Function at 0x10015fa
Capabilities:
Initialize winsock library
Resolve dns
Send icmp echo request
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5b4
mov eax, dword [0x10030a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
mov dword [ebp - 0x59c], esi
mov dword [ebp - 0x5ac], edi
mov dword [ebp - 0x5a4], 0x1e
mov byte [ebp - 0x5a0], 1
mov byte [ebp - 0x585], 0
mov dword [ebp - 0x5a8], 0xfa0
mov byte [ebp - 0x595], 0
mov dword [ebp - 0x58c], edi
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x1004460
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, edi
je 0x100168c
push eax
push 0x2732
push 1
call fcn.010025d9
xor eax, eax
add esp, 0xc
inc eax
jmp 0x1001ea6
push ebx
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x584]
push edi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x504]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
cmp dword [ebp + 8], 2
lea eax, [ebp - 0x70]
mov dword [ebp - 0x5b4], ebx
mov byte [ebp - 0x594], 1
mov byte [ebp - 0x593], 0
mov byte [ebp - 0x592], 0
mov byte [ebp - 0x591], 0
mov dword [ebp - 0x590], eax
jge 0x10016ee
push dword [esi]
push 0x2713
jmp 0x1001a95
xor edi, edi
inc edi
cmp dword [ebp + 8], edi
jle 0x100195d
mov eax, dword [esi + edi*4]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x100175a
cmp cl, 0x2f
je 0x100175a
push dword [ebp - 0x5a0]
lea ecx, [ebp - 0x474]
push 0x401
push ecx
lea ecx, [ebp - 0x5b4]
push ecx
lea ecx, [ebp - 0x504]
push ecx
push eax
push dword [ebp - 0x58c]
mov byte [ebp - 0x595], 1
call fcn.0100150e
test al, al
je 0x100197d
lea eax, [edi + 1]
cmp eax, dword [ebp + 8]
jge 0x100194a
push 0x2713
jmp 0x10019bd
movsx ecx, byte [eax + 1]
cmp ecx, 0x53
jg 0x1001816
je 0x10017c8
sub ecx, 0x34
je 0x10017c3
dec ecx
dec ecx
je 0x10017a7
sub ecx, 9
je 0x10016e2
sub ecx, 0x13
jne 0x1001997
push eax
push 0x17
lea eax, [ebp - 0x58c]
push eax
call fcn.0100145e
test al, al
je 0x1001a9f
or byte [ebp - 0x592], 1
jmp 0x100194a
push eax
push 0x17
lea eax, [ebp - 0x58c]
push eax
call fcn.0100145e
test al, al
je 0x1001a9f
jmp 0x100194a
push eax
push 2
jmp 0x10017aa
push eax
push 0x17
lea eax, [ebp - 0x58c]
push eax
call fcn.0100145e
test al, al
je 0x1001a9f
mov eax, dword [ebp + 8]
dec eax
cmp edi, eax
je 0x100198a
lea eax, [ebp - 0x584]
push eax
inc edi
push dword [esi + edi*4]
push dword [ebp - 0x58c]
call fcn.01001402
test eax, eax
jne 0x100194a
push dword [esi + edi*4]
push 0x273f
jmp 0x1001a95
sub ecx, 0x64
je 0x1001943
sub ecx, 4
je 0x1001933
dec ecx
dec ecx
je 0x1001858
sub ecx, 0xd
jne 0x1001997
push 0xffffffffffffffff
lea eax, [ebp - 0x5a8]
push 1
push edi
push dword [ebp + 8]
push esi
push eax
call fcn.0100137a
test al, al
je 0x1001a9f
inc edi
jmp 0x100194a
push eax
push 2
lea eax, [ebp - 0x58c]
push eax
call fcn.0100145e
test al, al
je 0x1001a9f
mov al, byte [ebp - 0x591]
mov byte [ebp - 0x585], al
movzx eax, al
lea ecx, [eax + 7]
cmp ecx, 0x28
jg 0x10019b8
mov ebx, dword [ebp - 0x590]
lea esi, [eax + ebx]
mov byte [eax + ebx], 0x83
mov byte [esi + 1], 3
mov byte [esi + 2], 4
add byte [ebp - 0x591], 3
jmp 0x10018ff
mov eax, dword [ebp - 0x59c]
mov eax, dword [eax + edi*4 + 4]
cmp byte [eax], 0x2d
je 0x1001909
movzx eax, byte [ebp - 0x591]
add eax, 4
cmp eax, 0x28
jg 0x10019b8
mov eax, dword [ebp - 0x59c]
inc edi
mov eax, dword [eax + edi*4]
push eax
mov dword [ebp - 0x5b0], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x10019cb
movzx ecx, byte [ebp - 0x591]
mov dword [ecx + ebx], eax
add byte [esi + 1], 4
add byte [ebp - 0x591], 4
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp edi, eax
jl 0x10018a8
mov al, byte [esi + 1]
mov cl, al
add cl, byte [ebp - 0x585]
add al, 4
mov byte [esi + 1], al
add byte [ebp - 0x591], 4
mov esi, dword [ebp - 0x59c]
mov byte [ebp - 0x585], cl
mov ebx, 0x80
jmp 0x100194a
push 0xff
lea eax, [ebp - 0x5a4]
jmp 0x100183d
mov byte [ebp - 0x5a0], 0
inc edi
cmp edi, dword [ebp + 8]
jl 0x10016fa
cmp byte [ebp - 0x595], 0
jne 0x10019db
push 0x2739
push 1
call fcn.010025d9
push 0x2713
push 1
call fcn.010025d9
add esp, 0x10
jmp 0x1001a9f
push dword [esi + edi*4]
push 0x2714
jmp 0x1001a95
push dword [esi + edi*4]
push 0x2734
jmp 0x1001a95
push eax
push 0x2738
push 1
call fcn.010025d9
push 0x2713
push 1
call fcn.010025d9
add esp, 0x14
jmp 0x1001a9f
push 0x2737
push 1
call fcn.010025d9
pop ecx
pop ecx
jmp 0x1001a9f
push dword [ebp - 0x5b0]
push 0x2736
jmp 0x1001a95
movzx eax, word [ebp - 0x504]
mov dword [ebp - 0x5b0], eax
cmp eax, 2
jne 0x1001a13
cmp byte [ebp - 0x585], 0
je 0x1001a0c
movzx eax, byte [ebp - 0x585]
mov ecx, dword [ebp - 0x500]
mov edx, dword [ebp - 0x590]
mov dword [eax + edx], ecx
call sub.icmp.dll_IcmpCreateFile
jmp 0x1001a7e
cmp word [ebp - 0x584], 0
jne 0x1001a79
xor edi, edi
push edi
push edi
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001a4d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x2741
push 1
call fcn.010025d9
add esp, 0xc
push 1
call dword [sym.imp.msvcrt.dll_exit]
push edi
push edi
lea eax, [ebp - 0x59c]
push eax
push ebx
lea eax, [ebp - 0x584]
push eax
push ebx
lea eax, [ebp - 0x504]
push eax
push 0xc8000014
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call sub.IPHLPAPI.DLL_Icmp6CreateFile
mov dword [ebp - 0x59c], eax
cmp eax, 0xffffffff
jne 0x1001aad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2715
push 1
call fcn.010025d9
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
inc eax
jmp 0x1001ea5
push 2
push 0
push 0
push 0x41
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x5b4]
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
cmp byte [ebp - 0x474], 0
push dword [ebp - 0x5a4]
lea eax, [ebp - 0x48]
push eax
je 0x1001af7
lea eax, [ebp - 0x474]
push eax
push 0x2716
push 1
call fcn.010025d9
add esp, 0x14
jmp 0x1001b06
push 0x2733
push 1
call fcn.010025d9
add esp, 0x10
movzx eax, byte [ebp - 0x594]
cmp eax, dword [ebp - 0x5a4]
ja 0x1001e84
mov edi, 0x1004600
mov ebx, 0x273c
cmp byte [ebp - 0x594], 0
je 0x1001e84
push eax
push 0x2717
push 1
call fcn.010025d9
add esp, 0xc
and dword [ebp - 0x58c], 0
mov byte [ebp - 0x585], 0
cmp dword [ebp - 0x5b0], 2
push dword [ebp - 0x5a8]
lea eax, [ebp - 0x594]
push 0x84
push edi
push eax
push 0x40
push 0x1004420
jne 0x1001c69
push dword [ebp - 0x500]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x59c]
call sub.icmp.dll_IcmpSendEcho2
test eax, eax
jne 0x1001be3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
cmp esi, 0x2b02
jne 0x1001dc6
push 0x273b
push 1
call fcn.010025d9
cmp dword [ebp - 0x58c], 2
