Function at 0x140039020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov r13, rcx
mov qword [rbp - 0x18], rcx
xor r15d, r15d
mov eax, r15d
mov dword [rbp - 0x78], eax
mov dword [rsp + 0x64], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x130], xmm1
movups xmmword [rbp + 0x140], xmm1
cmp byte [0x1404b9e28], r15b
je 0x140039195
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rbp + 0x70]
movabs rbx, 0x47ae147ae147ae15
mov rax, rbx
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x64
sub rcx, rax
imul rcx, rcx, 0x64
movzx eax, word [rbp + 0x72]
add rcx, rax
imul rcx, rcx, 0x64
movzx eax, word [rbp + 0x76]
add rcx, rax
imul rcx, rcx
mov r9d, 0xa
mov r8d, reloc.SinoSPE.dll_Ordinal_16
lea rdx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ui64tow_s]
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsrev]
mov word [rbp + 0x120], r15w
cmp byte [0x1404b9e28], r15b
je 0x140039195
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rbp + 0x70]
mov rax, rbx
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x64
sub rcx, rax
imul rcx, rcx, 0x64
movzx eax, word [rbp + 0x72]
add rcx, rax
imul rdx, rcx, 0x64
movzx eax, word [rbp + 0x76]
add rdx, rax
imul rcx, rdx, 0xc85e4
mov r9d, 0xa
mov r8d, reloc.SinoSPE.dll_Ordinal_16
lea rdx, [rbp + 0x130]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ui64tow_s]
lea rcx, [rbp + 0x130]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsrev]
mov word [rbp + 0x140], r15w
mov rcx, qword [r13 + 0x480]
mov rax, qword [rcx]
lea rdx, [rbp + 0xb0]
call qword [rax + 0x310]
nop
mov rdi, 0xffffffffffffffff
mov r10, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xc0]
cmp word [rbp + 0x110], 0
je 0x140039275
lea rcx, [rbp + 0x110]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400391e0
lea r9, [rbp + 0xb0]
cmp r10, 7
cmova r9, qword [rbp + 0xb0]
cmp rdx, rax
jne 0x140039275
mov r8, rdx
lea rcx, [rbp + 0x110]
test rdx, rdx
je 0x140039234
lea rax, [rbp + 0x110]
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [r9 + rcx], ax
jne 0x140039275
add rcx, 2
sub r8, 1
jne 0x140039220
mov dword [0x1404b02a0], edi
mov r9, rdi
lea r8, str.STRING_USERNAME_FSE
mov edx, reloc.SinoSPE.dll_Ordinal_32
lea rcx, [0x1404b02a4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
movabs rax, 0x6000ffffffffffff
mov qword [0x1404b02e8], rax
mov dword [0x1404b02e4], r15d
mov bl, 1
jmp 0x14003a57d
cmp word [rbp + 0x130], 0
je 0x14003931b
lea rcx, [rbp + 0x130]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140039290
lea r8, [rbp + 0xb0]
cmp r10, 7
cmova r8, qword [rbp + 0xb0]
cmp rdx, rax
jne 0x14003931b
lea rcx, [rbp + 0x130]
test rdx, rdx
je 0x1400392e4
lea rax, [rbp + 0x130]
sub r8, rax
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14003931b
add rcx, 2
sub rdx, 1
jne 0x1400392d0
mov dword [0x1404b02a0], edi
mov r9, rdi
lea r8, str.STRING_USERNAME_SU
mov edx, reloc.SinoSPE.dll_Ordinal_32
lea rcx, [0x1404b02a4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov qword [0x1404b02e8], rdi
mov dword [0x1404b02e4], r15d
mov bl, 1
jmp 0x14003a57d
xor bl, bl
mov byte [rsp + 0x60], bl
mov rcx, qword [r13 + 0x478]
mov eax, dword [rcx + 0x644]
mov dword [rsp + 0x64], eax
test eax, eax
js 0x14003a584
lea rdx, [rbp + 0xf0]
call fcn.1401c9d90
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
mov word [rbp + 0x190], ax
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400393b0
lea rax, [rcx + 1]
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0xb0]
cmp rdx, 7
cmova rax, qword [rbp + 0xb0]
mov dword [rax + rcx*2], 0x5f
jmp 0x1400393d1
mov qword [rsp + 0x20], 1
lea r9, [0x14041db78]
mov edx, 1
lea rcx, [rbp + 0xb0]
call fcn.140003d80
lea rdx, [rbp + 0x28]
mov rcx, qword [r13 + 0x478]
call fcn.1401c9bf0
nop
mov r9, rax
cmp qword [rax + 0x18], 7
jbe 0x1400393ef
mov r9, qword [rax]
mov rsi, qword [rax + 0x10]
mov r14, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
sub rax, r14
cmp rsi, rax
ja 0x140039445
lea rax, [rsi + r14]
mov qword [rbp + 0xc0], rax
lea rbx, [rbp + 0xb0]
cmp rcx, 7
cmova rbx, qword [rbp + 0xb0]
lea rcx, [rbx + r14*2]
lea r8, [rsi + rsi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rsi]
mov word [rbx + rax*2], r15w
jmp 0x14003945a
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp + 0xb0]
call fcn.140003d80
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14003949d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039498
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039498
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rdx, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0xf0]
cmp byte [0x1404b9e28], 0
je 0x14003a2aa
test rdx, rdx
je 0x14003a2aa
lea rcx, [rbp + 0x150]
call fcn.140234130
test al, al
je 0x14003a2aa
lea rcx, [rbp + 0x150]
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400394f0
lea r8, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova r8, rsi
mov rdx, qword [rbp + 0x100]
cmp rdx, rax
jne 0x14003a052
lea rcx, [rbp + 0x150]
test rdx, rdx
je 0x140039558
lea rax, [rbp + 0x150]
sub r8, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x14003a052
add rcx, 2
sub rdx, 1
jne 0x140039540
mov rcx, qword [r13 + 0x478]
call fcn.1401c9c90
mov dword [0x1404b02a0], eax
lea rdx, [rbp + 0x28]
mov rcx, qword [r13 + 0x478]
call fcn.1401c9bf0
cmp qword [rax + 0x18], 7
jbe 0x140039584
mov rax, qword [rax]
mov r9, rdi
mov r8, rax
mov edx, reloc.SinoSPE.dll_Ordinal_32
lea rcx, [0x1404b02a4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x1400395df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400395da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400395da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
xor ebx, ebx
mov dword [0x1404b02e4], ebx
mov qword [0x1404b02e8], rbx
mov qword [rbp + 0xd0], rbx
lea r8, str.VerifyUser
mov rdx, qword [r13 + 0x10]
lea rcx, [rbp + 0xd0]
call fcn.1401769f0
nop
mov r12, qword [rbp + 0xd0]
test r12, r12
je 0x14003a03d
mov dword [rbp - 0x74], ebx
mov r15d, ebx
mov qword [rbp + 0xe0], rbx
lea rax, [rbp + 0x68]
mov qword [rbp - 0x70], rax
lea rdx, str.__GlobalConfig_Security
lea rcx, [rbp + 0x68]
call fcn.140018080
nop
mov r8, rax
lea rdx, [rbp - 0x68]
mov rcx, r12
call fcn.140017e60
nop
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140016c90
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140039675
mov r15, rcx
mov qword [rbp + 0xe0], rcx
mov ecx, ebx
test rcx, rcx
je 0x140039681
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140039691
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
test r15, r15
je 0x140039c82
mov rax, qword [r13 + 0x488]
mov ecx, 8
cmp byte [rax + 0x5e8], 0
je 0x140039707
mov word [rbp + 0x70], cx
lea rcx, reloc.SinoSPE.dll_Ordinal_49
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x78], rax
test rax, rax
je 0x14003a604
lea rax, [rbp + 0x68]
mov qword [rbp - 0x70], rax
lea rdx, str.IsAutoLogin
lea rcx, [rbp + 0x68]
call fcn.140018080
nop
lea r8, [rbp + 0x70]
mov rdx, rax
mov rcx, r15
call fcn.14003a920
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [rbp - 0x74], 1
mov r14, rbx
mov qword [rbp + 0xe8], rbx
lea rax, [rbp + 0x68]
mov qword [rbp - 0x70], rax
lea rdx, str.User
lea rcx, [rbp + 0x68]
call fcn.140018080
nop
mov r8, rax
lea rdx, [rbp + 0x60]
mov rcx, r15
call fcn.140018190
nop
mov rcx, qword [rax]
test rcx, rcx
je 0x14003974f
mov r14, rcx
mov qword [rbp + 0xe8], rcx
mov qword [rax], rbx
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x14003975f
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
test r14, r14
je 0x140039a7c
mov rcx, r14
call fcn.140017fd0
mov esi, eax
mov dword [rbp - 0x68], eax
test eax, eax
jle 0x140039a7c
lea rcx, [rbp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, r14
call fcn.140017f90
mov r13d, ebx
nop word [rax + rax]
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x60], rbx
mov rax, qword [r14]
lea r8, [rbp + 0x60]
mov edx, r13d
mov rcx, r14
call qword [rax + Ordinal_58]
test eax, eax
jns 0x1400397cd
lea r8, [0x14041b2a0]
mov rdx, r14
mov ecx, eax
call fcn.1403c9f60
mov rbx, qword [rbp + 0x60]
mov qword [rbp + 0x60], rbx
or dword [rbp - 0x78], 1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x68]
call fcn.140016c90
nop
test rbx, rbx
je 0x1400397f6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov rdi, qword [rbp + 0x68]
test rdi, rdi
je 0x140039a10
cmp r13d, dword [0x1404b02a0]
jne 0x1400399eb
xor ebx, ebx
mov qword [rbp + 0x60], rbx
lea rax, [rbp - 0x10]
mov qword [rbp + 0xd8], rax
lea rdx, str.Authority
lea rcx, [rbp - 0x10]
call fcn.140018080
nop
mov r8, rax
lea rdx, [rbp - 8]
mov rcx, rdi
call fcn.140017e60
nop
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140016c90
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14003985f
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov rsi, qword [rbp + 0x60]
test rsi, rsi
je 0x1400398b1
lea rdx, [rbp]
mov rcx, rsi
call fcn.140017d90
mov rcx, qword [rax]
test rcx, rcx
je 0x140039881
mov rcx, qword [rcx]
jmp 0x140039884
mov rcx, rbx
xor edx, edx
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoull]
mov qword [0x1404b02e8], rax
lea rcx, [rbp]
call fcn.140018110
and dword [0x1404b02ec], 0x3fffffff
jmp 0x14003997c
test r13d, r13d
jne 0x1400398cc
movabs rax, 0x2000ffffffffffff
mov qword [0x1404b02e8], rax
jmp 0x14003997c
mov qword [rbp + 0xd8], rbx
lea rax, [rbp + 8]
mov qword [rbp + 0x70], rax
lea rdx, str.Authority
lea rcx, [rbp + 8]
call fcn.140018080
nop
mov r8, rax
lea rdx, [rbp + 0x10]
mov rcx, r12
call fcn.140017ba0
nop
mov rcx, qword [rax]
test rcx, rcx
je 0x140039915
mov rbx, rcx
mov qword [rbp + 0xd8], rcx
mov qword [rax], 0
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140039925
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
lea rax, [rbp + 0x18]
mov qword [rbp + 0x70], rax
lea rdx, [0x14041aa8c]
lea rcx, [rbp + 0x18]
call fcn.140018080
nop
test rbx, rbx
je 0x14003a5f9
mov rdx, rax
mov rcx, rbx
call fcn.140017cc0
mov r8, rbx
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.1400178e0
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140039972
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov eax, 8
mov word [rsp + 0x68], ax
lea rcx, reloc.SinoSPE.dll_Ordinal_49
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14003a60f
lea rax, [rbp - 0x20]
mov qword [rbp + 0x70], rax
lea rdx, str.IsLastLogin
lea rcx, [rbp - 0x20]
