Function at 0x401b40
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4d4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x80004000
mov esi, eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
push 0
push 0
push str._NT_SYMBOL_PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov ecx, str.cache_srvhttps:__msdl.microsoft.com_download_symbols
cmp eax, 0xcb
push 0
cmovne ecx, edx
push ecx
push esi
call dword [sym.imp.dbghelp.dll_SymInitializeW]
test eax, eax
jne 0x401b9e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 2
jl 0x401bb3
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
lea eax, [esp + 0x9c]
jmp 0x401bd4
push str._termsrv.dll
push 0x105
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x9c]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 2
push 0
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push dword [esp + 0x7c]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
test ebx, ebx
jne 0x401c12
lea eax, [ebx - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov dword [esp + 0x10], 0x403518
and edx, 0xfffffffc
mov edi, dword [edx + 0x3c]
add edi, edx
movzx eax, word [edi + 0x14]
mov ecx, dword [eax + edi + 0x2c]
sub ecx, dword [eax + edi + 0x24]
mov eax, 0x20b
add edx, ecx
cmp word [edi + 0x18], ax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x8c]
jne 0x401c55
push 2
push 0
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderInit]
jmp 0x401c68
push 1
push 1
push eax
call dword [sym.imp.Zydis.dll_ZydisDecoderInit]
mov dword [esp + 0x1c], 0x40351c
add esp, 0xc
mov dword [esp + 0x1a0], 0x33c
lea eax, [esp + 0x1a4]
push 0x338
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
lea eax, [esp + 0x1a4]
push eax
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.dbghelp.dll_SymSrvGetFileIndexInfo]
test eax, eax
jne 0x401cc0
mov eax, 0xfffffffa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esp + 0x7c]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push 0
push 0
lea eax, [esp + 0xa0]
push eax
push 8
push 0
push dword [esp + 0x4ec]
lea eax, [esp + 0x4dc]
push eax
lea eax, [esp + 0x3d9]
push eax
push 0
push esi
call dword [sym.imp.dbghelp.dll_SymFindFileInPath]
test eax, eax
jne 0x401d23
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401d17
push str.Symbol_not_found
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add esp, 4
mov eax, 0xfffffff9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push dword [edi + 0x50]
lea eax, [esp + 0xa4]
push dword [edi + 0x34]
push dword [edi + 0x30]
push 0
push eax
push 0
push esi
call dword [sym.imp.dbghelp.dll_SymLoadModuleEx]
or eax, edx
jne 0x401d53
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x401d6e
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
mov dword [esp + 0x88], ecx
test ecx, ecx
jne 0x401d8d
lea eax, [ecx - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x20], 0x58
mov dword [esp + 0x70], 0
movzx eax, word [ecx + 0x34]
push eax
movzx eax, word [ecx + 0x36]
push eax
movzx eax, word [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x32]
push eax
push str.__hu._hu._hu._hu__n
call fcn.00401010
mov edi, dword [sym.imp.dbghelp.dll_SymFromNameW]
lea eax, [esp + 0x34]
add esp, 0x14
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x80], 0xffffffff
push eax
push str.__imp_VerifyVersionInfoW
push esi
call edi
test eax, eax
jne 0x401dfc
lea eax, [esp + 0x20]
push eax
push str.__imp__VerifyVersionInfoW_16
push esi
call edi
test eax, eax
je 0x401e1a
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x40]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
mov dword [esp + 0x80], eax
push 0x80000002
call dword [sym.imp.dbghelp.dll_SymSetOptions]
lea eax, [esp + 0x20]
push eax
push 0x4035b8
push esi
call edi
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
test eax, eax
jne 0x401e51
lea eax, [esp + 0x20]
push eax
push str._memset
push esi
call edi
test eax, eax
je 0x401f17
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
push eax
push str.CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
push esi
call edi
test eax, eax
je 0x401ebb
push dword [esp + 0x80]
mov ecx, dword [esp + 0x5c]
push dword [esp + 0x88]
sub ecx, dword [esp + 0x48]
push dword [esp + 0x20]
mov eax, dword [esp + 0x68]
push dword [esp + 0x28]
sbb eax, dword [esp + 0x54]
push 0
push dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0xac]
call fcn.004017d0
add esp, 0x20
test eax, eax
jne 0x401f17
lea eax, [esp + 0x20]
push eax
push str.CUtils::IsSingleSessionPerUser
push esi
call edi
test eax, eax
je 0x401f17
push dword [esp + 0x80]
mov ecx, dword [esp + 0x5c]
push dword [esp + 0x88]
sub ecx, dword [esp + 0x48]
