicyPatch.x641_nDefPolicyOffset.x64_llX_nDefPolicyCode.x64CDefPolicy_Query__s__s_s_n
push dword [esp + 0x2c]
cmp dword [esp + 0x9c], 2
push ecx
mov ecx, str.DefPolicyPatch.x861_nDefPolicyOffset.x86_llX_nDefPolicyCode.x86CDefPolicy_Query__s__s_s_n
cmovne eax, ecx
push esi
push eax
call fcn.00401010
add esp, 0x18
jmp 0x401a02
push str.ERROR:_CDefPolicy_Query_not_found
call ebx
add esp, 4
mov eax, dword [esp + 0x88]
mov eax, dword [eax + 0x30]
cmp eax, 0x60001
jbe 0x401d66
cmp eax, 0x60002
lea eax, [esp + 0x28]
push eax
jne 0x401a72
push str.SLGetWindowsInformationDWORDWrapper
push edi
call dword [sym.imp.dbghelp.dll_SymFromNameW]
test eax, eax
je 0x401a5f
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.SLPolicyInternal._1_s1_nSLPolicyOffset._1_s_2_llX_nSLPolicyFunc._1_sNew_Win8SL_n
call fcn.00401050
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_SLGetWindowsInformationDWORDWrapper_not_found
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.dbghelp.dll_SymFromNameW]
push str.CEnforcementCore::GetInstanceOfTSLicense
push edi
call esi
test eax, eax
je 0x401ae5
mov eax, dword [esp + 0x60]
sub eax, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::IsLicenseTypeLocalOnly
push edi
call esi
test eax, eax
je 0x401ade
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push 0
push dword [esp + 0x28]
lea ecx, [esp + 0x9c]
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.00401090
add esp, 0x18
jmp 0x401aef
push str.ERROR:_IsLicenseTypeLocalOnly_not_found
jmp 0x401aea
push str.ERROR:_GetInstanceOfTSLicense_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::Initialize
push edi
call esi
test eax, eax
je 0x401d5c
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.SLInitHook._1_s1_nSLInitOffset._1_s_2_llX_nSLInitFunc._1_sNew_CSLQuery_Initialize_n
call fcn.00401050
mov ecx, dword [esp + 0x98]
movzx eax, word [ecx + 0x34]
push eax
movzx eax, word [ecx + 0x36]
push eax
movzx eax, word [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x32]
push eax
push str._n__hu._hu._hu._hu_SLInit__n
call fcn.00401010
add esp, 0x24
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::bServerSku
push edi
call esi
test eax, eax
je 0x401b82
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.bServerSku._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401b8c
push str.ERROR:_bServerSku_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::bRemoteConnAllowed
push edi
call esi
test eax, eax
je 0x401bc2
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.bRemoteConnAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401bcc
push str.ERROR:_bRemoteConnAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::bFUSEnabled
push edi
call esi
test eax, eax
je 0x401c02
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.bFUSEnabled._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401c0c
push str.ERROR:_bFUSEnabled_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::bAppServerAllowed
push edi
call esi
test eax, eax
je 0x401c42
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.bAppServerAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401c4c
push str.ERROR:_bAppServerAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::bMultimonAllowed
push edi
call esi
test eax, eax
je 0x401c82
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.bMultimonAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401c8c
push str.ERROR:_bMultimonAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::lMaxUserSessions
push edi
call esi
test eax, eax
je 0x401cc2
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.lMaxUserSessions._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401ccc
push str.ERROR:_lMaxUserSessions_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::ulMaxDebugSessions
push edi
call esi
test eax, eax
je 0x401d02
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.ulMaxDebugSessions._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x401d0c
push str.ERROR:_ulMaxDebugSessions_not_found
call ebx
add esp, 4
lea eax, [esp + 0x28]
push eax
push str.CSLQuery::bInitialized
push edi
call esi
test eax, eax
je 0x401d49
mov ecx, dword [esp + 0x60]
sub ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
sbb eax, dword [esp + 0x4c]
push eax
push ecx
push dword [esp + 0x18]
push str.bInitialized._s_llX_n
call fcn.00401010
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_bInitialized_not_found
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_CSLQuery_Initialize_not_found
call ebx
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret