Function at 0x481600
Capabilities:
Encrypt data using speck
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov ebp, dword [esp + 0x220]
mov esi, ecx
mov ebx, edx
lea ecx, [esp + 0x4c]
push ebp
call fcn.00410680
add esp, 4
cmp word [esp + 0x4c], 2
jne 0x4817c0
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], 0
mov dword [esp + 0x8c], 0x3a
mov byte [esp + 0xa4], 1
mov dword [esp + 0xa0], 0x3a
lea ecx, [ebx + 3]
lea eax, [ebx - 1]
mov edx, ebx
mov dword [esp + 0x18], esi
mov edi, dword [esp + 0x9c]
and ecx, 0xfffffffc
mov dword [esp], eax
sub ecx, ebx
mov ebx, ebp
mov dword [esp + 8], ecx
jmp 0x48169a
cmp edi, ebp
mov ebx, edi
ja 0x481854
mov esi, ebx
mov ebp, ebx
mov dword [esp + 4], ebx
sub esi, ecx
jb 0x4816b7
and esi, 7
mov ebp, ebx
mov dword [esp + 4], ecx
sub ebp, esi
jb 0x48198d
mov eax, dword [esp]
mov esi, ebx
mov dword [esp + 0x10], ebx
sub esi, ebp
add ebx, eax
nop word cs:[eax + eax]
nop
test esi, esi
je 0x4816f0
dec esi
cmp byte [ebx], 0x3a
lea ebx, [ebx - 1]
jne 0x4816d0
add esi, ebp
mov ebp, dword [esp + 0x220]
jmp 0x481773
mov dword [esp + 0xc], edi
nop word cs:[eax + eax]
nop
cmp ebp, dword [esp + 4]
mov ebx, ebp
jbe 0x481743
mov edi, dword [edx + ebx - 8]
mov ecx, dword [edx + ebx - 4]
mov eax, edx
lea ebp, [ebx - 8]
mov esi, edi
mov edx, ecx
xor esi, 0xc5c5c5c5
xor edx, 0xc5c5c5c5
add edx, 0x1010101
add esi, 0x1010101
or edx, ecx
or esi, edi
and esi, edx
mov edx, eax
not esi
test esi, 0x80808080
je 0x481700
cmp ebx, dword [esp + 0x10]
ja 0x481980
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x220]
mov ecx, dword [esp + 8]
mov edi, dword [esp]
nop
test ebx, ebx
je 0x48181c
cmp byte [edi + ebx], 0x3a
lea esi, [ebx - 1]
mov ebx, esi
jne 0x481760
mov edi, esi
cmp esi, ebp
jae 0x481690
mov al, 0x3a
cmp byte [edx + edi], al
jne 0x481690
lea eax, [edi + 1]
mov ecx, 0x5e3c7c
sub ebp, eax
mov dword [esp + 4], eax
je 0x481828
lea esi, [edx + edi + 1]
cmp ebp, 1
jne 0x48185d
movzx eax, byte [esi]
cmp eax, 0x2b
je 0x481828
mov ebp, 1
cmp eax, 0x2d
je 0x481828
jmp 0x48189b
movzx eax, byte [0x62314d]
xor ecx, ecx
mov edx, 0x20
call fcn.0048bb80
test eax, eax
je 0x481d86
movsd xmm0, qword [esp + 0x64]
mov ecx, eax
add ecx, 0x20
movsd qword [eax + 0x18], xmm0
movsd xmm0, qword [esp + 0x5c]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [esp + 0x4c]
movsd xmm1, qword [esp + 0x54]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], ecx
jmp 0x481849
mov dword [esp + 0x9c], eax
mov ecx, 0x5e3c5c
mov esi, dword [esp + 0x18]
mov byte [esp + 0x30], 2
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 0
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x9c], edi
jmp 0x481823
cmp byte [esi], 0x2b
jne 0x481896
inc esi
cmp ebp, 6
lea ebp, [ebp - 1]
jb 0x48189b
xor eax, eax
mov dword [esp], edx
sub ebp, 1
jb 0x4818ba
mov dx, 0xa
mul dx
movzx edx, byte [esi]
seto bl
add edx, 0xffffffd0
cmp edx, 9
ja 0x481828
test bl, bl
jne 0x481828
inc esi
add ax, dx
jae 0x481870
jmp 0x481828
cmp ebp, 5
jae 0x48186b
xor eax, eax
mov dword [esp], edx
movzx edx, byte [esi]
add edx, 0xffffffd0
cmp edx, 9
ja 0x481828
add eax, eax
inc esi
