Function at 0x48a0f0
Capabilities:
Encrypt data using speck
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov ebp, dword [esp + 0x220]
mov esi, ecx
mov ebx, edx
lea ecx, [esp + 0x4c]
push ebp
call fcn.00418aa0
add esp, 4
cmp word [esp + 0x4c], 2
jne 0x48a2b0
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], 0
mov dword [esp + 0x8c], 0x3a
mov byte [esp + 0xa4], 1
mov dword [esp + 0xa0], 0x3a
lea ecx, [ebx + 3]
lea eax, [ebx - 1]
mov edx, ebx
mov dword [esp + 0x18], esi
mov edi, dword [esp + 0x9c]
and ecx, 0xfffffffc
mov dword [esp], eax
sub ecx, ebx
mov ebx, ebp
mov dword [esp + 8], ecx
jmp 0x48a18a
cmp edi, ebp
mov ebx, edi
ja 0x48a344
mov esi, ebx
mov ebp, ebx
mov dword [esp + 4], ebx
sub esi, ecx
jb 0x48a1a7
and esi, 7
mov ebp, ebx
mov dword [esp + 4], ecx
sub ebp, esi
jb 0x48a47d
mov eax, dword [esp]
mov esi, ebx
mov dword [esp + 0x10], ebx
sub esi, ebp
add ebx, eax
nop word cs:[eax + eax]
nop
test esi, esi
je 0x48a1e0
dec esi
cmp byte [ebx], 0x3a
lea ebx, [ebx - 1]
jne 0x48a1c0
add esi, ebp
mov ebp, dword [esp + 0x220]
jmp 0x48a263
mov dword [esp + 0xc], edi
nop word cs:[eax + eax]
nop
cmp ebp, dword [esp + 4]
mov ebx, ebp
jbe 0x48a233
mov edi, dword [edx + ebx - 8]
mov ecx, dword [edx + ebx - 4]
mov eax, edx
lea ebp, [ebx - 8]
mov esi, edi
mov edx, ecx
xor esi, 0xc5c5c5c5
xor edx, 0xc5c5c5c5
add edx, 0x1010101
add esi, 0x1010101
or edx, ecx
or esi, edi
and esi, edx
mov edx, eax
not esi
test esi, 0x80808080
je 0x48a1f0
cmp ebx, dword [esp + 0x10]
ja 0x48a470
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x220]
mov ecx, dword [esp + 8]
mov edi, dword [esp]
nop
test ebx, ebx
je 0x48a30c
cmp byte [edi + ebx], 0x3a
lea esi, [ebx - 1]
mov ebx, esi
jne 0x48a250
mov edi, esi
cmp esi, ebp
jae 0x48a180
mov al, 0x3a
cmp byte [edx + edi], al
jne 0x48a180
lea eax, [edi + 1]
mov ecx, 0xf951ac
sub ebp, eax
mov dword [esp + 4], eax
je 0x48a318
lea esi, [edx + edi + 1]
cmp ebp, 1
jne 0x48a34d
movzx eax, byte [esi]
cmp eax, 0x2b
je 0x48a318
mov ebp, 1
cmp eax, 0x2d
je 0x48a318
jmp 0x48a38b
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x20
call fcn.00494530
test eax, eax
je 0x48a876
movsd xmm0, qword [esp + 0x64]
mov ecx, eax
add ecx, 0x20
movsd qword [eax + 0x18], xmm0
movsd xmm0, qword [esp + 0x5c]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [esp + 0x4c]
movsd xmm1, qword [esp + 0x54]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], ecx
jmp 0x48a339
mov dword [esp + 0x9c], eax
mov ecx, 0xf9518c
mov esi, dword [esp + 0x18]
mov byte [esp + 0x30], 2
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 0
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x9c], edi
jmp 0x48a313
cmp byte [esi], 0x2b
jne 0x48a386
inc esi
cmp ebp, 6
lea ebp, [ebp - 1]
jb 0x48a38b
xor eax, eax
mov dword [esp], edx
sub ebp, 1
jb 0x48a3aa
mov dx, 0xa
mul dx
movzx edx, byte [esi]
seto bl
add edx, 0xffffffd0
cmp edx, 9
ja 0x48a318
test bl, bl
jne 0x48a318
inc esi
add ax, dx
jae 0x48a360
jmp 0x48a318
cmp ebp, 5
jae 0x48a35b
xor eax, eax
mov dword [esp], edx
movzx edx, byte [esi]
add edx, 0xffffffd0
cmp edx, 9
ja 0x48a318
add eax, eax
inc esi