call fcn.140018080
nop
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, rdi
call fcn.14003a920
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
test rsi, rsi
je 0x1400399e6
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
mov esi, dword [rbp - 0x68]
jmp 0x140039a10
lea rax, [rbp - 0x70]
mov qword [rbp + 0x70], rax
lea rdx, str.IsLastLogin
lea rcx, [rbp - 0x70]
call fcn.140018080
nop
mov rdx, rax
mov rcx, rdi
call fcn.14003a860
nop
test rdi, rdi
je 0x140039a1f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
inc r13d
cmp r13d, esi
jge 0x140039a2e
xor ebx, ebx
jmp 0x1400397a0
mov rax, qword [rbp - 0x18]
mov ecx, dword [rsp + 0x64]
cmp dword [rax + 0x470], ecx
jne 0x140039a44
cmp dword [rbp - 0x74], 0
je 0x140039a63
mov qword [rbp + 0x68], r12
mov rax, qword [r12]
mov rcx, r12
call qword [rax + reloc.SinoSPE.dll_Ordinal_8]
nop
lea rdx, str.VerifyUser
lea rcx, [rbp + 0x68]
call fcn.140177c40
mov byte [rsp + 0x60], 1
lea rcx, [rbp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor ebx, ebx
jmp 0x140039c5e
xor edx, edx
mov r8d, 0x258
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov r8d, reloc.SinoSPE.dll_Ordinal_29
lea rdx, str.STRING_GCONFIG_NODE_NOT_EXIST
lea rcx, [rbp + 0x90]
call fcn.140006340
nop
call fcn.1401d56e0
mov rcx, rax
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x28]
call fcn.1401d7170
lea r8, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova r8, qword [rbp + 0x28]
lea r9, str.User
mov rdx, rdi
lea rcx, [rbp + 0x1a0]
call fcn.140016d80
lea rcx, [rbp + 0x28]
call fcn.140006060
nop
lea rcx, [rbp + 0x90]
call fcn.140006060
mov dword [rsp + 0x28], 1
mov r9d, 2
lea r8, str.Cannot_find_any_User_node.
lea rdx, [0x1404397d8]
lea rcx, str.VerifyUser
call fcn.14016ca80
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
xor r8d, r8d
lea rdx, [0x140419d94]
lea rcx, [rbp + 0x70]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 9
lea rdx, str.MSGBOX_OK
lea rcx, [rsp + 0x68]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
xor r8d, r8d
lea rdx, [0x140419d94]
lea rcx, [rbp + 0x90]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
lea rax, [rbp + 0x1a0]
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140039bd0
mov r8, rdi
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x28]
call fcn.140006340
nop
mov dword [rsp + 0x50], reloc.SinoSPE.dll_Ordinal_16
mov byte [rsp + 0x48], 1
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 1
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, qword [r13 + 0x10]
call fcn.140120d20
nop
lea rcx, [rbp + 0x28]
call fcn.140006060
nop
lea rcx, [rbp + 0x90]
call fcn.140006060
nop
lea rcx, [rsp + 0x68]
call fcn.140006060
nop
lea rcx, [rbp + 0x70]
call fcn.140006060
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov qword [rbp + 0xe0], rbx
test r14, r14
je 0x140039c7d
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
jmp 0x14003a036
xor edx, edx
mov r8d, 0x258
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
mov r8d, reloc.SinoSPE.dll_Ordinal_29
lea rdx, str.STRING_GCONFIG_NODE_NOT_EXIST
lea rcx, [rbp - 0x40]
call fcn.140006340
nop
call fcn.1401d56e0
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
xor r8d, r8d
lea rdx, [0x140419d94]
lea rcx, [rbp - 0x60]
call fcn.140006340
nop
mov dword [rsp + 0x64], 4
mov rsi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x40]
mov r10, qword [rbp - 0x30]
test r10, r10
je 0x140039e09
lea r8, [rbp - 0x40]