push dword [esp + 0x20]
mov eax, dword [esp + 0x68]
push dword [esp + 0x28]
sbb eax, dword [esp + 0x54]
push 0
push dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0xac]
call fcn.004017d0
add esp, 0x20
test eax, eax
jne 0x401f17
push str.ERROR:_SingleUserPatch_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CDefPolicy::Query
push esi
call edi
test eax, eax
je 0x401f51
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push 0
push dword [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x9c]
call fcn.00401410
add esp, 0x10
jmp 0x401f5b
push str.ERROR:_CDefPolicy_Query_not_found
call ebx
add esp, 4
mov eax, dword [esp + 0x88]
mov eax, dword [eax + 0x30]
cmp eax, 0x60001
jbe 0x4022b5
cmp eax, 0x60002
lea eax, [esp + 0x20]
push eax
jne 0x401fc7
push str.SLGetWindowsInformationDWORDWrapper
push esi
call edi
test eax, eax
je 0x401fb4
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.SLPolicyInternal._1_s1_nSLPolicyOffset._1_s_2_llX_nSLPolicyFunc._1_sNew_Win8SL_n
call fcn.00401050
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_SLGetWindowsInformationDWORDWrapper_not_found
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CEnforcementCore::GetInstanceOfTSLicense
push esi
call edi
test eax, eax
je 0x402034
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::IsLicenseTypeLocalOnly
push esi
call edi
test eax, eax
je 0x40202d
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push 0
push dword [esp + 0x20]
lea ecx, [esp + 0x9c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.00401090
add esp, 0x18
jmp 0x40203e
push str.ERROR:_IsLicenseTypeLocalOnly_not_found
jmp 0x402039
push str.ERROR:_GetInstanceOfTSLicense_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::Initialize
push esi
call edi
test eax, eax
je 0x4022ab
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.SLInitHook._1_s1_nSLInitOffset._1_s_2_llX_nSLInitFunc._1_sNew_CSLQuery_Initialize_n
call fcn.00401050
mov ecx, dword [esp + 0x98]
movzx eax, word [ecx + 0x34]
push eax
movzx eax, word [ecx + 0x36]
push eax
movzx eax, word [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x32]
push eax
push str._n__hu._hu._hu._hu_SLInit__n
call fcn.00401010
add esp, 0x24
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bServerSku
push esi
call edi
test eax, eax
je 0x4020d1
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bServerSku._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x4020db
push str.ERROR:_bServerSku_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bRemoteConnAllowed
push esi
call edi
test eax, eax
je 0x402111
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bRemoteConnAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40211b
push str.ERROR:_bRemoteConnAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bFUSEnabled
push esi
call edi
test eax, eax
je 0x402151
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bFUSEnabled._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40215b
push str.ERROR:_bFUSEnabled_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bAppServerAllowed
push esi
call edi
test eax, eax
je 0x402191
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bAppServerAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40219b
push str.ERROR:_bAppServerAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bMultimonAllowed
push esi
call edi
test eax, eax
je 0x4021d1
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bMultimonAllowed._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x4021db
push str.ERROR:_bMultimonAllowed_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::lMaxUserSessions
push esi
call edi
test eax, eax
je 0x402211
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.lMaxUserSessions._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40221b
push str.ERROR:_lMaxUserSessions_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::ulMaxDebugSessions
push esi
call edi
test eax, eax
je 0x402251
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.ulMaxDebugSessions._s_llX_n
call fcn.00401010
add esp, 0x10
jmp 0x40225b
push str.ERROR:_ulMaxDebugSessions_not_found
call ebx
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.CSLQuery::bInitialized
push esi
call edi
test eax, eax
je 0x402298
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x5c]
sbb eax, dword [esp + 0x44]
push eax
push ecx
push dword [esp + 0x18]
push str.bInitialized._s_llX_n
call fcn.00401010
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_bInitialized_not_found
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_CSLQuery_Initialize_not_found
call ebx
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret