Function at 0x4337a8
Capabilities:
Create thread
Reference 114dns dns server

Disassembly:
push 0x50
mov eax, 0x4686de
call fcn.0043587d
mov eax, dword [ebp + 0xc]
mov esi, ecx
cmp eax, 0xe3
jne 0x4337cf
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.http:__bbs.ithome.com_thread_579459_1_1.html
jmp 0x4337e3
cmp eax, 0xe2
jne 0x4337f3
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.http:__bbs.ithome.com_thread_579471_1_1.html
call fcn.004076dd
call fcn.0042a6ad
pop ecx
jmp 0x433ae8
cmp eax, 0xe1
je 0x433efc
cmp eax, 0xf1
jne 0x433982
push 0xef
call fcn.004169bd
test eax, eax
je 0x43387a
mov edx, dword [eax]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call dword [edx + 0x30]
mov edi, dword [eax]
and dword [ebp - 4], 0
test edi, edi
je 0x43383b
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x43383f
xor edi, edi
jmp 0x433857
lea ebx, [eax + eax]
mov eax, ebx
call fcn.00439560
mov eax, esp
push 3
push ebx
push edi
push eax
call fcn.00407cbb
mov edi, eax
push edi
call fcn.00435c90
pop ecx
push eax
lea ecx, [esi + 0x1148]
push edi
call fcn.00401f36
mov ecx, dword [ebp - 0x4c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00405c12
push 0xf0
mov ecx, esi
call fcn.004169bd
test eax, eax
je 0x4338f0
mov edx, dword [eax]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call dword [edx + 0x30]
mov ebx, dword [eax]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x4338b1
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4338b5
xor edi, edi
jmp 0x4338cd
lea edi, [eax + eax]
mov eax, edi
call fcn.00439560
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.00407cbb
mov edi, eax
push edi
call fcn.00435c90
pop ecx
push eax
lea ecx, [esi + 0x1164]
push edi
call fcn.00401f36
mov ecx, dword [ebp - 0x4c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00405c12
mov edi, 0x470934
push edi
call fcn.00435c90
pop ecx
push eax
push edi
push dword [esi + 0x1158]
lea ecx, [esi + 0x1148]
push 0
call fcn.00401676
test eax, eax
je 0x433efc
mov edi, 0x47092c
push edi
call fcn.00435c90
pop ecx
push eax
push edi
push dword [esi + 0x1174]
xor edi, edi
push edi
lea ecx, [esi + 0x1164]
call fcn.00401676
test eax, eax
je 0x433efc
mov ecx, esi
call fcn.004124d4
push 1
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.ck_W
call fcn.004076dd
mov ecx, esi
call fcn.004229bb
push edi
push edi
push esi
mov dword [esi + 0x11a4], edi
push 0x432886
push edi
push edi
jmp 0x433eef
cmp eax, 0xf2
jne 0x433a61
push 0xfb
call fcn.004169bd
mov ebx, eax
mov edi, str.114.114.114.114
test ebx, ebx
je 0x4339f7
mov eax, dword [ebx]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, ebx
call dword [eax + 0xc8]
push edi
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.004061cf
mov ecx, dword [ebp - 0x4c]
test eax, eax
setne byte [ebp - 0x4d]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00405c12
cmp byte [ebp - 0x4d], 0
je 0x4339f7
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push edi
call fcn.004076dd
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
push ebx
call fcn.0043207d
pop ecx
push 0xfc
mov ecx, esi
call fcn.004169bd
mov esi, eax
test esi, esi
je 0x433efc
mov eax, dword [esi]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, esi
call dword [eax + 0xc8]
push edi
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.004061cf
mov ecx, dword [ebp - 0x4c]
test eax, eax
setne bl
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00405c12
test bl, bl
je 0x433efc
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push edi
call fcn.004076dd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xcc]
jmp 0x433ae2
cmp eax, 0xfd
jne 0x433aee
push 0xfb
call fcn.004169bd
mov ebx, eax
mov edi, 0x46c860
test ebx, ebx
je 0x433aaa
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push edi
call fcn.004076dd
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
mov eax, dword [ebx]
push 0x49a753
mov ecx, ebx
call dword [eax + 0x48]
push ebx
call fcn.0043207d
pop ecx
push 0xfc
mov ecx, esi
call fcn.004169bd
mov esi, eax
test esi, esi
je 0x433efc
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push edi
call fcn.004076dd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xcc]
mov eax, dword [esi]
push 0x49a753
mov ecx, esi
call dword [eax + 0x48]
push esi
call fcn.0043207d
pop ecx
jmp 0x433efc
cmp eax, 0xfe
jne 0x433ce9
push 0xfb
call fcn.004169bd
push 0xfc
mov ecx, esi
mov edi, eax
call fcn.004169bd
lea ecx, [ebp - 0x58]
mov ebx, eax
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0xc8]
mov eax, dword [ebx]
lea ecx, [ebp - 0x54]
push ecx
mov ecx, ebx
mov dword [ebp - 4], 4
call dword [eax + 0xc8]
mov edi, 0x46c860
push edi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.004061cf
test eax, eax
je 0x433b87
push 0x46c7fc