lea eax, [eax + eax*4]
add eax, edx
dec ebp
jne 0x48a390
mov word [esp + 0x16], ax
mov eax, dword [0xfd51e8]
cmp eax, 3
jne 0x48a440
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x16]
cmp edi, 0x17f
mov dword [esp + 0x48], eax
ja 0x48a44a
lea ebp, [esp + 0x8c]
push edi
push dword [esp + 4]
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 6
mov byte [esp + edi + 0x8c], 0
ja 0x48a40f
xor ecx, ecx
cmp byte [esp + ecx + 0x8c], 0
je 0x48a4df
inc ecx
cmp dword [esp + 4], ecx
jne 0x48a3f5
jmp 0x48a53c
lea eax, [esp + 0x8f]
and eax, 0xfffffffc
sub eax, ebp
je 0x48a439
xor ecx, ecx
cmp byte [esp + ecx + 0x8c], 0
je 0x48a4df
inc ecx
cmp eax, ecx
jne 0x48a41f
mov ebx, edi
lea ecx, [edi - 7]
jmp 0x48a4b5
mov ebx, edi
lea ecx, [edi - 7]
jmp 0x48a486
call fcn.004e99b0
jmp 0x48a3bd
mov edx, dword [esp]
lea eax, [esp + 0x48]
lea ecx, [esp + 0x2c]
push eax
push edi
call fcn.004e9a00
add esp, 8
mov eax, dword [esp + 0x2c]
test al, 1
jne 0x48a325
jmp 0x48a55c
mov eax, dword [esp + 0xc]
mov dword [esp + 0x9c], eax
ud2
mov dword [esp + 0x9c], edi
ud2
mov esi, dword [esp + eax + 0x90]
mov edx, dword [esp + eax + 0x8c]
mov edi, 0x1010100
sub edi, esi
or edi, esi
mov esi, 0x1010100
sub esi, edx
or esi, edx
and esi, edi
not esi
test esi, 0x80808080
jne 0x48a4b9
add eax, 8
cmp eax, ecx
jbe 0x48a486
sub dword [esp + 4], eax
mov esi, dword [esp + 0x18]
je 0x48a53c
mov edi, ebx
lea edx, [esp + eax + 0x8c]
xor ecx, ecx
cmp byte [edx + ecx], 0
je 0x48a4dd
inc ecx
cmp dword [esp + 4], ecx
jne 0x48a4ce
jmp 0x48a53c
add ecx, eax
cmp ecx, edi
jne 0x48a53c
xorps xmm0, xmm0
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x6c]
movups xmmword [esp + 0x6c], xmm0
movups xmmword [esp + 0x7c], xmm0
mov dword [esp + 0x74], 1
push eax
push ecx
push 0
push ebp
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x48a851
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 0
mov eax, 1
test al, 1
jne 0x48a325
jmp 0x48a55c
mov eax, dword [0xf949b8]
mov ecx, dword [0xf949bc]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov eax, 1
test al, 1
jne 0x48a325
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
test ecx, ecx
je 0x48a58a
movzx eax, word [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x18]
mov ebp, dword [ecx + 0x1c]
movzx edx, word [eax]
cmp edx, 0x17
je 0x48a5dc
cmp edx, 2
je 0x48a59f
test ebp, ebp
mov ecx, ebp
jne 0x48a571
push edi
call dword [sym.imp.ws2_32.dll_freeaddrinfo]
mov eax, 4
xor edi, edi
xor ecx, ecx
jmp 0x48a83c
cmp dword [ecx + 0x10], 0xf
mov dword [esp + 0x3c], edi
jbe 0x48a876
mov ecx, dword [eax + 4]
movzx esi, word [eax + 2]
mov dword [esp], 0xf95168
mov dword [esp + 8], 0
mov ebx, ecx
movzx eax, cx
shr ecx, 0x10
rol si, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
shr ebx, 0x18
jmp 0x48a633
cmp dword [ecx + 0x10], 0x1b
mov dword [esp + 0x3c], edi
jbe 0x48a876
mov ecx, dword [eax + 4]
movzx edi, word [eax + 2]
movzx ebx, word [eax + 8]
mov edx, dword [eax + 0x14]
movzx esi, word [eax + 0xa]
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0xc], ebx
rol di, 8
shr ebx, 8
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
