Function at 0x403b70
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x41c8a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
push esi
push edi
push str.ICMP.DLL
mov dword [esp + 0x64], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x403bd0
push 1
lea ecx, [esp + 0x6c]
mov dword [esp + 0x64], 0xffffffff
call fcn.00405a90
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
mov eax, dword [esp + 0x6c]
test eax, eax
jne 0x403bdd
mov eax, 0x41d228
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x403c3e
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x403c26
mov al, byte [ecx - 1]
test al, al
je 0x403c1c
cmp al, 0xff
je 0x403c1c
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebp
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
dec ecx
push ecx
call fcn.0040f37c
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IcmpCreateFile
push ebx
call esi
push str.IcmpCloseHandle
push ebx
mov edi, eax
call esi
push str.IcmpSendEcho
push ebx
mov dword [esp + 0x18], eax
call esi
test edi, edi
mov ebp, eax
je 0x403e3f
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403e3f
test ebp, ebp
je 0x403e3f
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x403cdd
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x403cc5
mov al, byte [ecx - 1]
test al, al
je 0x403cbb
cmp al, 0xff
je 0x403cbb
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebp
mov eax, 5
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
dec ecx
push ecx
call fcn.0040f37c
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
mov ecx, 0x10
mov eax, 0xaaaaaaaa
lea edi, [esp + 0x18]
push 0x5c
rep stosd dword es:[edi], eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x403d4f
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x403d37
mov al, byte [ecx - 1]
test al, al
je 0x403d2d
cmp al, 0xff
je 0x403d2d
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebp
mov eax, 6
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
dec ecx
push ecx
call fcn.0040f37c
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push 0x3e8
push 0x5c
mov dword [esi + 0x10], eax
mov word [esi + 0xc], 0x40
mov eax, dword [edx + 0xc]
push esi
push 0
lea ecx, [esp + 0x28]
push 0x40
push ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
push edx
push eax
call ebp
test eax, eax
je 0x403de7
mov edx, dword [esp + 0x78]
mov ecx, dword [esi + 8]
push esi
mov dword [edx], ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x403dd2
mov al, byte [ecx - 1]
test al, al
je 0x403dc8
cmp al, 0xff
je 0x403dc8
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
dec ecx
push ecx
call fcn.0040f37c
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x403e27
mov al, byte [ecx - 1]
test al, al
je 0x403e1d
cmp al, 0xff
je 0x403e1d
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebp
mov eax, 7
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
dec ecx
push ecx
call fcn.0040f37c
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x403e63
mov al, byte [ecx - 1]
test al, al
je 0x403e59
cmp al, 0xff
je 0x403e59
dec al
mov byte [ecx - 1], al
jmp 0x403e63
dec ecx
push ecx
call fcn.0040f37c
add esp, 4
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret