Function at 0x1001591
Capabilities:
Initialize winsock library
Resolve dns
Send icmp echo request
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5bc
mov eax, dword [0x10030bc]
and dword [ebp - 0x590], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push 0
mov dword [ebp - 4], eax
mov dword [ebp - 0x5b8], ebx
mov dword [ebp - 0x5a8], 0x1e
inc esi
mov byte [ebp - 0x5a0], 1
mov byte [ebp - 0x585], 0
mov dword [ebp - 0x5b0], 0xfa0
mov byte [ebp - 0x591], 0
call sub.KERNEL32.dll_SetThreadUILanguage
push 0x1004140
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1001616
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2732
push esi
call fcn.01001189
add esp, 0xc
mov eax, esi
jmp 0x1001e29
push edi
xor eax, eax
cmp dword [ebp + 8], 2
push 0x20
pop ecx
lea edi, [ebp - 0x584]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x59b], al
mov byte [ebp - 0x59a], al
mov byte [ebp - 0x599], al
lea eax, [ebp - 0x70]
mov byte [ebp - 0x59c], 1
mov dword [ebp - 0x598], eax
jge 0x1001659
push dword [ebx]
push 0x2713
push esi
jmp 0x1001a16
cmp dword [ebp + 8], esi
mov edi, esi
mov dword [ebp - 0x58c], edi
jle 0x10018e2
lea eax, [ebx + edi*4]
mov esi, dword [eax]
mov dword [ebp - 0x5b4], eax
mov al, byte [esi]
cmp al, 0x2d
je 0x10016c7
cmp al, 0x2f
je 0x10016c7
push dword [ebp - 0x5a0]
lea eax, [ebp - 0x474]
push 0x401
push eax
lea eax, [ebp - 0x5bc]
push eax
lea eax, [ebp - 0x504]
push eax
push esi
push dword [ebp - 0x590]
mov byte [ebp - 0x591], 1
call fcn.01001404
test al, al
jne 0x10018c9
push dword [ebx + edi*4]
push 0x2714
jmp 0x1001a14
movsx eax, byte [esi + 1]
cmp eax, 0x53
jg 0x1001771
je 0x100172d
sub eax, 0x34
je 0x1001728
dec eax
dec eax
je 0x1001714
sub eax, 9
je 0x1001902
sub eax, 0x13
jne 0x100190e
push esi
push 0x17
lea eax, [ebp - 0x590]
push eax
call fcn.01001559
test al, al
je 0x1001a1e
or byte [ebp - 0x59a], 1
jmp 0x10018c9
push esi
push 0x17
lea eax, [ebp - 0x590]
push eax
call fcn.01001559
jmp 0x10018b8
push esi
push 2
jmp 0x1001717
push esi
push 0x17
lea eax, [ebp - 0x590]
push eax
call fcn.01001559
test al, al
je 0x1001a1e
lea eax, [ebp - 0x584]
push eax
inc edi
push dword [ebx + edi*4]
push dword [ebp - 0x590]
call fcn.010014f5
test eax, eax
jne 0x10018c9
movsx eax, byte [esi + 1]
push eax
push 0x2735
jmp 0x1001a14
sub eax, 0x64
je 0x10018c2
sub eax, 4
je 0x100189f
dec eax
dec eax
je 0x100179d
sub eax, 0xd
jne 0x100190e
push 0xffffffffffffffff
lea eax, [ebp - 0x5b0]
jmp 0x10018aa
push esi
push 2
lea eax, [ebp - 0x590]
push eax
call fcn.01001559
test al, al
je 0x1001a1e
mov al, byte [ebp - 0x599]
movzx edi, al
mov byte [ebp - 0x585], al
lea eax, [edi + 7]
cmp eax, 0x28
jg 0x1001931
mov ebx, dword [ebp - 0x598]
mov eax, dword [ebp + 8]
lea esi, [edi + ebx]
mov byte [edi + ebx], 0x83
mov byte [esi + 1], 3
mov byte [esi + 2], 4
add byte [ebp - 0x599], 3
add eax, 0xfffffffe
cmp dword [ebp - 0x58c], eax
jge 0x1001874
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax + 4]
cmp byte [eax], 0x2d
je 0x1001874
lea eax, [edi + 7]
cmp eax, 0x28
jg 0x1001931
mov eax, dword [ebp - 0x5a4]
inc dword [ebp - 0x58c]
add eax, 4
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x5b4], eax
mov eax, dword [eax]
push eax
mov dword [ebp - 0x5ac], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x1001944
movzx ecx, byte [esi + 1]
add ecx, edi
mov dword [ecx + ebx], eax
mov eax, dword [ebp + 8]
add byte [esi + 1], 4
add byte [ebp - 0x599], 4
add eax, 0xfffffffe
cmp dword [ebp - 0x58c], eax
jl 0x1001805
mov al, byte [esi + 1]
mov edi, dword [ebp - 0x58c]
mov ebx, dword [ebp - 0x5b8]
mov cl, al
add cl, byte [ebp - 0x585]
add al, 4
mov byte [esi + 1], al
add byte [ebp - 0x599], 4
mov byte [ebp - 0x585], cl
jmp 0x10018c9
push 0xff
lea eax, [ebp - 0x5a8]
push 1
push edi
push dword [ebp + 8]
push ebx
push eax
call fcn.01001393
inc edi
test al, al
je 0x1001a1e
jmp 0x10018c9
mov byte [ebp - 0x5a0], 0
inc edi
cmp edi, dword [ebp + 8]
mov dword [ebp - 0x58c], edi
jl 0x100166a
cmp byte [ebp - 0x591], 0
jne 0x1001954
push 0x2739
push 1
call fcn.01001189
push 0x2713
push 1
call fcn.01001189
add esp, 0x10
jmp 0x1001a1e
push dword [ebx]
push 0x2713
jmp 0x1001a14
push dword [ebx + edi*4]
push 0x2738
push 1
call fcn.01001189
push 0x2713
push 1
call fcn.01001189
add esp, 0x14
jmp 0x1001a1e
push 0x2737
push 1
call fcn.01001189
pop ecx
pop ecx
jmp 0x1001a1e
push dword [ebp - 0x5ac]
push 0x2736
jmp 0x1001a14
movsx eax, word [ebp - 0x504]
cmp eax, 2
mov dword [ebp - 0x5ac], eax
jne 0x100198e
cmp byte [ebp - 0x585], 0
je 0x1001985
movzx eax, byte [ebp - 0x585]
mov ecx, dword [ebp - 0x500]
mov edx, dword [ebp - 0x598]
mov dword [eax + edx], ecx
call sub.icmp.dll_IcmpCreateFile
xor edi, edi
jmp 0x10019fd
xor edi, edi
cmp word [ebp - 0x584], di
jne 0x10019f8
push edi
push edi
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10019c7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x2732
push 1
call fcn.01001189
add esp, 0xc
push 1
call dword [sym.imp.msvcrt.dll_exit]
push edi
push edi
lea eax, [ebp - 0x5b8]
push eax
mov eax, 0x80
push eax
lea ecx, [ebp - 0x584]
push ecx
push eax
lea eax, [ebp - 0x504]
push eax
push 0xc8000014
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call sub.iphlpapi.dll_Icmp6CreateFile
cmp eax, 0xffffffff
mov dword [ebp - 0x590], eax
jne 0x1001a2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2715
push 1
call fcn.01001189
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
inc eax
jmp 0x1001e28
push 2
push edi
push edi
push 0x41
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x5bc]
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
cmp byte [ebp - 0x474], 0
push dword [ebp - 0x5a8]
lea eax, [ebp - 0x48]
push eax
je 0x1001a74
lea eax, [ebp - 0x474]
push eax
push 0x2716
push 1
call fcn.01001189
add esp, 0x14
jmp 0x1001a83
push 0x2733
push 1
call fcn.01001189
add esp, 0x10
movzx eax, byte [ebp - 0x59c]
cmp eax, dword [ebp - 0x5a8]
ja 0x1001e07
mov edi, 0x10042e0
mov ebx, 0x273c
cmp byte [ebp - 0x59c], 0
je 0x1001e07
push eax
push 0x2717
push 1
call fcn.01001189
add esp, 0xc
and dword [ebp - 0x58c], 0
mov byte [ebp - 0x585], 0
cmp dword [ebp - 0x5ac], 2
push dword [ebp - 0x5b0]
lea eax, [ebp - 0x59c]
push 0x84
push edi
push eax
push 0x40
push 0x1004100
jne 0x1001bf9
push dword [ebp - 0x500]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x590]
call sub.icmp.dll_IcmpSendEcho2
test eax, eax
jne 0x1001b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
cmp esi, 0x2b02
jne 0x1001d45
push 0x273b
push 1
call fcn.01001189
cmp dword [ebp - 0x58c], 2
pop ecx
pop ecx
jne 0x1001cb1
cmp byte [ebp - 0x585], 0
je 0x1001c68
push dword [ebp - 0x5a0]
push dword [ebp - 0x5a4]
call fcn.010012ca
push ebx
push 1
call fcn.01001189
pop ecx
pop ecx
jmp 0x1001cb1
mov esi, dword [0x10042e4]
test esi, esi
mov eax, edi
jne 0x1001b9e
push dword [0x10042e8]
call fcn.0100135d
cmp dword [ebp - 0x58c], 2
je 0x1001d32
mov eax, dword [0x10042e0]
mov dword [ebp - 0x5a4], eax
jmp 0x1001caa
cmp esi, 0x2b05
jne 0x1001d45
push dword [0x10042e8]
call fcn.0100135d
cmp dword [ebp - 0x58c], 2
jne 0x1001b8e
push dword [ebp - 0x5a0]
push dword [0x10042e0]
call fcn.010012ca
push ebx
push 1
call fcn.01001189
mov eax, dword [0x10042e8]
pop ecx
pop ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x1001cb1
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001cb1
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x584]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x590]
call sub.iphlpapi.dll_Icmp6SendEcho2
test eax, eax
jne 0x1001c72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
cmp esi, 0x2b02
jne 0x1001db2
push 0x273b
push 1
call fcn.01001189
cmp dword [ebp - 0x58c], 2
pop ecx
pop ecx
jne 0x1001cb1
cmp byte [ebp - 0x585], 0
je 0x1001c68
push dword [ebp - 0x5a0]
lea eax, [ebp - 0x484]
push eax
call fcn.01001310
jmp 0x1001b5b
push 0x2728
jmp 0x1001b5c
mov esi, dword [0x10042fc]
test esi, esi
mov eax, edi
jne 0x1001ce2
push dword [0x1004300]
call fcn.0100135d
cmp dword [ebp - 0x58c], 2
je 0x1001d9f
mov esi, 0x10042e6
lea edi, [ebp - 0x484]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, 0x10042e0
mov byte [ebp - 0x585], 1
inc dword [ebp - 0x58c]
cmp dword [ebp - 0x58c], 3
jl 0x1001acb
inc byte [ebp - 0x59c]
movzx eax, byte [ebp - 0x59c]
cmp eax, dword [ebp - 0x5a8]
jbe 0x1001aa0
jmp 0x1001e07
cmp esi, 0x2b05
jne 0x1001db2
push dword [0x1004300]
call fcn.0100135d
cmp dword [ebp - 0x58c], 2
jne 0x1001c96
push dword [ebp - 0x5a0]
push 0x10042e6
call fcn.01001310
push ebx
push 1
call fcn.01001189
mov eax, dword [0x1004300]
cmp eax, 0x3e8
pop ecx
pop ecx
jae 0x1001cb1
mov ecx, 0x3e8
jmp 0x1001beb
push dword [ebp - 0x5a0]
push dword [0x10042e0]
call fcn.010012ca
jmp 0x1001daf
cmp esi, 0x2af8
jae 0x1001d62
push esi
push 0x271a
push 1
call fcn.01001189
add esp, 0xc
jmp 0x1001e07
test eax, eax
je 0x1001d81
push dword [ebp - 0x5a0]
push dword [eax]
call fcn.010012ca
push 0x2719
push 1
call fcn.01001189
pop ecx
pop ecx
mov eax, dword [0x1003018]
xor ecx, ecx
jmp 0x1001d99
cmp eax, 0x2b2a
je 0x1001df7
mov eax, dword [ecx*8 + 0x1003020]
inc ecx
cmp eax, esi
jne 0x1001d8a
jmp 0x1001df7
push dword [ebp - 0x5a0]
push 0x10042e6
call fcn.01001310
push ebx
jmp 0x1001dfe
cmp esi, 0x2af8
jb 0x1001d4d
test eax, eax
je 0x1001ddb
push dword [ebp - 0x5a0]
add eax, 6
push eax
call fcn.01001310
push 0x2719
push 1
call fcn.01001189
pop ecx
pop ecx
mov eax, dword [0x1003018]
xor ecx, ecx
jmp 0x1001df3
cmp eax, 0x2b2a
je 0x1001df7
mov eax, dword [ecx*8 + 0x1003020]
inc ecx
cmp eax, esi
jne 0x1001de4
push dword [ecx*8 + 0x100301c]
push 1
call fcn.01001189
pop ecx
pop ecx
push 0x271b
push 1
call fcn.01001189
pop ecx
pop ecx
push dword [ebp - 0x590]
call sub.icmp.dll_IcmpCloseHandle
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01001ead
leave
ret