Function at 0x447b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, str.MIT_MAGIC_COOKIE_1
mov dword [ebp - 8], edx
mov eax, edi
mov dword [ebp - 0xc], ecx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [esi]
jne 0x447bb0
test dl, dl
je 0x447bac
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x447bb0
add eax, 2
add esi, 2
test cl, cl
jne 0x447b90
xor eax, eax
jmp 0x447bb5
sbb eax, eax
or eax, 1
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x447bce
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ebx
jmp 0x447c0f
mov ecx, str.XDM_AUTHORIZATION_1
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x447bf5
test dl, dl
je 0x447bf1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x447bf5
add eax, 2
add ecx, 2
test dl, dl
jne 0x447bd5
xor eax, eax
jmp 0x447bfa
sbb eax, eax
or eax, 1
test eax, eax
jne 0x447e59
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x34]
push 0
call fcn.0048ecb0
mov edi, eax
add esp, 4
test edi, edi
jne 0x447c36
mov ecx, str.Authorisation_not_recognised
call fcn.004919e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi], 2
jne 0x447e4b
cmp esi, 0x18
je 0x447c59
push esi
push str.XDM_AUTHORIZATION_1_data_was_wrong_length___d__expected_24_
call fcn.00490340
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0xffffffff
jne 0x447c70
mov ecx, str.cannot_do_XDM_AUTHORIZATION_1_without_remote_address_data
call fcn.004919e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, dword [edi + 4]
mov edx, ebx
add ecx, 9
call fcn.0047a800
mov eax, dword [edi + 4]
xorps xmm0, xmm0
movzx edx, byte [ebx + 9]
add esp, 4
movd xmm1, dword [ebx]
movzx ecx, byte [ebx + 0xc]
movd xmm3, dword [eax]
movd xmm2, dword [eax + 4]
movzx eax, byte [ebx + 8]
shl eax, 8
or edx, eax
punpcklbw xmm1, xmm0
movzx eax, byte [ebx + 0xa]
punpcklbw xmm3, xmm0
punpcklwd xmm1, xmm0
shl edx, 8
or edx, eax
punpcklwd xmm3, xmm0
movzx eax, byte [ebx + 0xb]
xorps xmm3, xmm1
movd xmm1, dword [ebx + 4]
punpcklbw xmm2, xmm0
shl ecx, 8
shl edx, 8
or edx, eax
punpcklwd xmm2, xmm0
movzx eax, byte [ebx + 0xd]
xor edx, dword [ebp - 0xc]
or ecx, eax
mov eax, dword [ebp - 8]
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
movzx eax, ax
xorps xmm2, xmm1
xor ecx, eax
orps xmm2, xmm3
movzx eax, byte [ebx + 0x16]
or edx, ecx
movzx ecx, byte [ebx + 0x17]
movaps xmm0, xmm2
or ecx, eax
psrldq xmm0, 8
movzx eax, byte [ebx + 0x15]
orps xmm2, xmm0
or ecx, eax
movups xmm0, xmm2
movzx eax, byte [ebx + 0x14]
or ecx, eax
psrldq xmm0, 4
movzx eax, byte [ebx + 0x13]
orps xmm2, xmm0
or ecx, eax
movd esi, xmm2
movzx eax, byte [ebx + 0x12]
or ecx, eax
or esi, edx
or esi, ecx
je 0x447d4e
mov ecx, str.XDM_AUTHORIZATION_1_data_failed_check
call fcn.004919e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, byte [ebx + 0xe]
movzx eax, byte [ebx + 0xf]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 0x10]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 0x11]
shl esi, 8
push 0
or esi, eax
call fcn.004a6015
mov ecx, esi
add esp, 4
sub ecx, eax
add ecx, 0x4b0
cmp ecx, 0x960
jbe 0x447d9a
mov ecx, str.XDM_AUTHORIZATION_1_time_stamp_was_too_far_out
call fcn.004919e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0xc
push 0
lea ecx, [edx - 0xb]
call fcn.0048ffe0
add esp, 4
mov dword [ebp - 8], eax
mov dword [eax], esi
mov ecx, dword [ebx + 8]
mov dword [eax + 4], ecx
mov cx, word [ebx + 0xc]
mov word [eax + 8], cx
cmp dword [edi + 0x18], 0
jne 0x447ddf
push 0x103
push str.C:Usersomahr_source_reposputty_caccode_sshx11fwd.c
push str.auth__xdmseen___NULL
call fcn.004a3dca
mov eax, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [edi + 0x18]
mov edx, eax
call fcn.0048ead0
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x447e06
call fcn.00490070
mov ecx, str.XDM_AUTHORIZATION_1_data_replayed
call fcn.004919e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x18]
xor edx, edx
call fcn.0048eb10
mov ebx, eax
test ebx, ebx
jne 0x447e2d
push 0x10c
push str.C:Usersomahr_source_reposputty_caccode_sshx11fwd.c
push str.seen___NULL
call fcn.004a3dca
add esp, 0xc
mov eax, esi
sub eax, dword [ebx]
cmp eax, 0x4b0
jbe 0x447e4b
mov ecx, dword [edi + 0x18]
xor edx, edx
call fcn.0048f360
mov ecx, eax
call fcn.00490070
jmp 0x447e06
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi], 0
jne 0x447e6f
mov ecx, str.No_authorisation_provided
call fcn.004919e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.Unsupported_authorisation_protocol__s
call fcn.00490340
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret