Function at 0x493270
Capabilities:
Encrypt data using speck
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov ebp, dword [esp + 0x220]
mov esi, ecx
mov ebx, edx
lea ecx, [esp + 0x4c]
push ebp
call fcn.0041f530
add esp, 4
cmp word [esp + 0x4c], 2
jne 0x493430
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], 0
mov dword [esp + 0x8c], 0x3a
mov byte [esp + 0xa4], 1
mov dword [esp + 0xa0], 0x3a
lea ecx, [ebx + 3]
lea eax, [ebx - 1]
mov edx, ebx
mov dword [esp + 0x18], esi
mov edi, dword [esp + 0x9c]
and ecx, 0xfffffffc
mov dword [esp], eax
sub ecx, ebx
mov ebx, ebp
mov dword [esp + 8], ecx
jmp 0x49330a
cmp edi, ebp
mov ebx, edi
ja 0x4934c4
mov esi, ebx
mov ebp, ebx
mov dword [esp + 4], ebx
sub esi, ecx
jb 0x493327
and esi, 7
mov ebp, ebx
mov dword [esp + 4], ecx
sub ebp, esi
jb 0x4935fd
mov eax, dword [esp]
mov esi, ebx
mov dword [esp + 0x10], ebx
sub esi, ebp
add ebx, eax
nop word cs:[eax + eax]
nop
test esi, esi
je 0x493360
dec esi
cmp byte [ebx], 0x3a
lea ebx, [ebx - 1]
jne 0x493340
add esi, ebp
mov ebp, dword [esp + 0x220]
jmp 0x4933e3
mov dword [esp + 0xc], edi
nop word cs:[eax + eax]
nop
cmp ebp, dword [esp + 4]
mov ebx, ebp
jbe 0x4933b3
mov edi, dword [edx + ebx - 8]
mov ecx, dword [edx + ebx - 4]
mov eax, edx
lea ebp, [ebx - 8]
mov esi, edi
mov edx, ecx
xor esi, 0xc5c5c5c5
xor edx, 0xc5c5c5c5
add edx, 0x1010101
add esi, 0x1010101
or edx, ecx
or esi, edi
and esi, edx
mov edx, eax
not esi
test esi, 0x80808080
je 0x493370
cmp ebx, dword [esp + 0x10]
ja 0x4935f0
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x220]
mov ecx, dword [esp + 8]
mov edi, dword [esp]
nop
test ebx, ebx
je 0x49348c
cmp byte [edi + ebx], 0x3a
lea esi, [ebx - 1]
mov ebx, esi
jne 0x4933d0
mov edi, esi
cmp esi, ebp
jae 0x493300
mov al, 0x3a
cmp byte [edx + edi], al
jne 0x493300
lea eax, [edi + 1]
mov ecx, 0x8c6bdc
sub ebp, eax
mov dword [esp + 4], eax
je 0x493498
lea esi, [edx + edi + 1]
cmp ebp, 1
jne 0x4934cd
movzx eax, byte [esi]
cmp eax, 0x2b
je 0x493498
mov ebp, 1
cmp eax, 0x2d
je 0x493498
jmp 0x49350b
movzx eax, byte [0x90320d]
xor ecx, ecx
mov edx, 0x20
call fcn.0049d570
test eax, eax
je 0x4939f6
movsd xmm0, qword [esp + 0x64]
mov ecx, eax
add ecx, 0x20
movsd qword [eax + 0x18], xmm0
movsd xmm0, qword [esp + 0x5c]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [esp + 0x4c]
movsd xmm1, qword [esp + 0x54]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], ecx
jmp 0x4934b9
mov dword [esp + 0x9c], eax
mov ecx, 0x8c6bbc
mov esi, dword [esp + 0x18]
mov byte [esp + 0x30], 2
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 0
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x9c], edi
jmp 0x493493
cmp byte [esi], 0x2b
jne 0x493506
inc esi
cmp ebp, 6
lea ebp, [ebp - 1]
jb 0x49350b
xor eax, eax
mov dword [esp], edx
sub ebp, 1
jb 0x49352a
mov dx, 0xa
mul dx
movzx edx, byte [esi]
seto bl
add edx, 0xffffffd0
cmp edx, 9
ja 0x493498
test bl, bl
jne 0x493498
inc esi
add ax, dx
jae 0x4934e0
jmp 0x493498
cmp ebp, 5
jae 0x4934db
xor eax, eax
mov dword [esp], edx
movzx edx, byte [esi]
add edx, 0xffffffd0
cmp edx, 9
ja 0x493498
add eax, eax
inc esi
lea eax, [eax + eax*4]
add eax, edx
dec ebp
jne 0x493510
mov word [esp + 0x16], ax
mov eax, dword [0x9031e8]
cmp eax, 3
jne 0x4935c0
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x16]
cmp edi, 0x17f
mov dword [esp + 0x48], eax
ja 0x4935ca
lea ebp, [esp + 0x8c]
push edi
push dword [esp + 4]
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 6
mov byte [esp + edi + 0x8c], 0
ja 0x49358f
xor ecx, ecx
cmp byte [esp + ecx + 0x8c], 0
je 0x49365f
inc ecx
cmp dword [esp + 4], ecx
jne 0x493575
jmp 0x4936bc
lea eax, [esp + 0x8f]
and eax, 0xfffffffc
sub eax, ebp
je 0x4935b9
xor ecx, ecx
cmp byte [esp + ecx + 0x8c], 0
je 0x49365f
inc ecx
cmp eax, ecx
jne 0x49359f
mov ebx, edi
lea ecx, [edi - 7]
jmp 0x493635
mov ebx, edi
lea ecx, [edi - 7]
jmp 0x493606
call fcn.004f1820
jmp 0x49353d
mov edx, dword [esp]
lea eax, [esp + 0x48]
lea ecx, [esp + 0x2c]
push eax
push edi
call fcn.004f1870
add esp, 8
mov eax, dword [esp + 0x2c]
test al, 1
jne 0x4934a5
jmp 0x4936dc
mov eax, dword [esp + 0xc]
mov dword [esp + 0x9c], eax
ud2
mov dword [esp + 0x9c], edi
ud2
mov esi, dword [esp + eax + 0x90]
mov edx, dword [esp + eax + 0x8c]
mov edi, 0x1010100
sub edi, esi
or edi, esi
mov esi, 0x1010100
sub esi, edx
or esi, edx
and esi, edi
not esi
test esi, 0x80808080
jne 0x493639
add eax, 8
cmp eax, ecx
jbe 0x493606
sub dword [esp + 4], eax
mov esi, dword [esp + 0x18]
je 0x4936bc
mov edi, ebx
lea edx, [esp + eax + 0x8c]
xor ecx, ecx
cmp byte [edx + ecx], 0
je 0x49365d
inc ecx
cmp dword [esp + 4], ecx
jne 0x49364e
jmp 0x4936bc
add ecx, eax
cmp ecx, edi
jne 0x4936bc
xorps xmm0, xmm0
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x6c]
movups xmmword [esp + 0x6c], xmm0
movups xmmword [esp + 0x7c], xmm0
mov dword [esp + 0x74], 1
push eax
push ecx
push 0
push ebp
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x4939d1
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 0
mov eax, 1
test al, 1
jne 0x4934a5
jmp 0x4936dc
mov eax, dword [0x8c63e8]
mov ecx, dword [0x8c63ec]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov eax, 1
test al, 1
jne 0x4934a5
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
test ecx, ecx
je 0x49370a
movzx eax, word [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x18]
mov ebp, dword [ecx + 0x1c]
movzx edx, word [eax]
cmp edx, 0x17
je 0x49375c
cmp edx, 2
je 0x49371f
test ebp, ebp
mov ecx, ebp
jne 0x4936f1
push edi
call dword [sym.imp.ws2_32.dll_freeaddrinfo]
mov eax, 4
xor edi, edi
xor ecx, ecx
jmp 0x4939bc
cmp dword [ecx + 0x10], 0xf
mov dword [esp + 0x3c], edi
jbe 0x4939f6
mov ecx, dword [eax + 4]
movzx esi, word [eax + 2]
mov dword [esp], str.invalid_argument
mov dword [esp + 8], 0
mov ebx, ecx
movzx eax, cx
shr ecx, 0x10
rol si, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
shr ebx, 0x18
jmp 0x4937b3
cmp dword [ecx + 0x10], 0x1b
mov dword [esp + 0x3c], edi
jbe 0x4939f6
mov ecx, dword [eax + 4]
movzx edi, word [eax + 2]
movzx ebx, word [eax + 8]
mov edx, dword [eax + 0x14]
movzx esi, word [eax + 0xa]
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0xc], ebx
rol di, 8
shr ebx, 8
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
mov ax, 1
mov dword [esp], ecx
mov dword [esp + 8], eax
movzx eax, byte [0x90320d]
xor ecx, ecx
mov edx, 0x80
call fcn.0049d570
test eax, eax
je 0x4939f6
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
test dx, dx
mov word [eax], dx
mov edx, dword [esp + 0x24]
cmovne edi, ecx
cmove esi, ecx
movzx ecx, byte [esp + 0xc]
shl ebx, 0x18
shl ecx, 0x10
or ebx, ecx
mov ecx, dword [esp]
add ebx, dword [esp + 0x10]
mov dword [eax + 2], ebx
mov word [eax + 6], si
mov esi, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0x20]
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], edx
mov word [eax + 0x1c], di
mov edi, 1
mov dword [esp + 0x8c], 4
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 1
test ebp, ebp
je 0x4939a0
mov edx, ebp
mov ecx, dword [edx + 0x18]
mov ebp, dword [edx + 0x1c]
movzx esi, word [ecx]
cmp esi, 0x17
je 0x49389d
cmp esi, 2
je 0x49386a
test ebp, ebp
mov edx, ebp
jne 0x49384c
jmp 0x4939a0
cmp dword [edx + 0x10], 0xf
jbe 0x4939f6
mov edx, dword [ecx + 4]
movzx esi, word [ecx + 2]
mov dword [esp], str.invalid_argument
mov ebx, edx
movzx ecx, dx
shr edx, 0x10
rol si, 8
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
shr ebx, 0x18
xor ecx, ecx
jmp 0x4938f6
cmp dword [edx + 0x10], 0x1b
jbe 0x4939f6
mov esi, dword [ecx + 4]
movzx ebx, word [ecx + 0xa]
movzx edx, word [ecx + 2]
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x18]
mov dword [esp + 8], ebx
mov ebx, dword [ecx + 0xc]
rol dx, 8
mov dword [esp + 0x24], esi
movzx esi, word [ecx + 8]
mov dword [esp], ebx
mov ebx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x44], ebx
mov ebx, esi
mov dword [esp + 0x10], esi
mov esi, dword [esp + 8]
mov dword [esp + 0x20], ecx
mov cx, 1
shr ebx, 8
mov dword [esp + 0x28], ecx
test cx, cx
mov ecx, dword [esp + 4]
cmovne edx, ecx
cmove esi, ecx
cmp edi, dword [esp + 0x8c]
mov dword [esp + 8], edx
je 0x49397d
movzx ecx, byte [esp + 0x10]
shl ebx, 0x18
mov edx, edi
inc edi
shl edx, 5
shl ecx, 0x10
or ecx, ebx
mov ebx, dword [esp + 0x28]
add ecx, dword [esp + 0xc]
mov word [eax + edx], bx
mov dword [eax + edx + 2], ecx
mov ecx, dword [esp]
mov word [eax + edx + 6], si
mov dword [eax + edx + 8], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + edx + 0x10], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + edx + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + edx + 0x14], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + edx + 0x18], ecx
mov ecx, dword [esp + 8]
mov word [eax + edx + 0x1c], cx
mov dword [esp + 0x94], edi
test ebp, ebp
jne 0x49384a
jmp 0x4939a0
lea ecx, [esp + 0x8c]
mov edx, edi
push 0x20
push 4
push 1
call fcn.004f2050
add esp, 0xc
mov eax, dword [esp + 0x90]
jmp 0x493914
push dword [esp + 0x3c]
call dword [sym.imp.ws2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
mov esi, dword [esp + 0x18]
shl edi, 5
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
add edi, eax
mov dword [esi + 0xc], edi
jmp 0x4934b9
mov eax, dword [esp + 0x40]
movzx ecx, word [esp + 0x16]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], cx
xor eax, eax
test al, 1
jne 0x4934a5
jmp 0x4936dc
ud2