Function at 0x140038070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r15, rcx
mov qword [rsp + 0x58], rcx
xor r12d, r12d
mov r13d, r12d
mov dword [rsp + 0x34], r12d
cmp qword [rcx + 0x28], r12
je 0x14003825a
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, r15
lea rdx, [rbp + 0xe0]
call fcn.140003770
lea rax, [0x14003a620]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movdqu xmmword [rbp + 0xb0], xmm0
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x140038144
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rcx
lock inc dword [rcx + 0xc]
mov rcx, qword [rbp + 0xe8]
movups xmm0, xmmword [rbp + 0x90]
movups xmmword [rbp + 0xc0], xmm0
movzx eax, byte [rbp + 0xa0]
mov byte [rbp + 0xd0], al
mov qword [rbp + 0xd8], r15
mov r13d, 8
test rcx, rcx
je 0x14003818e
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14003818e
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_8]
nop
lea rax, [0x14041dcd8]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x30], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
movups xmm0, xmmword [rbp + 0x90]
movups xmmword [rbp + 0x38], xmm0
movzx eax, byte [rbp + 0xa0]
mov byte [rbp + 0x48], al
mov qword [rbp + 0x50], r15
lea rax, [rbp + 0x20]
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x70], Ordinal_60
mov rcx, qword [r15 + 0x28]
add rcx, 0x558
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0xe0]
call fcn.140005bf0
mov rbx, qword [rax]
mov rdi, qword [rbx + 0x20]
cmp rdi, qword [rbx + 0x28]
je 0x14003822f
mov qword [rsp + 0x48], rdi
mov qword [rdi + 0x38], r12
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140038228
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x38], rax
add qword [rbx + 0x20], 0x40
jmp 0x140038240
lea r8, [rbp + 0x20]
mov rdx, rdi
lea rcx, [rbx + 0x18]
call fcn.140005340
nop
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14003825a
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov r8d, 8
lea rdx, str.username
lea rcx, [rbp - 0x80]
call fcn.140006340
nop
lea r8, [rbp - 0x80]
mov rbx, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x68]
cmp rdi, 7
cmova r8, rbx
movabs rsi, 0xcbf29ce484222325
mov rdx, rsi
mov rcx, r12
mov r10, qword [rbp - 0x70]
lea r9, [r10 + r10]
movabs r11, 0x100000001b3
test r9, r9
je 0x1400382d4
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r11
inc rcx
cmp rcx, r9
jb 0x1400382c0
and rdx, qword [r15 + 0x388]
shl rdx, 4
add rdx, qword [r15 + 0x370]
mov rax, qword [rdx + 8]
mov r14, qword [r15 + 0x360]
cmp rax, r14
je 0x140038351
mov r11, qword [rdx]
nop dword [rax]
lea rdx, [rax + 0x10]
cmp qword [rax + 0x28], 7
jbe 0x14003830f
mov rdx, qword [rax + 0x10]
lea r9, [rbp - 0x80]
cmp rdi, 7
cmova r9, rbx
cmp r10, qword [rax + 0x20]
jne 0x140038346
mov r8, r10
test r10, r10
je 0x140038354
sub r9, rdx
nop dword [rax]
movzx ecx, word [rdx]
cmp word [rdx + r9], cx
jne 0x140038346
add rdx, 2
sub r8, 1
jne 0x140038330
jmp 0x140038354
cmp rax, r11
je 0x140038351
mov rax, qword [rax + 8]
jmp 0x140038300
mov rax, r12
test rax, rax
cmove rax, r14
cmp rax, r14
je 0x140038385
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140038385
mov dword [rsp + 0x20], r12d
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
call sub.VCRUNTIME140.dll___RTDynamicCast
jmp 0x140038388
mov rax, r12
mov qword [r15 + 0x478], rax
cmp rdi, 7
jbe 0x1400383ca
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400383c2
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003867e
mov rcx, rbx
call fcn.1403ca488
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov r8d, 8
lea rdx, str.password
lea rcx, [rbp - 0x60]
call fcn.140006340
nop
lea r8, [rbp - 0x60]
mov rbx, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x48]
cmp rdi, 7
cmova r8, rbx
mov rdx, rsi
mov rcx, r12
mov r10, qword [rbp - 0x50]
lea r9, [r10 + r10]
test r9, r9
je 0x140038435
movabs r11, 0x100000001b3
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r11
inc rcx
cmp rcx, r9
jb 0x140038421
and rdx, qword [r15 + 0x388]
shl rdx, 4
add rdx, qword [r15 + 0x370]
mov rax, qword [rdx + 8]
mov r14, qword [r15 + 0x360]
cmp rax, r14
je 0x1400384b1
mov r11, qword [rdx]
nop word [rax + rax]
lea rdx, [rax + 0x10]
cmp qword [rax + 0x28], 7
jbe 0x14003846f
mov rdx, qword [rax + 0x10]
lea r9, [rbp - 0x60]
cmp rdi, 7
cmova r9, rbx
cmp r10, qword [rax + 0x20]
jne 0x1400384a6
mov r8, r10
test r10, r10
je 0x1400384b4
sub r9, rdx
nop dword [rax]
movzx ecx, word [rdx]
cmp word [rdx + r9], cx
jne 0x1400384a6
add rdx, 2
sub r8, 1
jne 0x140038490
jmp 0x1400384b4
cmp rax, r11
je 0x1400384b1
mov rax, qword [rax + 8]
jmp 0x140038460
mov rax, r12
test rax, rax
cmove rax, r14
cmp rax, r14
je 0x1400384e5
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x1400384e5
mov dword [rsp + 0x20], r12d
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
call sub.VCRUNTIME140.dll___RTDynamicCast
jmp 0x1400384e8
mov rax, r12
mov qword [r15 + 0x480], rax
cmp rdi, 7
jbe 0x14003852a
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140038522
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003867e
mov rcx, rbx
call fcn.1403ca488
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov r8d, 9
lea rdx, str.autologin
lea rcx, [rbp - 0x40]
call fcn.140006340
nop
lea rdx, [rbp - 0x40]
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x28]
cmp rdi, 7
cmova rdx, rbx
mov rcx, r12
mov r10, qword [rbp - 0x30]
lea r8, [r10 + r10]
test r8, r8
je 0x140038596
movabs r12, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
xor rsi, rax
imul rsi, r12
inc rcx
cmp rcx, r8
jb 0x140038580
xor r12d, r12d
mov rdx, qword [r15 + 0x388]
and rdx, rsi
shl rdx, 4
add rdx, qword [r15 + 0x370]
mov rax, qword [rdx + 8]
mov rsi, qword [r15 + 0x360]
cmp rax, rsi
je 0x140038611
mov r11, qword [rdx]
nop
lea rdx, [rax + 0x10]
cmp qword [rax + 0x28], 7
jbe 0x1400385cf
mov rdx, qword [rax + 0x10]
lea r9, [rbp - 0x40]
cmp rdi, 7
cmova r9, rbx
cmp r10, qword [rax + 0x20]
jne 0x140038606
mov r8, r10
test r10, r10
je 0x140038614
sub r9, rdx
nop dword [rax]
movzx ecx, word [rdx]
cmp word [rdx + r9], cx
jne 0x140038606
add rdx, 2
sub r8, 1
jne 0x1400385f0
jmp 0x140038614
cmp rax, r11
je 0x140038611
mov rax, qword [rax + 8]
jmp 0x1400385c0
mov rax, r12
test rax, rax
cmove rax, rsi
cmp rax, rsi
je 0x140038645
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140038645
mov dword [rsp + 0x20], r12d
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
call sub.VCRUNTIME140.dll___RTDynamicCast
jmp 0x140038648
mov rax, r12
mov qword [r15 + 0x488], rax
cmp rdi, 7
jbe 0x14003868d
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140038685
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038685
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1403ca488
mov rcx, qword [r15 + 0x478]
mov rax, qword [rcx]
call qword [rax + 0x388]
mov qword [rbp + 0xf0], r12
xor r8d, r8d
mov rdx, qword [r15 + 0x10]
lea rcx, [rbp + 0xf0]
call fcn.1401769f0
nop
mov r12, qword [rbp + 0xf0]
test r12, r12
je 0x140038f91
xor edi, edi
mov r15d, edi
mov qword [rbp + 0x110], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140038727
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], 1
lea rcx, str.__GlobalConfig_Security
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140038fdc
jmp 0x14003872a
mov rbx, rdi
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140038ff2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x68], rdi
mov rax, qword [r12]
lea r8, [rbp + 0x68]
mov rdx, qword [rbx]
mov rcx, r12
call qword [rax + 0x128]
test eax, eax
jns 0x14003876f
lea r8, [0x14041b2b0]
mov rdx, r12
mov ecx, eax
call fcn.1403c9f60
mov rbx, qword [rbp + 0x68]
mov qword [rbp + 0x80], rbx
or r13d, 0x10
lea rcx, [rsp + 0x50]
call fcn.140018110
nop
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x88]
call fcn.140016c90
nop
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x1400387b6
mov r15, rcx
mov qword [rbp + 0x110], rcx
mov rcx, rdi
test rcx, rcx
je 0x1400387c2
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
test rbx, rbx
je 0x1400387d1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
test r15, r15
je 0x140038f82
mov r14, rdi
mov qword [rbp + 0x118], rdi
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rdx, str.User
lea rcx, [rbp + 0x80]
call fcn.140018080
nop
mov r8, rax
lea rdx, [rbp + 0x88]
mov rcx, r15
call fcn.140018190
nop
mov rcx, qword [rax]
test rcx, rcx
je 0x14003882c
mov r14, rcx
mov qword [rbp + 0x118], rcx
mov qword [rax], rdi
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x14003883f
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