cmp rsi, 7
cmova r8, rbx
movabs rcx, 0xcbf29ce484222325
xor r14d, r14d
mov edx, r14d
lea r9, [r10 + r10]
test r9, r9
je 0x140039d54
movabs r11, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor rcx, rax
imul rcx, r11
inc rdx
cmp rdx, r9
jb 0x140039d40
mov rax, qword [r15 + 0x38]
and rax, rcx
add rax, rax
mov rcx, qword [r15 + 0x20]
mov r9, qword [rcx + rax*8 + 8]
mov r11, qword [r15 + 0x10]
cmp r9, r11
jne 0x140039d75
mov r9, r14
jmp 0x140039dd4
mov r14, qword [rcx + rax*8]
nop dword [rax]
lea rcx, [r9 + 0x10]
cmp qword [r9 + 0x28], 7
jbe 0x140039d8f
mov rcx, qword [r9 + 0x10]
lea r8, [rbp - 0x40]
cmp rsi, 7
cmova r8, rbx
cmp r10, qword [r9 + 0x20]
jne 0x140039dc6
mov rdx, r10
test r10, r10
je 0x140039dd4
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140039dc6
add rcx, 2
sub rdx, 1
jne 0x140039db0
jmp 0x140039dd4
cmp r9, r14
je 0x140039dd1
mov r9, qword [r9 + 8]
jmp 0x140039d80
xor r9d, r9d
test r9, r9
cmovne r11, r9
cmp r11, qword [r15 + 0x10]
je 0x140039e09
lea r8, [r11 + 0x30]
lea rax, [rbp - 0x60]
cmp rax, r8
je 0x140039e09
mov rdx, r8
cmp qword [r8 + 0x18], 7
jbe 0x140039dfb
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
lea rcx, [rbp - 0x60]
call fcn.1400050d0
nop
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r8, qword [rbp - 0x60]
lea r9, str.__GlobalConfig_Security
mov rdx, rdi
lea rcx, [rbp + 0x1a0]
call fcn.140016d80
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140039e70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039e6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039e6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
movdqa xmm0, xmmword [0x1404530e0]
movdqu xmmword [rbp - 0x50], xmm0
xor eax, eax
mov word [rbp - 0x60], ax
cmp rsi, 7
jbe 0x140039ec1
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140039eb9
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039eb9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1403ca488
mov dword [rsp + 0x28], 1
mov r9d, 2
lea r8, str.Cannot_find_GlobalConfig_Security_node.
lea rdx, [0x1404397d8]
lea rcx, str.VerifyUser
call fcn.14016ca80
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
xor r8d, r8d
lea rdx, [0x140419d94]
lea rcx, [rbp + 0x28]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov r8d, 9
lea rdx, str.MSGBOX_OK
lea rcx, [rbp + 0x70]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
xor r8d, r8d
lea rdx, [0x140419d94]
lea rcx, [rsp + 0x68]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
lea rax, [rbp + 0x1a0]
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140039f80
mov r8, rdi
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x90]
call fcn.140006340
nop
mov dword [rsp + 0x50], reloc.SinoSPE.dll_Ordinal_16
mov byte [rsp + 0x48], 1
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x90]
mov rcx, qword [r13 + 0x10]
call fcn.140120d20
nop
mov r8, qword [rbp + 0xa8]
cmp r8, 7
jbe 0x14003a000
mov rdx, qword [rbp + 0x90]
call fcn.140006010
nop
mov r8, qword [rbp - 0x80]
cmp r8, 7
jbe 0x14003a015
mov rdx, qword [rsp + 0x68]
call fcn.140006010
nop
mov r8, qword [rbp + 0x88]
cmp r8, 7
jbe 0x14003a02c
mov rdx, qword [rbp + 0x70]
call fcn.140006010
nop
lea rcx, [rbp + 0x28]
call fcn.140006060
nop
mov rsi, qword [rbp + 0xf0]
test r12, r12
je 0x14003a04d
mov rax, qword [r12]
mov rcx, r12
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
nop
jmp 0x14003a533
mov dword [rsp + 0x28], 1
mov r9d, 2
lea r8, str.Incorrect_password.
lea rdx, [0x1404397d8]
lea rcx, str.VerifyUser
call fcn.14016ca80
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
xor r8d, r8d
lea rdx, [0x140419d94]
lea rcx, [rbp + 0x28]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov r8d, 9
lea rdx, str.MSGBOX_OK
lea rcx, [rbp + 0x70]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, reloc.SinoSPE.dll_Ordinal_16
lea rdx, str.LOGIN_FORM_TITLE
lea rcx, [rsp + 0x68]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov r8d, Ordinal_32
lea rdx, str.STRING_LOGIN_INCORRECT_PASSWORD
lea rcx, [rbp + 0x90]
call fcn.140006340
nop
mov dword [rsp + 0x50], reloc.SinoSPE.dll_Ordinal_16
mov byte [rsp + 0x48], 1
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp + 0x90]
mov rcx, qword [r13 + 0x10]
call fcn.140120d20
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14003a1ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a1a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a1a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14003a1f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a1ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a1ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14003a239
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a233
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a233
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14003a279
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a274
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a4c8
call fcn.1403ca488
mov rdx, qword [r13 + 0x480]
mov rcx, r13
call fcn.1401b74b0
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, reloc.SinoSPE.dll_Ordinal_23
mov rdx, qword [r13 + 0x480]
mov rcx, r13
call fcn.1401b7bb0
jmp 0x14003a533
mov dword [rsp + 0x28], 1
mov r9d, 2
lea r8, str.Incorrect_password.
lea rdx, [0x1404397d8]
lea rcx, str.VerifyUser
call fcn.14016ca80
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
xor r8d, r8d
lea rdx, [0x140419d94]
lea rcx, [rbp + 0x70]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 9
lea rdx, str.MSGBOX_OK
lea rcx, [rsp + 0x68]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov r8d, reloc.SinoSPE.dll_Ordinal_16
lea rdx, str.LOGIN_FORM_TITLE
lea rcx, [rbp + 0x90]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov r8d, Ordinal_32
lea rdx, str.STRING_LOGIN_INCORRECT_PASSWORD
lea rcx, [rbp + 0x28]
call fcn.140006340
nop
mov dword [rsp + 0x50], reloc.SinoSPE.dll_Ordinal_16
mov byte [rsp + 0x48], 1
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 1
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp + 0x28]
mov rcx, qword [r13 + 0x10]
call fcn.140120d20
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14003a3ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a3f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a3f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14003a449
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a443
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a443
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14003a48e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a488
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a488
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14003a4d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a4cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a4cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov rdx, qword [r13 + 0x480]
mov rcx, r13
call fcn.1401b74b0
mov rbx, qword [r13 + 0x480]
test rbx, rbx
je 0x14003a533
mov word [rbp + 0x44], r15w
mov dword [rbp + 0x58], 0
mov qword [rbp + 0x30], rbx
mov dword [rbp + 0x28], reloc.SinoSPE.dll_Ordinal_23
mov rax, qword [r13 + 0x180]
mov qword [rbp + 0x3c], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0x38], eax
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], r15
mov rax, qword [rbx]
lea rdx, [rbp + 0x28]
mov rcx, rbx
call qword [rax + 0x238]
nop
mov rax, qword [rbp + 0x108]
cmp rax, 7
jbe 0x14003a578
lea rdx, [rax*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003a570
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a570
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1403ca488
movzx ebx, byte [rsp + 0x60]
mov r10, qword [rbp + 0xc8]
cmp r10, 7
jbe 0x14003a5c6
lea rdx, [r10*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a5c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a5c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
movzx eax, bl
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004003
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
int3