Function at 0x1400a9600
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
mov r11d, dword [0x14087c624]
mov byte [0x14087c640], 0
test r11d, r11d
mov rbx, rcx
mov rsi, rdx
mov rbp, r8
mov rdi, r9
jne 0x1400a9728
lea rcx, str.SSH_CLIENT
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400a9653
mov r10d, dword [0x14087c620]
test r10d, r10d
je 0x1400a9910
lea r12, [rsp + 0x50]
test rbx, rbx
je 0x1400a969c
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a9998
mov r9d, dword [0x140174b98]
mov rcx, rbx
test r9d, r9d
jne 0x1400a9900
call fcn.1400a4c70
mov rdx, rax
lea r12, [rsp + 0x50]
mov rcx, r12
call sub.msvcrt.dll_wcscpy
lea rbx, [rsp + 0x30]
test rsi, rsi
je 0x1400a96ce
mov r8d, dword [0x140174b98]
mov rcx, rsi
test r8d, r8d
jne 0x1400a98f0
call fcn.1400a4c70
mov rdx, rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov rcx, r12
mov r9, rdi
mov r8, rbp
mov rdx, rbx
call fcn.1400a68c0
test rax, rax
mov rcx, rax
je 0x1400a98db
mov edx, dword [0x140174b98]
test edx, edx
jne 0x1400a98e0
call fcn.1400a4f10
mov rdx, rax
lea rcx, [0x14087c630]
call sub.msvcrt.dll_strcpy
lea rcx, [0x14087c640]
mov rdx, rax
call sub.msvcrt.dll_strcpy
jmp 0x1400a987f
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400a9930
call fcn.1400a3b20
test eax, eax
je 0x1400a98a0
test rbx, rbx
je 0x1400a9760
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a99b8
test rsi, rsi
je 0x1400a9948
lea rcx, [0x14087c640]
mov r8d, 7
mov rdx, rsi
call sub.msvcrt.dll_strncpy
mov byte [0x14087c647], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a7310
test rax, rax
mov rbp, rax
je 0x1400a97a6
lea rcx, [rsp + 0x50]
mov rdx, rax
call sub.msvcrt.dll_strcpy
lea r8, [0x14087c640]
mov rcx, rbx
lea rdx, str.Enter_hex_rgb_color__i.e._f5ca20_
call fcn.1400a7310
test rax, rax
mov rsi, rax
je 0x1400a98db
mov rcx, rax
call sub.msvcrt.dll_strlen
cmp rax, 7
jne 0x1400a98db
cmp byte [rsi], 0x23
jne 0x1400a98db
mov r12, qword [sym.imp.msvcrt.dll_isxdigit]
lea rbx, [rsi + 1]
lea r13, [rsi + 7]
movsx ecx, byte [rbx]
call r12
test eax, eax
je 0x1400a98db
add rbx, 1
cmp r13, rbx
jne 0x1400a97f2
test rdi, rdi
je 0x1400a985e
mov rax, qword [rsi]
lea rcx, [rsp + 0x35]
mov r8d, 0x10
xor edx, edx
mov qword [rsp + 0x30], rax
call sub.msvcrt.dll_strtoul
lea rcx, [rsp + 0x33]
mov r8d, 0x10
xor edx, edx
mov byte [rdi + 2], al
mov byte [rsp + 0x35], 0
call sub.msvcrt.dll_strtoul
lea rcx, [rsp + 0x31]
mov r8d, 0x10
xor edx, edx
mov byte [rdi + 1], al
mov byte [rsp + 0x33], 0
call sub.msvcrt.dll_strtoul
mov byte [rdi], al
lea rcx, [0x14087c640]
mov rdx, rsi
call sub.msvcrt.dll_strcpy
test rbp, rbp
je 0x1400a987f
lea rdx, [rsp + 0x50]
mov rcx, rbp
call sub.msvcrt.dll_strcpy
lea rax, [0x14087c640]
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test rbx, rbx
je 0x1400a9760
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400a9760
movabs rax, 0x706e696369736162
mov qword [0x14087c220], rax
mov dword [0x14087c227], 0x747570
xor eax, eax
jmp 0x1400a9886
call fcn.1400a5010
mov rdx, rax
jmp 0x1400a9701
call fcn.1400a4d30
mov rdx, rax
jmp 0x1400a96c1
call fcn.1400a4d30
mov rdx, rax
jmp 0x1400a968f
lea rcx, [0x1401a34a7]
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x1400a9653
jmp 0x1400a9737
call fcn.1400a3b20
test eax, eax
je 0x1400a9632
jmp 0x1400a9737
test rbp, rbp
je 0x1400a9980
movzx eax, byte [rbp + 2]
lea rdx, str._02hhx_02hhx_02hhx
lea rcx, [0x14087c640]
mov dword [rsp + 0x20], eax
movzx r9d, byte [rbp + 1]
movzx r8d, byte [rbp]
call fcn.1400a4270
jmp 0x1400a9785
xor eax, eax
mov byte [0x14087c642], 0
mov word [0x14087c640], ax
jmp 0x1400a9785
movabs rax, 0x73776f646e6977
mov qword [0x14087c220], rax
mov eax, 1
jmp 0x1400a9886
mov dword [0x14087c220], 0x6c616964
xor eax, eax
mov dword [0x14087c223], 0x676f6c
jmp 0x1400a9886