test r14, r14
je 0x140038f73
mov rcx, r14
call fcn.140017fd0
mov dword [rsp + 0x50], eax
test eax, eax
jle 0x140038f73
mov dword [rbp + 0x70], edi
lea rcx, [rbp + 0xf8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, r14
call fcn.140017f90
mov esi, edi
mov dword [rsp + 0x40], edi
nop dword [rax + rax]
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x78], rdi
mov rax, qword [r14]
lea r8, [rbp + 0x78]
mov edx, esi
mov rcx, r14
call qword [rax + Ordinal_58]
test eax, eax
jns 0x1400388af
lea r8, [0x14041b2a0]
mov rdx, r14
mov ecx, eax
call fcn.1403c9f60
mov rbx, qword [rbp + 0x78]
mov qword [rbp + 0x80], rbx
or r13d, 4
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x88]
call fcn.140016c90
nop
test rbx, rbx
je 0x1400388e1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov rdi, qword [rbp + 0x88]
test rdi, rdi
je 0x140038f20
xor esi, esi
mov qword [rbp + 0x80], rsi
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rbp + 0x60], rax
test rax, rax
je 0x14003894b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rsi
mov dword [rbx + 0x10], 1
lea rcx, str.LoginName
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140038fe7
jmp 0x14003894e
mov rbx, rsi
mov qword [rbp + 0x68], rbx
test rbx, rbx
je 0x140038fd1
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x78], rsi
mov rax, qword [rdi]
lea r8, [rbp + 0x78]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [rax + 0x128]
test eax, eax
jns 0x140038990
lea r8, [0x14041b2b0]
mov rdx, rdi
mov ecx, eax
call fcn.1403c9f60
mov rbx, qword [rbp + 0x78]
mov qword [rsp + 0x38], rbx
or r13d, 0x20
mov dword [rsp + 0x34], r13d
lea rcx, [rbp + 0x68]
call fcn.140018110
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x80]
call fcn.140016c90
nop
test rbx, rbx
je 0x1400389cd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xor r13d, r13d
mov qword [rbp + 0xc0], r13
mov eax, 7
mov qword [rbp + 0xc8], rax
mov word [rbp + 0xb0], r13w
mov rsi, qword [rbp + 0x80]
test rsi, rsi
je 0x140038eb3
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.140017d90
nop
mov r9, qword [rax]
test r9, r9
je 0x140038a1f
mov r9, qword [r9]
jmp 0x140038a22
mov r9, r13
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140038a30
mov rax, qword [rbp + 0xc8]
cmp rdx, rax
ja 0x140038a7f
lea r13, [rbp + 0xb0]
cmp rax, 7
cmova r13, qword [rbp + 0xb0]
mov qword [rbp + 0xc0], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, r13
call sub.VCRUNTIME140.dll_memmove
xor ecx, ecx
mov word [rbx + r13], cx
xor r13d, r13d
jmp 0x140038a8c
lea rcx, [rbp + 0xb0]
call fcn.140004f70
nop
lea rcx, [rbp - 0x20]
call fcn.140018110
cmp qword [rbp + 0xc0], 0
je 0x140038eac
mov qword [rbp + 0x78], r13
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rdx, str.Password
lea rcx, [rbp - 0x18]
call fcn.140018080
nop
mov r8, rax
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.140017e60
nop
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.140016c90
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140038aee
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r13w
mov rbx, qword [rbp + 0x78]
test rbx, rbx
je 0x140038bb2
lea rdx, [rbp - 8]
mov rcx, rbx
call fcn.140017d90
nop
mov r9, qword [rax]
test r9, r9
je 0x140038b39
mov r9, qword [r9]
jmp 0x140038b3c
mov r9, r13
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140038b43
mov rcx, qword [rbp + 0xa8]
cmp rdx, rcx
ja 0x140038b9c
lea rax, [rbp + 0x90]
cmp rcx, 7
cmova rax, qword [rbp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0xa0], rdx
lea r13, [rdx + rdx]
mov r8, r13
mov rdx, r9
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x38]
xor ecx, ecx
mov word [rax + r13], cx
xor r13d, r13d
jmp 0x140038ba9
lea rcx, [rbp + 0x90]
call fcn.140004f70
nop
lea rcx, [rbp - 8]
call fcn.140018110
lea rdx, [0x1403f55d0]
mov ecx, 0x850
call fcn.1403caaf8
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x140038bdf
mov edx, 1
mov rcx, rax
call fcn.1401db540
mov r13, rax
test r13, r13
je 0x140038e67
mov rax, qword [r13]
lea rdx, [rbp + 0xb0]
mov rcx, r13
call qword [rax + 0x468]
mov rax, qword [r13]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [rax + 0x3e8]
nop
mov r8, qword [r13]
mov rdx, rax
mov rcx, r13
call qword [r8 + 0xa0]
nop
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x140038c36
mov rdx, qword [rsp + 0x60]
call fcn.140006010
mov eax, dword [rsp + 0x40]
mov dword [r13 + 0x80c], eax
cmp qword [rbp + 0xa0], 0
je 0x140038c67
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.140005e80
mov rdx, rax
mov rcx, r13
call fcn.1401dbcf0
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, str.IsLocked
lea rcx, [rbp]
call fcn.140018080
nop
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14003abb0
nop
mov rdx, rax
lea rcx, [rbp + 0xf8]
call qword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x14003900d
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp word [rbp + 0xf8], 8
jne 0x140038cf4
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 8]
call fcn.14003a9c0
mov ecx, dword [rsp + 0x34]
or ecx, 1
mov dword [rsp + 0x34], ecx
mov rcx, qword [rax]
test rcx, rcx
je 0x140038ce5
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
test eax, eax
mov byte [rsp + 0x30], 1
jne 0x140038cf9
mov byte [rsp + 0x30], 0
mov eax, dword [rsp + 0x34]
test al, 1
je 0x140038d11
and eax, 0xfffffffe
mov dword [rsp + 0x34], eax
lea rcx, [rbp + 8]
call fcn.140018110
cmp byte [rsp + 0x30], 0
je 0x140038d27
mov rax, qword [r13]
xor edx, edx
mov rcx, r13
call qword [rax + 0x138]
lea rcx, [rbp + 0xf8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x140039005
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x478]
mov rax, qword [rcx]
mov rdx, r13
call qword [rax + 0x350]
test al, al
je 0x140038e4d
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x128]
test al, al
je 0x140038e67
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0x470], 0
jge 0x140038e67
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
lea rdx, str.IsLastLogin
lea rcx, [rbp + 0x10]
call fcn.140018080
nop
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14003abb0
nop
mov rdx, rax
lea rcx, [rbp + 0xf8]
call qword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x140038ffd
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp word [rbp + 0xf8], 8
jne 0x140038e17
lea rdx, [rbp + 0xf8]
lea rcx, [rsp + 0x48]
call fcn.14003a9c0
mov ecx, dword [rsp + 0x34]
or ecx, 2
mov dword [rsp + 0x34], ecx
mov rcx, qword [rax]
test rcx, rcx
je 0x140038e04
mov rcx, qword [rcx]
jmp 0x140038e08
xor eax, eax
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
test eax, eax
je 0x140038e17
mov r13b, 1
jmp 0x140038e1a
xor r13b, r13b
mov eax, dword [rsp + 0x34]
test al, 2
je 0x140038e33
and eax, 0xfffffffd
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x48]
call fcn.140018110
test r13b, r13b
je 0x140038e67
mov rax, qword [rsp + 0x58]
mov ecx, dword [rbp + 0x70]
mov dword [rax + 0x470], ecx
inc ecx
mov dword [rbp + 0x70], ecx
jmp 0x140038e67
mov rax, qword [r13 + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, r13
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov r8, qword [rbp + 0xa8]
cmp r8, 7
jbe 0x140038e80
mov rdx, qword [rbp + 0x90]
call fcn.140006010
xor r13d, r13d
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r13w
test rbx, rbx
je 0x140038eac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov rax, qword [rbp + 0xc8]
cmp rax, 7
jbe 0x140038eee
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038ee9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038f42
call fcn.1403ca488
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r13w
test rsi, rsi
je 0x140038f17
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov esi, dword [rsp + 0x40]
mov r13d, dword [rsp + 0x34]
test rdi, rdi
je 0x140038f2f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
inc esi
mov dword [rsp + 0x40], esi
cmp esi, dword [rsp + 0x50]
jge 0x140038f49
xor edi, edi
jmp 0x140038880
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [rsp + 0x58]
mov edx, dword [rax + 0x470]
test edx, edx
js 0x140038f65
mov rcx, qword [rax + 0x478]
call fcn.1401c9ea0
nop
lea rcx, [rbp + 0xf8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
test r14, r14
je 0x140038f82
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
test r15, r15
je 0x140038f91
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
test r12, r12
je 0x140038fa1
mov rax, qword [r12]
mov rcx, r12
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, eax
call fcn.1403c9f50
nop
mov ecx, eax
call fcn.1403c9f50
nop
mov ecx, eax
call fcn.1403c9f50
int3