pop ecx
pop ecx
jne 0x1001d25
cmp byte [ebp - 0x585], 0
je 0x1001cdf
push dword [ebp - 0x5a0]
push dword [ebp - 0x5ac]
call fcn.010012a7
jmp 0x1001cd3
mov esi, dword [0x1004604]
mov eax, edi
test esi, esi
jne 0x1001c17
push dword [0x1004608]
call fcn.01001344
cmp dword [ebp - 0x58c], 2
je 0x1001daf
mov eax, dword [0x1004600]
mov dword [ebp - 0x5ac], eax
jmp 0x1001d1e
cmp esi, 0x2b05
jne 0x1001dc6
push dword [0x1004608]
call fcn.01001344
cmp dword [ebp - 0x58c], 2
jne 0x1001c07
push dword [ebp - 0x5a0]
push dword [0x1004600]
call fcn.010012a7
push ebx
push 1
call fcn.010025d9
mov eax, dword [0x1004608]
pop ecx
pop ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x1001d25
jmp 0x1001da1
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x584]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x59c]
call sub.IPHLPAPI.DLL_Icmp6SendEcho2
test eax, eax
jne 0x1001ce6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
cmp esi, 0x2b02
jne 0x1001e1d
push 0x273b
push 1
call fcn.010025d9
cmp dword [ebp - 0x58c], 2
pop ecx
pop ecx
jne 0x1001d25
cmp byte [ebp - 0x585], 0
je 0x1001cdf
push dword [ebp - 0x5a0]
lea eax, [ebp - 0x484]
push eax
call fcn.010012f2
push ebx
push 1
call fcn.010025d9
pop ecx
pop ecx
jmp 0x1001d25
push 0x2728
jmp 0x1001cd4
mov esi, dword [0x100461c]
mov eax, edi
test esi, esi
jne 0x1001d56
push dword [0x1004620]
call fcn.01001344
cmp dword [ebp - 0x58c], 2
je 0x1001e0b
lea edi, [ebp - 0x484]
mov esi, 0x1004606
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, 0x1004600
mov byte [ebp - 0x585], 1
inc dword [ebp - 0x58c]
cmp dword [ebp - 0x58c], 3
jl 0x1001b4e
inc byte [ebp - 0x594]
movzx eax, byte [ebp - 0x594]
cmp eax, dword [ebp - 0x5a4]
jbe 0x1001b23
jmp 0x1001e84
cmp esi, 0x2b05
jne 0x1001e1d
push dword [0x1004620]
call fcn.01001344
cmp dword [ebp - 0x58c], 2
jne 0x1001d0a
push dword [ebp - 0x5a0]
push 0x1004606
call fcn.010012f2
push ebx
push 1
call fcn.010025d9
mov eax, dword [0x1004620]
pop ecx
pop ecx
cmp eax, 0x3e8
jae 0x1001d25
mov ecx, 0x3e8
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001d25
push dword [ebp - 0x5a0]
push dword [0x1004600]
call fcn.010012a7
push ebx
jmp 0x1001e7b
cmp esi, 0x2af8
jb 0x1001e25
test eax, eax
je 0x1001ded
push dword [ebp - 0x5a0]
push dword [eax]
call fcn.010012a7
push 0x2719
push 1
call fcn.010025d9
pop ecx
pop ecx
mov eax, dword [section..data]
xor ecx, ecx
jmp 0x1001e05
cmp eax, 0x2b2a
je 0x1001e74
mov eax, dword [ecx*8 + 0x1003008]
inc ecx
cmp eax, esi
jne 0x1001df6
jmp 0x1001e74
push dword [ebp - 0x5a0]
push 0x1004606
call fcn.010012f2
jmp 0x1001dc0
cmp esi, 0x2af8
jae 0x1001e37
push esi
push 0x271a
push 1
call fcn.010025d9
add esp, 0xc
jmp 0x1001e84
test eax, eax
je 0x1001e58
push dword [ebp - 0x5a0]
add eax, 6
push eax
call fcn.010012f2
push 0x2719
push 1
call fcn.010025d9
pop ecx
pop ecx
mov eax, dword [section..data]
xor ecx, ecx
jmp 0x1001e70
cmp eax, 0x2b2a
je 0x1001e74
mov eax, dword [ecx*8 + 0x1003008]
inc ecx
cmp eax, esi
jne 0x1001e61
push dword [ecx*8 + 0x1003004]
push 1
call fcn.010025d9
pop ecx
pop ecx
push 0x271b
push 1
call fcn.010025d9
pop ecx
pop ecx
push dword [ebp - 0x59c]
call sub.icmp.dll_IcmpCloseHandle
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100215c
leave
ret