Function at 0x4024ab
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov eax, 0x467210
call fcn.0045bc2c
sub esp, 0x294
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push 0x3e8
call fcn.00450c49
xor ebx, ebx
mov dword [esi], 0x468480
mov dword [ebp - 4], ebx
call fcn.0045b832
cdq
mov ecx, 0x1f4
idiv ecx
push edx
call fcn.0045b6eb
push 0x20
mov dword [esi + 0x2f8], eax
pop edi
push edi
call fcn.0045b6eb
push edi
mov dword [esi + 0x318], eax
call fcn.0045b6eb
mov dword [esi + 0x31c], eax
call fcn.0045b832
cdq
mov ecx, 0x1f4
idiv ecx
push edx
call fcn.0045b6eb
push edi
mov dword [esi + 0x1d0], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1b4], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1b8], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1c4], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1c8], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1cc], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1d4], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1d8], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1dc], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1e0], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1bc], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1c0], eax
call fcn.0045b6eb
add esp, 0x40
mov dword [esi + 0x1e8], eax
push edi
call fcn.0045b6eb
push edi
mov dword [esi + 0x1ec], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1fc], eax
call fcn.0045b6eb
mov dword [esi + 0x1f0], eax
push edi
call fcn.0045b6eb
push edi
mov dword [esi + 0x200], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1f4], eax
call fcn.0045b6eb
push edi
mov dword [esi + 0x1f8], eax
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x134], eax
call fcn.004401eb
mov dword [esi + 0x310], ebx
mov dword [esi + 0x314], ebx
mov dword [esi + 0x300], ebx
mov dword [esi + 0x244], ebx
mov dword [esi + 0x218], ebx
push 0xffffffffffffffec
mov dword [esi + 0x304], ebx
push dword [esi + 0x200]
call fcn.004401eb
mov dword [esi + 0x214], ebx
mov dword [esi + 0x210], ebx
lea eax, [esi + 0x220]
mov dword [esi + 0x204], 1
push ebx
mov dword [esi + 0x2c4], ebx
push eax
mov dword [esi + 0x2c8], ebx
call fcn.004401eb
mov dword [esi + 0x240], ebx
mov dword [esi + 0x1e4], ebx
push edi
mov dword [esi + 0x208], 1
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x198], eax
call fcn.004401eb
add esp, 0x40
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x194], eax
call fcn.004401eb
push edi
mov dword [esi + 0x20c], ebx
call fcn.0045b6eb
push 1
push eax
mov dword [esi + 0x184], eax
call fcn.004401eb
mov eax, dword [0x4a620c]
push edi
mov eax, dword [eax + 0xc30]
mov dword [esi + 0x158], eax
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x15c], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x160], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x164], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
add esp, 0x40
mov dword [esi + 0x168], eax
push ebx
push eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x140], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x138], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x13c], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x144], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x14c], eax
call fcn.004401eb
add esp, 0x44
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x148], eax
call fcn.004401eb
push edi
mov dword [esi + 0x34c], ebx
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x16c], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x170], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x174], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x178], eax
call fcn.004401eb
push edi
mov dword [esi + 0x30c], ebx
mov dword [esi + 0x2d0], ebx
call fcn.0045b6eb
add esp, 0x40
mov dword [esi + 0x1a0], eax
push ebx
push eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x188], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x18c], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x190], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x17c], eax
call fcn.004401eb
push edi
call fcn.0045b6eb
push ebx
push eax
mov dword [esi + 0x180], eax
call fcn.004401eb
add esp, 0x44
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x21c], ebx
push edi
call fcn.0045b6eb
push 0xffffffffffffffff
push eax
mov dword [esi + 0x19c], eax
call fcn.004401eb
push 0xffffffffffffffff
push dword [esi + 0x1f8]
call fcn.004401eb
or dword [esi + 0x308], 0xffffffff
push edi
call fcn.0045b6eb
push edi
mov dword [esi + 0x150], eax
call fcn.0045b6eb
push ebx
mov dword [esi + 0x154], eax
push dword [esi + 0x150]
call fcn.004401eb
push ebx
push dword [esi + 0x154]
call fcn.004401eb
or dword [esi + 0x350], 0xffffffff
add esp, 0x2c
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1a8], ebx
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x354], ebx
cmp byte [0x47dc10], bl
je 0x4029dd
lea eax, [ebp - 0x2a0]
push eax
push 0x202
call dword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
jne 0x4029d7
mov al, byte [0x47dc14]
push 0x3f
mov byte [ebp - 0x110], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x110]
push 0xff
push eax
call dword [sym.imp.ws2_32.dll_gethostname]
test eax, eax
jne 0x402978
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.ws2_32.dll_gethostbyname]
cmp eax, ebx
je 0x402978
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.ws2_32.dll_inet_ntoa]
mov edi, eax
jmp 0x40297b
mov edi, dword [ebp + 8]
call dword [sym.imp.ws2_32.dll_WSACleanup]
push edi
mov byte [0x47dc10], bl
call fcn.0045b670
cmp eax, 0xc
pop ecx
jbe 0x4029ae
push str.211.201.134.
push edi
mov byte [edi + 0xc], bl
call fcn.0045b5e0
pop ecx
test eax, eax
pop ecx
jne 0x4029ae
mov byte [0x47dc10], 1
push edi
call fcn.0045b670
cmp eax, 9
pop ecx
jbe 0x4029dd
push str.211.44.7.
push edi
mov byte [edi + 9], bl
call fcn.0045b5e0
pop ecx
test eax, eax
pop ecx
jne 0x4029dd
mov byte [0x47dc10], 1
jmp 0x4029dd
mov byte [0x47dc10], bl
or dword [esi + 0x358], 0xffffffff
or dword [esi + 0x35c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x360], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4