lea eax, [eax + eax*4]
add eax, edx
dec ebp
jne 0x4818a0
mov word [esp + 0x16], ax
mov eax, dword [0x623128]
cmp eax, 3
jne 0x481950
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x16]
cmp edi, 0x17f
mov dword [esp + 0x48], eax
ja 0x48195a
lea ebp, [esp + 0x8c]
push edi
push dword [esp + 4]
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 6
mov byte [esp + edi + 0x8c], 0
ja 0x48191f
xor ecx, ecx
cmp byte [esp + ecx + 0x8c], 0
je 0x4819ef
inc ecx
cmp dword [esp + 4], ecx
jne 0x481905
jmp 0x481a4c
lea eax, [esp + 0x8f]
and eax, 0xfffffffc
sub eax, ebp
je 0x481949
xor ecx, ecx
cmp byte [esp + ecx + 0x8c], 0
je 0x4819ef
inc ecx
cmp eax, ecx
jne 0x48192f
mov ebx, edi
lea ecx, [edi - 7]
jmp 0x4819c5
mov ebx, edi
lea ecx, [edi - 7]
jmp 0x481996
call fcn.004df1b0
jmp 0x4818cd
mov edx, dword [esp]
lea eax, [esp + 0x48]
lea ecx, [esp + 0x2c]
push eax
push edi
call fcn.004df200
add esp, 8
mov eax, dword [esp + 0x2c]
test al, 1
jne 0x481835
jmp 0x481a6c
mov eax, dword [esp + 0xc]
mov dword [esp + 0x9c], eax
ud2
mov dword [esp + 0x9c], edi
ud2
mov esi, dword [esp + eax + 0x90]
mov edx, dword [esp + eax + 0x8c]
mov edi, 0x1010100
sub edi, esi
or edi, esi
mov esi, 0x1010100
sub esi, edx
or esi, edx
and esi, edi
not esi
test esi, 0x80808080
jne 0x4819c9
add eax, 8
cmp eax, ecx
jbe 0x481996
sub dword [esp + 4], eax
mov esi, dword [esp + 0x18]
je 0x481a4c
mov edi, ebx
lea edx, [esp + eax + 0x8c]
xor ecx, ecx
cmp byte [edx + ecx], 0
je 0x4819ed
inc ecx
cmp dword [esp + 4], ecx
jne 0x4819de
jmp 0x481a4c
add ecx, eax
cmp ecx, edi
jne 0x481a4c
xorps xmm0, xmm0
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x6c]
movups xmmword [esp + 0x6c], xmm0
movups xmmword [esp + 0x7c], xmm0
mov dword [esp + 0x74], 1
push eax
push ecx
push 0
push ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x481d61
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 0
mov eax, 1
test al, 1
jne 0x481835
jmp 0x481a6c
mov eax, dword [0x5e3488]
mov ecx, dword [0x5e348c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov eax, 1
test al, 1
jne 0x481835
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
test ecx, ecx
je 0x481a9a
movzx eax, word [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x18]
mov ebp, dword [ecx + 0x1c]
movzx edx, word [eax]
cmp edx, 0x17
je 0x481aec
cmp edx, 2
je 0x481aaf
test ebp, ebp
mov ecx, ebp
jne 0x481a81
push edi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 4
xor edi, edi
xor ecx, ecx
jmp 0x481d4c
cmp dword [ecx + 0x10], 0xf
mov dword [esp + 0x3c], edi
jbe 0x481d86
mov ecx, dword [eax + 4]
movzx esi, word [eax + 2]
mov dword [esp], str.invalid_argument__
mov dword [esp + 8], 0
mov ebx, ecx
movzx eax, cx
shr ecx, 0x10
rol si, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
shr ebx, 0x18
jmp 0x481b43
cmp dword [ecx + 0x10], 0x1b
mov dword [esp + 0x3c], edi
jbe 0x481d86
mov ecx, dword [eax + 4]
movzx edi, word [eax + 2]
movzx ebx, word [eax + 8]
mov edx, dword [eax + 0x14]
movzx esi, word [eax + 0xa]
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0xc], ebx
rol di, 8
shr ebx, 8
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
mov ax, 1
mov dword [esp], ecx
mov dword [esp + 8], eax
movzx eax, byte [0x62314d]
xor ecx, ecx
mov edx, 0x80
call fcn.0048bb80
test eax, eax
je 0x481d86
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
test dx, dx
mov word [eax], dx
mov edx, dword [esp + 0x24]
cmovne edi, ecx
cmove esi, ecx
movzx ecx, byte [esp + 0xc]
shl ebx, 0x18
shl ecx, 0x10
or ebx, ecx
mov ecx, dword [esp]
add ebx, dword [esp + 0x10]
mov dword [eax + 2], ebx
mov word [eax + 6], si
mov esi, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0x20]
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], edx
mov word [eax + 0x1c], di
mov edi, 1
mov dword [esp + 0x8c], 4
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 1
test ebp, ebp
je 0x481d30
mov edx, ebp
mov ecx, dword [edx + 0x18]
mov ebp, dword [edx + 0x1c]
movzx esi, word [ecx]
cmp esi, 0x17
je 0x481c2d
cmp esi, 2
je 0x481bfa
test ebp, ebp
mov edx, ebp
jne 0x481bdc
jmp 0x481d30
cmp dword [edx + 0x10], 0xf
jbe 0x481d86
mov edx, dword [ecx + 4]
movzx esi, word [ecx + 2]
mov dword [esp], str.invalid_argument__
mov ebx, edx
movzx ecx, dx
shr edx, 0x10
rol si, 8
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
shr ebx, 0x18
xor ecx, ecx
jmp 0x481c86
cmp dword [edx + 0x10], 0x1b
jbe 0x481d86
mov esi, dword [ecx + 4]
movzx ebx, word [ecx + 0xa]
movzx edx, word [ecx + 2]
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x18]
mov dword [esp + 8], ebx
mov ebx, dword [ecx + 0xc]
rol dx, 8
mov dword [esp + 0x24], esi
movzx esi, word [ecx + 8]
mov dword [esp], ebx
mov ebx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x44], ebx
mov ebx, esi
mov dword [esp + 0x10], esi
mov esi, dword [esp + 8]
mov dword [esp + 0x20], ecx
mov cx, 1
shr ebx, 8
mov dword [esp + 0x28], ecx
test cx, cx
mov ecx, dword [esp + 4]
cmovne edx, ecx
cmove esi, ecx
cmp edi, dword [esp + 0x8c]
mov dword [esp + 8], edx
je 0x481d0d
movzx ecx, byte [esp + 0x10]
shl ebx, 0x18
mov edx, edi
inc edi
shl edx, 5
shl ecx, 0x10
or ecx, ebx
mov ebx, dword [esp + 0x28]
add ecx, dword [esp + 0xc]
mov word [eax + edx], bx
mov dword [eax + edx + 2], ecx
mov ecx, dword [esp]
mov word [eax + edx + 6], si
mov dword [eax + edx + 8], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + edx + 0x10], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + edx + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + edx + 0x14], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + edx + 0x18], ecx
mov ecx, dword [esp + 8]
mov word [eax + edx + 0x1c], cx
mov dword [esp + 0x94], edi
test ebp, ebp
jne 0x481bda
jmp 0x481d30
lea ecx, [esp + 0x8c]
mov edx, edi
push 0x20
push 4
push 1
call fcn.004df9e0
add esp, 0xc
mov eax, dword [esp + 0x90]
jmp 0x481ca4
push dword [esp + 0x3c]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
mov esi, dword [esp + 0x18]
shl edi, 5
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
add edi, eax
mov dword [esi + 0xc], edi
jmp 0x481849
mov eax, dword [esp + 0x40]
movzx ecx, word [esp + 0x16]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], cx
xor eax, eax
test al, 1
jne 0x481835
jmp 0x481a6c
ud2