Function at 0x40ec87
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fc0
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
mov dword [ebp - 0x1fbc], esi
push str.Decrypting_XManager_password_for_app_d__version_d
mov dword [ebp - 0x1fac], 0x3e8
call fcn.00449974
add esp, 0xc
mov byte [esi], 0
push ebx
push ebx
call fcn.00631510
pop ecx
push eax
push str._n_Base64_decoding_the_input_password___d___s
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0x17d8]
push eax
push ebx
call fcn.00445e29
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x40ed10
push ebx
push str._n_Failed_to_decode_base64_password__s
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
jmp 0x40f057
push esi
push str._n_Successfully_decoded_base64_password__output_size__d
call fcn.00449974
pop ecx
pop ecx
cmp edi, 0x33
jl 0x40ed39
sub esi, 0x20
cmp esi, 0x3e8
jae 0x40f066
mov byte [ebp + esi - 0x17d8], 0
push esi
push str._n_Final_password_data_size__d
call fcn.00449974
pop ecx
pop ecx
cmp esi, 1
jge 0x40ed53
push esi
push str._n_Invalid_data_of_size__d_found_...returning_now
jmp 0x40ed02
mov ebx, 0x3e7
mov dword [ebp - 0x1fb4], 0x3e8
push ebx
lea eax, [ebp - 0x44f]
mov byte [ebp - 0x450], 0
push 0
push eax
call fcn.00626f50
push ebx
lea eax, [ebp - 0x1007]
mov byte [ebp - 0x1008], 0
push 0
push eax
call fcn.00626f50
push ebx
xor ebx, ebx
mov byte [ebp - 0x838], 0
lea eax, [ebp - 0x837]
push ebx
push eax
call fcn.00626f50
xor eax, eax
mov dword [ebp - 0x1fb8], 0x44
push 0x7ce
mov word [ebp - 0x1fa8], ax
lea eax, [ebp - 0x1fa6]
push ebx
push eax
call fcn.00626f50
add esp, 0x30
cmp edi, 0x33
jl 0x40eeca
lea eax, [ebp - 0x1fb0]
mov dword [ebp - 0x1fb0], 0x3e8
push eax
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x450]
push eax
push str._n_Found_current_user__s
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x1fc0]
push eax
lea eax, [ebp - 0x1fb4]
push eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1fb8]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x450]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x40ee5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x450]
push eax
push str.DecryptXManagerPassword
push str._n_n_s_Failed_to_get_SID_value_of_current_user__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x40ed09
push 0x3e8
lea eax, [ebp - 0x1fa8]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00449d42
add esp, 0xc
test eax, eax
jne 0x40ee98
lea eax, [ebp - 0x450]
push eax
push str.DecryptXManagerPassword
push str._n_n_s_Failed_to_get_SID_value_of_current_user__s
call fcn.00449974
add esp, 0xc
jmp 0x40ed09
push ebx
push ebx
push 0x3e8
lea eax, [ebp - 0x838]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1fa8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x838]
push eax
push str._n_Final_user_SID_after_ascii_conversion_is__s
call fcn.00449974
pop ecx
pop ecx
mov dword [ebp - 0x24], 0x35986e30
mov dword [ebp - 0x20], 0xd29192de
mov dword [ebp - 0x1c], 0xb228bb27
mov dword [ebp - 0x18], 0x33ca2df7
mov dword [ebp - 0x14], 0x7e9b2dba
mov dword [ebp - 0x10], 0xd173ca9c
mov dword [ebp - 0xc], 0x7267b252
mov dword [ebp - 8], 0x5ef52d66
cmp edi, 0x33
jge 0x40ef3a
push str._n__Version___5.1__Copying_MD5_hash_of_size_16
call fcn.00449974
cmp dword [ebp + 8], 0x15d
lea ecx, [ebp - 0x24]
push 0x10
pop edi
lea eax, [ebp - 0x14]
cmove eax, ecx
push edi
push eax
lea eax, [ebp - 0x13f0]
push eax
call fcn.006269d0
add esp, 0x10
jmp 0x40f00e
je 0x40ef74
cmp edi, 0x34
je 0x40ef74
push str._n__Version___5.3__copying_Username__SID_value_for_key_generation
call fcn.00449974
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x450]
push eax
push 0x66ea84
lea eax, [ebp - 0xc20]
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x18
jmp 0x40ef9e
push str._n__Version__5.1__5.2__copying_SID_value_for_key_generation
call fcn.00449974
lea eax, [ebp - 0x838]
push eax
push 0x66bf70
lea eax, [ebp - 0xc20]
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x14
lea eax, [ebp - 0xc20]
push eax
push str._n_Generating_sha256_hash_of__s
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x1fac]
push eax
lea eax, [ebp - 0x13f0]
push eax
lea eax, [ebp - 0xc20]
push eax
call fcn.00631510
pop ecx
push eax
lea eax, [ebp - 0xc20]
push eax
push 0x800c
call fcn.0041037c
add esp, 0x14
test eax, eax
jne 0x40effb
lea eax, [ebp - 0xc20]
push eax
push str.DecryptXManagerPassword
push str._n_n_s_Failed_to_generate_sha256_hash_of__s
jmp 0x40ee8b
mov edi, dword [ebp - 0x1fac]
push edi
push str._n_Generated_sha256_hash_of_size_d_n
call fcn.00449974
pop ecx
pop ecx
push dword [ebp + 0x18]
mov ebx, dword [ebp - 0x1fbc]
lea eax, [ebp - 0x13f0]
push ebx
push edi
push eax
lea eax, [ebp - 0x17d8]
push esi
push eax
call fcn.0044999e
add esp, 0x18
test eax, eax
jne 0x40f043
push str.DecryptXManagerPassword
push str._n_n_s_Failed_to_RC4_decrypt_password
jmp 0x40ed02
push ebx
push dword [ebp + 0x18]
push str._n___Succesfully_decrypted_password___d____s
call fcn.00449974
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3