how do I take out ur address?
hexedit?
No - my initial analysis indicates the user address is used most of the time, with a switch to something else which has yet to be determined. It's a string (seemingly) that is sourced from the stack - not embedded in the binary, but probably made at runtime in some way. Currently doing just static analysis.