Function at 0x4402f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x98d0
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
push str._n_Parsing_the_XManager___d__session_file__s
call fcn.00449974
push 0x72
pop eax
xor ebx, ebx
mov word [ebp - 0x1bc0], ax
push 0x3e6
lea eax, [ebp - 0x1bbe]
mov dword [ebp - 0x98c4], ebx
push ebx
push eax
mov dword [ebp - 0x98c8], ebx
call fcn.00626f50
push 0x670244
lea eax, [ebp - 0x98c8]
push esi
push eax
call fcn.00632119
add esp, 0x24
test eax, eax
jne 0x4409d8
cmp dword [ebp - 0x98c8], ebx
je 0x4409d8
push esi
push str._nSuccessfully_opened_file_in_binary_mode__s
call fcn.00449974
push dword [ebp - 0x98c8]
lea eax, [ebp - 0x68]
push 2
push 1
push eax
call fcn.00637a2b
add esp, 0x18
cmp eax, 2
je 0x4403af
push str.RecoverXManagerPasswordsFromFile
push str._s___Error_in_reading_file_type_data
call fcn.00449974
pop ecx
pop ecx
jmp 0x4409eb
push dword [ebp - 0x98c8]
call fcn.00637603
mov al, byte [ebp - 0x68]
mov edi, 0x66ca20
pop ecx
cmp al, 0xff
jne 0x4403d4
cmp byte [ebp - 0x67], 0xfe
jne 0x4403f4
mov ebx, str._s___Unicode_LE_encoding_detected__open_s
jmp 0x4403e3
cmp al, 0xfe
jne 0x4403f4
cmp byte [ebp - 0x67], 0xff
jne 0x4403f4
mov ebx, str._s___Unicode_BE_encoding_detected__open_s
mov dword [ebp - 0x98cc], 1
mov eax, str.r__ccsUTF_16LE
jmp 0x440401
mov dword [ebp - 0x98cc], ebx
mov eax, edi
mov ebx, str._s___ANSI_encoding_detected__open_s
push eax
lea eax, [ebp - 0x1bc0]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0x1bc0]
push eax
push str.RecoverXManagerPasswordsFromFile
push ebx
call fcn.00449974
cmp dword [ebp - 0x98cc], 0
lea eax, [ebp - 0x1bc0]
cmovne edi, eax
lea eax, [ebp - 0x98c4]
push edi
push esi
push eax
call fcn.00632119
add esp, 0x24
test eax, eax
jne 0x4409cb
cmp dword [ebp - 0x98c4], eax
je 0x4409cb
mov esi, 0x3e7
lea eax, [ebp - 0x1007]
xor ebx, ebx
push esi
push ebx
push eax
mov byte [ebp - 0x1008], bl
call fcn.00626f50
push esi
lea eax, [ebp - 0xc1f]
mov byte [ebp - 0xc20], bl
push ebx
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x1fa7]
mov byte [ebp - 0x1fa8], bl
push ebx
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x13ef]
mov byte [ebp - 0x13f0], bl
push ebx
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x837]
mov byte [ebp - 0x838], bl
push ebx
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x238f]
mov byte [ebp - 0x2390], bl
push ebx
push eax
call fcn.00626f50
add esp, 0x48
mov byte [ebp - 0x450], bl
lea eax, [ebp - 0x44f]
push esi
push ebx
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x17d7]
mov byte [ebp - 0x17d8], bl
push ebx
push eax
call fcn.00626f50
add esp, 0x18
mov edi, ebx
mov ebx, dword [ebp + 8]
push 0x3c
pop eax
mov dword [ebp - 0x98d0], eax
mov esi, 0x3e8
cmp dword [ebp - 0x98cc], 0
push dword [ebp - 0x98c4]
push 0x2710
je 0x440568
lea eax, [ebp - 0x98c0]
push eax
call fcn.00631f5a
add esp, 0xc
test eax, eax
je 0x4408ea
xor ecx, ecx
lea eax, [ebp - 0x4aa0]
push ecx
push ecx
push 0x2710
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x98c0]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x44057f
lea eax, [ebp - 0x4aa0]
push eax
call fcn.00631f4f
add esp, 0xc
test eax, eax
je 0x4408ea
lea eax, [ebp - 0x4aa0]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x4405b1
lea eax, [ebp - 0x4aa0]
push eax
call fcn.00631510
dec eax
pop ecx
cmp eax, 0x2710
jae 0x4409fc
mov byte [ebp + eax - 0x4aa0], 0
lea eax, [ebp - 0x4aa0]
push eax
call fcn.00449da7
lea eax, [ebp - 0x4aa0]
push 0x5b
push eax
call fcn.006270b0
add esp, 0xc
test eax, eax
je 0x44063d
lea eax, [ebp - 0x4aa0]
push 0x5d
push eax
call fcn.006270b0
pop ecx
pop ecx
test eax, eax
je 0x44063d
lea eax, [ebp - 0x4aa0]
push eax
push str._n___Found_new_entry....__s
call fcn.00449974
lea eax, [ebp - 0x4aa0]
push str._Connection_
push eax
call fcn.00631435
add esp, 0x10
test eax, eax
je 0x44062e
cmp ebx, 0x15e
jne 0x440636
lea eax, [ebp - 0x4aa0]
push str._connection:authentication_
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
jne 0x440636
xor edi, edi
inc edi
jmp 0x44051a
xor edi, edi
jmp 0x44051a
push 0x6751e8
call fcn.00631510
push eax
lea eax, [ebp - 0x4aa0]
push 0x6751e8
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x440700
lea eax, [ebp - 0x4aa0]
push 0x3d
push eax
call fcn.006270b0
inc eax
push eax
lea eax, [ebp - 0x450]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x450]
push eax
call fcn.00449da7
lea eax, [ebp - 0x450]
push eax
push str._n_Found_Version_s
call fcn.00449974
lea eax, [ebp - 0x450]
push eax
call fcn.00631510
add esp, 0x24
cmp eax, 1
jb 0x44051a
cmp byte [ebp - 0x44f], 0x2e
movzx eax, byte [ebp - 0x44e]
movzx edx, byte [ebp - 0x44f]
movsx esi, byte [ebp - 0x450]
cmove edx, eax
movsx ecx, dl
test dl, dl
lea eax, [ecx - 0x30]
cmovne ecx, eax
lea eax, [esi - 0x30]
imul eax, eax, 0xa
add ecx, eax
push ecx
push str._n_Final_app_Version_d
mov dword [ebp - 0x98d0], ecx
call fcn.00449974
pop ecx
pop ecx
jmp 0x440515
test edi, edi
je 0x44051a
push str.host
call fcn.00631510
push eax
lea eax, [ebp - 0x4aa0]
push str.host
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x440765
lea eax, [ebp - 0x4aa0]
push 0x3d
push eax
call fcn.006270b0
inc eax
push eax
lea eax, [ebp - 0x1008]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x1008]
push eax
call fcn.00449da7
lea eax, [ebp - 0x1008]
push eax
push str._n_Found_Host_s
jmp 0x4408dd
push str.port
call fcn.00631510
push eax
lea eax, [ebp - 0x4aa0]
push str.port
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x4407c2
lea eax, [ebp - 0x4aa0]
push 0x3d
push eax
call fcn.006270b0
inc eax
push eax
lea eax, [ebp - 0xc20]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0xc20]
push eax
call fcn.00449da7
lea eax, [ebp - 0xc20]
push eax
push str._n_Found_Port_s
jmp 0x4408dd
cmp ebx, 0x15e
jne 0x440827
push str.protocol
call fcn.00631510
push eax
lea eax, [ebp - 0x4aa0]
push str.protocol
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x440827
lea eax, [ebp - 0x4aa0]
push 0x3d
push eax
call fcn.006270b0
inc eax
push eax
lea eax, [ebp - 0x17d8]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x17d8]
push eax
call fcn.00449da7
lea eax, [ebp - 0x17d8]
push eax
push str._n_Found_Protocol_s
jmp 0x4408dd
push str.username
call fcn.00631510
push eax
lea eax, [ebp - 0x4aa0]
push str.username
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x440881
lea eax, [ebp - 0x4aa0]
push 0x3d
push eax
call fcn.006270b0
inc eax
push eax
lea eax, [ebp - 0x13f0]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x13f0]
push eax
call fcn.00449da7
lea eax, [ebp - 0x13f0]
push eax
push str._n_Found_User_s
jmp 0x4408dd
push str.password
call fcn.00631510
push eax
lea eax, [ebp - 0x4aa0]
push str.password
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x44051a
lea eax, [ebp - 0x4aa0]
push 0x3d
push eax
call fcn.006270b0
inc eax
push eax
lea eax, [ebp - 0x838]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x838]
push eax
call fcn.00449da7
lea eax, [ebp - 0x838]
push eax
push str._n_Found_Encoded_Password_s
call fcn.00449974
add esp, 0x20
jmp 0x44051a
push dword [ebp - 0x98c4]
call fcn.00637603
lea eax, [ebp - 0x838]
push eax
call fcn.00631510
pop ecx
pop ecx
cmp eax, 1
jae 0x440917
push str._n_No_password_found_in_session_file...returning...
call fcn.00449974
jmp 0x4403a9
push esi
lea eax, [ebp - 0x2390]
push eax
lea eax, [ebp - 0x838]
push eax
mov eax, dword [ebp - 0x98d0]
push eax
push ebx
call fcn.0040ec87
add esp, 0x14
test eax, eax
jne 0x44094b
lea eax, [ebp - 0x838]
push eax
push str._n_Failed_to_decrypt_password__s
jmp 0x4403a3
lea eax, [ebp - 0xc20]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x440981
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0x1008]
push eax
push str._s:_s
lea eax, [ebp - 0x1fa8]
push esi
push eax
call fcn.00445d6d
add esp, 0x14
jmp 0x440998
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1fa8]
push esi
push eax
call fcn.006311ec
add esp, 0xc
push 0xffffffffffffffff
push 0x66ae5d
lea eax, [ebp - 0x2390]
push eax
lea ecx, [ebp - 0x13f0]
push ecx
lea ecx, [ebp - 0x1fa8]
push ecx
lea ecx, [ebp - 0x17d8]
push ecx
push ebx
push 4
call fcn.00412c85
xor eax, eax
add esp, 0x20
inc eax
jmp 0x4409ed
push esi
push str.RecoverXManagerPasswordsFromFile
push str._s_Failed_to_open_file__s
jmp 0x4409e3
push esi
push str.RecoverXManagerPasswordsFromFile
push str._s_Unable_to_open_file:___s
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3