mov ax, 1
mov dword [esp], ecx
mov dword [esp + 8], eax
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x80
call fcn.00494530
test eax, eax
je 0x48a876
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
test dx, dx
mov word [eax], dx
mov edx, dword [esp + 0x24]
cmovne edi, ecx
cmove esi, ecx
movzx ecx, byte [esp + 0xc]
shl ebx, 0x18
shl ecx, 0x10
or ebx, ecx
mov ecx, dword [esp]
add ebx, dword [esp + 0x10]
mov dword [eax + 2], ebx
mov word [eax + 6], si
mov esi, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0x20]
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], edx
mov word [eax + 0x1c], di
mov edi, 1
mov dword [esp + 0x8c], 4
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 1
test ebp, ebp
je 0x48a820
mov edx, ebp
mov ecx, dword [edx + 0x18]
mov ebp, dword [edx + 0x1c]
movzx esi, word [ecx]
cmp esi, 0x17
je 0x48a71d
cmp esi, 2
je 0x48a6ea
test ebp, ebp
mov edx, ebp
jne 0x48a6cc
jmp 0x48a820
cmp dword [edx + 0x10], 0xf
jbe 0x48a876
mov edx, dword [ecx + 4]
movzx esi, word [ecx + 2]
mov dword [esp], 0xf95168
mov ebx, edx
movzx ecx, dx
shr edx, 0x10
rol si, 8
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
shr ebx, 0x18
xor ecx, ecx
jmp 0x48a776
cmp dword [edx + 0x10], 0x1b
jbe 0x48a876
mov esi, dword [ecx + 4]
movzx ebx, word [ecx + 0xa]
movzx edx, word [ecx + 2]
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x18]
mov dword [esp + 8], ebx
mov ebx, dword [ecx + 0xc]
rol dx, 8
mov dword [esp + 0x24], esi
movzx esi, word [ecx + 8]
mov dword [esp], ebx
mov ebx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x44], ebx
mov ebx, esi
mov dword [esp + 0x10], esi
mov esi, dword [esp + 8]
mov dword [esp + 0x20], ecx
mov cx, 1
shr ebx, 8
mov dword [esp + 0x28], ecx
test cx, cx
mov ecx, dword [esp + 4]
cmovne edx, ecx
cmove esi, ecx
cmp edi, dword [esp + 0x8c]
mov dword [esp + 8], edx
je 0x48a7fd
movzx ecx, byte [esp + 0x10]
shl ebx, 0x18
mov edx, edi
inc edi
shl edx, 5
shl ecx, 0x10
or ecx, ebx
mov ebx, dword [esp + 0x28]
add ecx, dword [esp + 0xc]
mov word [eax + edx], bx
mov dword [eax + edx + 2], ecx
mov ecx, dword [esp]
mov word [eax + edx + 6], si
mov dword [eax + edx + 8], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + edx + 0x10], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + edx + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + edx + 0x14], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + edx + 0x18], ecx
mov ecx, dword [esp + 8]
mov word [eax + edx + 0x1c], cx
mov dword [esp + 0x94], edi
test ebp, ebp
jne 0x48a6ca
jmp 0x48a820
lea ecx, [esp + 0x8c]
mov edx, edi
push 0x20
push 4
push 1
call fcn.004ea1e0
add esp, 0xc
mov eax, dword [esp + 0x90]
jmp 0x48a794
push dword [esp + 0x3c]
call dword [sym.imp.ws2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
mov esi, dword [esp + 0x18]
shl edi, 5
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
add edi, eax
mov dword [esi + 0xc], edi
jmp 0x48a339
mov eax, dword [esp + 0x40]
movzx ecx, word [esp + 0x16]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], cx
xor eax, eax
test al, 1
jne 0x48a325
jmp 0x48a55c
ud2