AES Counter Derivation from 0xA101: HMAC-SHA256 to ctx+0xF4

// ─────────────────────────────────────────────────────────────────────────────
// Phase A — PRNG fill + HMAC-SHA256  (common to both recv and send paths)
// ─────────────────────────────────────────────────────────────────────────────

uint8_t prng[128];   // stack esp+0x58 in 0x401100 frame
// CONFIRMED: Crypto_PRNGFill @ 0x00404610
// Uses a time-seeded LCPRNG (seed DAT_02303A8C); fills 128 bytes.
Crypto_PRNGFill(prng);

uint8_t digest[32];  // stack esp+0x38..0x57 (post-arg-pop alignment)
{
    // Pre-key: SHA256 of the 128-byte PRNG output
    // CONFIRMED @ 0x404434: data ptr [esp+0x11c], len 0x80
    uint8_t key0[32];
    SHA256(prng, 128, key0);   // SHA256 @ 0x404434–0x404496

    // HMAC-SHA256(key=key0, msg=block_b[0..field_2])
    // CONFIRMED @ 0x404569: [esp+0x134] with N=5 outstanding pushes = field_2
    HMAC_SHA256(
        key  = key0,           // 32 bytes
        msg  = block_b,        // wire body +0x43
        len  = (size_t)(uint8_t)field_2,   // CONFIRMED @ 0x404569
        out  = digest          // 32 bytes; EBX = stack+0x38 @ 0x404575–0x404579
    );
    // ipad: key XOR 0x36 on 64-byte block — CONFIRMED @ 0x4044F0–0x404504
    // opad: key XOR 0x5C on 64-byte block — CONFIRMED @ 0x40457E–0x4045E8
    // SHA-256 IV constants at 0x404456–0x40448E, 0x40451F–0x404557, 0x404593–0x4045CB
}

// ─────────────────────────────────────────────────────────────────────────────
// Phase B — Recv CounterLoad (field_0 == 0)
// Branch confirmed @ 0x40116C
// ─────────────────────────────────────────────────────────────────────────────

uint8_t counter_src[16];
memcpy(counter_src, digest + 0,  16);  // digest[0..15]
// lea ecx,[esp+0x38] @ 0x401179 (post-HMAC esp); no PRNG XOR applied

// Load counter into main recv ctx  (0x023037F0, counter VA = 0x023038E4)
Crypto_CounterLoad(counter_src, ctx_0x023037F0);   // eax=0x023037F0 @ 0x401174

// Load counter into secondary recv ctx  (0x02303940, counter VA = 0x02303A34)
Crypto_CounterLoad(counter_src, ctx_0x02303940);   // eax=0x02303940 @ 0x401182

// ─────────────────────────────────────────────────────────────────────────────
// key_seed — digest[16..31] distributed to globals @ 0x401190–0x4011EB
// CONFIRMED: stack esp+0x48..0x57 copied to 0x023027C0..0x023027CC + mirrors
// ─────────────────────────────────────────────────────────────────────────────

uint8_t key_seed[16];
memcpy(key_seed, digest + 16, 16);  // digest[16..31]
// Distributed to:
//   DAT_023027C0, DAT_023027C4, DAT_023027C8, DAT_023027CC  (key seed buffer)
//   and counter shadow copies @ 0x401190–0x4011EB

// Crypto_CounterLoad @ 0x00404680
// Calling convention: __fastcall  (ECX = src uint32[4], EAX = dst ctx*)
// CONFIRMED @ 0x404693: ctx+0xF0 = 10  (AES-128 round count)
uint32_t __fastcall Crypto_CounterLoad(uint32_t *src, CryptoCtx *ctx) {
    if (src == NULL || ctx == NULL) return 0xFFFFFFFF;

    ctx->rounds = 10;  // ctx+0xF0 — AES-128

    // Custom dword permute (confirmed @ 0x40468D–0x40470C):
    // Each 32-bit word has its bytes rotated so that:
    //   byte[3] → byte[0], byte[2] → byte[1], byte[1] → byte[2], byte[0] → byte[3]
    // Equivalent to: t = rotr(x,8) & 0xFF00FF00 | rotl(x,8) & 0x00FF00FF
    for (int i = 0; i < 4; i++) {
        uint32_t x = src[i];
        uint32_t t = (x >> 8 & 0xFF00FF00u) | (x << 24)
                   | ((x & 0xFF00u) << 8)   | (x >> 24);
        ctx->counter_u32[i] = t;  // → ctx+0xF4
    }

    // AES-128 key expansion into ctx+0x100..
    // T-tables at 0x00790760; round constants at 0x00791F64
    AES_KeyExpand_inplace(ctx);  // writes round_keys[] into ctx
    return 0;
}

// Crypto_KeyMaterialAppend @ 0x00404F90
// Uses std::vector-like blob
void Crypto_KeyMaterialAppend(uint8_t *block_b, uint8_t field_1,
                               uint8_t *block_a, uint8_t field_2,
                               uint8_t *prng,   uint8_t *out_vec) {
    // CONFIRMED @ 0x404F96: memcpy(block_b, field_1 bytes)
    memcpy(out_vec, block_b, field_1);
    // CONFIRMED @ 0x404FEA: memcpy(block_a, field_2 bytes)
    memcpy(out_vec + field_1, block_a, field_2);
}
// Crypto_OutputPack @ 0x00405050 packs the vector + prng[128] → 128-byte client output
// NetworkSendKeyFollowUp @ 0x005EC5A0 sends opcode 0x00A101 / 131 bytes