lea ecx, [ebp - 0x58]
call fcn.004061cf
test eax, eax
je 0x433cce
mov eax, dword [ebp - 0x58]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x5c], esp
mov ebx, esp
push eax
call fcn.00405e04
add eax, 0x10
pop ecx
mov dword [ebx], eax
call fcn.00408cab
pop ecx
test eax, eax
je 0x433cce
lea eax, [ebp - 0x54]
push 0x46bb7c
push eax
call fcn.00421d34
pop ecx
pop ecx
test al, al
jne 0x433be3
push edi
lea ecx, [ebp - 0x54]
call fcn.004061cf
test eax, eax
je 0x433be3
push 0x46c7fc
lea ecx, [ebp - 0x54]
call fcn.004061cf
test eax, eax
je 0x433cce
mov eax, dword [ebp - 0x54]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x5c], esp
mov edi, esp
push eax
call fcn.00405e04
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.00408cab
pop ecx
test eax, eax
je 0x433cce
mov eax, dword [ebp - 0x58]
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x433bfe
push eax
call ebx
inc eax
cmp eax, 0x3fffffff
jle 0x433c02
xor edi, edi
jmp 0x433c1c
lea edi, [eax + eax]
mov eax, edi
call fcn.00439560
mov eax, esp
push 3
push edi
push dword [ebp - 0x4c]
push eax
call fcn.00407cbb
mov edi, eax
push edi
call fcn.00435c90
pop ecx
push eax
push edi
lea ecx, [esi + 0x110c]
call fcn.00401f36
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x433c45
push eax
call ebx
inc eax
cmp eax, 0x3fffffff
jle 0x433c49
xor edi, edi
jmp 0x433c63
lea edi, [eax + eax]
mov eax, edi
call fcn.00439560
mov eax, esp
push 3
push edi
push dword [ebp - 0x4c]
push eax
call fcn.00407cbb
mov edi, eax
push edi
call fcn.00435c90
pop ecx
push eax
push edi
lea ecx, [esi + 0x1128]
call fcn.00401f36
mov ecx, esi
call fcn.004124d4
push 1
xor edi, edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push edi
push 3
push 0x420
push dword [0x485eac]
call dword [sym.imp.USER32.dll_PostMessageW]
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.ck_W
call fcn.004076dd
mov ecx, esi
call fcn.004229bb
push edi
push edi
push esi
push 0x43186c
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.00405c12
jmp 0x433efc
cmp eax, 0xee
jne 0x433e9e
push 0xf
pop eax
xor edi, edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edi
mov byte [ebp - 0x48], 0
mov dword [ebp - 4], 6
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
push 0xf3
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004169bd
cmp eax, edi
je 0x433d8a
mov edx, dword [eax]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call dword [edx + 0x30]
mov ebx, dword [eax]
mov byte [ebp - 4], 8
cmp ebx, edi
je 0x433d4c
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x433d50
xor ebx, ebx
jmp 0x433d6a
lea edi, [eax + eax]
mov eax, edi
call fcn.00439560
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.00407cbb
mov ebx, eax
xor edi, edi
push ebx
call fcn.00435c90
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x48]
call fcn.00401f36
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00405c12
push 0xf4
mov ecx, esi
call fcn.004169bd
cmp eax, edi
je 0x433dfc
mov edx, dword [eax]
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, eax
call dword [edx + 0x30]
mov ebx, dword [eax]
mov byte [ebp - 4], 9
test ebx, ebx
je 0x433dbe
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x433dc2
xor edi, edi
jmp 0x433dda
lea edi, [eax + eax]
mov eax, edi
call fcn.00439560
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.00407cbb
mov edi, eax
push edi
call fcn.00435c90
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401f36
mov ecx, dword [ebp - 0x5c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.00405c12
xor edi, edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x433e08
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x38]
push edi
call fcn.00401676
push 0xf6
mov ecx, esi
test eax, eax
jne 0x433e74
call fcn.004169bd
cmp eax, edi
je 0x433e35
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0x14]
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [esi + 0x1180]
call fcn.00401e9d
push edi
push 3
push 0x420
push dword [0x485eac]
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
push edi
push esi
push 0x431a5f
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x433e86
call fcn.004169bd
cmp eax, edi
je 0x433e86
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0x14]
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401713
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00401713
jmp 0x433efc
cmp eax, 0xed
jne 0x433edc
call fcn.004124d4
push 1
xor edi, edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x4708ec
call fcn.004076dd
mov ecx, esi
call fcn.004229bb
push edi
push edi
push esi
push 0x432a94
jmp 0x43397b
cmp eax, 0xff
jne 0x433efc
xor eax, eax
push eax
push eax
push esi
push 0x431c4e
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
lea esp, [ebp - 0x6c]
call fcn.00435900
ret 0x10