Function at 0x1400aa520
Capabilities:
Delete file
Execute command
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x830
mov eax, dword [0x14087f624]
mov esi, dword [rsp + 0x888]
test eax, eax
mov rbx, rcx
mov rdi, rdx
mov r12d, r8d
mov rbp, r9
jne 0x1400aa660
lea rcx, str.SSH_CLIENT
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400aa56f
mov r11d, dword [0x14087f620]
test r11d, r11d
je 0x1400aaa10
test rbx, rbx
je 0x1400aa58b
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400aaaa0
mov r8d, r12d
mov dword [rsp + 0x28], esi
mov r9, rbp
mov rdx, rdi
mov rax, qword [rsp + 0x880]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400a8110
test rax, rax
mov r12, rax
je 0x1400aaaf0
cmp byte [r12], 0
je 0x1400aaaf0
test esi, esi
je 0x1400aa9c0
mov edx, 0x7c
mov rcx, r12
call sub.msvcrt.dll_strchr
test rax, rax
mov rbx, rax
je 0x1400aa9c0
mov rcx, r12
call sub.msvcrt.dll_strlen
test rax, rax
je 0x1400aaaf0
mov rbp, r12
mov rdi, r12
nop dword [rax]
mov rsi, rbx
mov rdx, rdi
mov rcx, rbp
sub rsi, rdi
mov r8, rsi
add rsi, rbp
call sub.msvcrt.dll_memmove
mov byte [rsi], 0
mov rcx, rbp
call fcn.1400a6ad0
test eax, eax
je 0x1400aa62d
mov byte [rsi], 0x7c
lea rbp, [rsi + 1]
lea rdi, [rbx + 1]
mov edx, 0x7c
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
mov rbx, rax
jne 0x1400aa600
mov rcx, rdi
call fcn.1400a6ad0
test eax, eax
jne 0x1400aaac0
mov byte [rbp - 1], 0
jmp 0x1400aa9d0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400aaa30
call fcn.1400a5760
test eax, eax
je 0x1400aa8f8
test rbx, rbx
je 0x1400aab00
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400aab6b
lea rbp, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
lea r12, [rsp + 0x430]
mov rcx, rbp
call sub.msvcrt.dll_memset
cmp byte [rbx], 0
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x430], rax
jne 0x1400aaa48
mov rcx, r12
call sub.msvcrt.dll_strlen
mov r8d, 0x594c
mov r9d, 0x2022
test rdi, rdi
movabs rdx, 0x69746b6361622d2d
mov rbx, rax
lea rax, [r12 + rax]
mov qword [rax], rdx
movabs rdx, 0x2220656c7469746b
mov qword [rax + 5], rdx
lea rax, [r12 + rbx + 0xd]
movabs rdx, 0x636f66203a626174
mov qword [rax], rdx
movabs rdx, 0x203a2f207c207375
mov qword [rax + 8], rdx
movabs rdx, 0x6574616c75706f70
mov qword [rax + 0x10], rdx
movabs rdx, 0x6563617073207c20
mov qword [rax + 0x18], rdx
movabs rdx, 0x6c6966203a726162
mov qword [rax + 0x20], rdx
movabs rdx, 0x662074786574206c
mov qword [rax + 0x28], rdx
movabs rdx, 0x6f207c20646c6569
mov qword [rax + 0x30], rdx
movabs rdx, 0x2054584554203a6b
mov qword [rax + 0x38], rdx
movabs rdx, 0x4e4f20444c454946
mov qword [rax + 0x40], rdx
movabs rdx, 0x63656c6573662d2d
mov word [rax + 0x48], r8w
lea rax, [r12 + rbx + 0x59]
mov word [r12 + rbx + 0x57], r9w
mov qword [rax], rdx
mov dword [rax + 8], 0x222074
je 0x1400aa7e6
cmp byte [rdi], 0
je 0x1400aa7e6
mov rcx, rbp
mov rdx, rdi
call sub.msvcrt.dll_strcpy
mov rcx, rbp
jmp 0x1400aa7d7
mov byte [rax], 0x2f
lea rcx, [rax + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400aa7d0
mov edx, 0x2f
mov rcx, rbp
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1400aab38
movabs rdi, 0x3220303620302022
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edx, 0x3e
lea rcx, str.TEMP
add rax, r12
mov qword [rax], rdi
movabs rdi, 0x2e6466796e69745c
mov word [rax + 8], dx
call sub.msvcrt.dll_getenv
mov rcx, rbp
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rdx, rbp
mov rcx, r12
add rax, rbp
mov qword [rax], rdi
lea rdi, [0x14087fa60]
mov dword [rax + 8], 0x747874
call sub.msvcrt.dll_strcat
mov rcx, r12
call sub.msvcrt.dll_system
lea rdx, [0x1401a55c2]
mov rcx, rbp
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
je 0x1400aab84
nop dword [rax + rax]
mov r8, rbx
mov edx, 0x400
mov rcx, rdi
call sub.msvcrt.dll_fgets
test rax, rax
jne 0x1400aa898
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rcx, rbp
call sub.msvcrt.dll_remove
lea rcx, [0x14087fa60]
jmp 0x1400aa8d7
mov byte [rax], 0x5c
lea rcx, [rax + 1]
mov edx, 0x2f
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400aa8d0
lea r12, [0x14087fa60]
jmp 0x1400aa5b9
test rbx, rbx
je 0x1400aa914
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400aab4e
movabs rax, 0x6c6966206e65704f
mov edx, 0x400
mov qword [0x14087fe60], rax
lea rcx, [0x140880260]
movabs rax, 0x206d6f72662065
lea rbp, [0x14087fe60]
mov qword [0x14087fe68], rax
call sub.msvcrt.dll__getcwd
mov rcx, rbp
mov rdx, rax
call sub.msvcrt.dll_strcat
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a8f50
test rax, rax
mov rdi, rax
je 0x1400aa9e8
lea r12, [rsp + 0x430]
mov rdx, rax
mov rcx, r12
call sub.msvcrt.dll_strcpy
lea r8, [0x1401a56c4]
mov rdx, rbp
mov rcx, rbx
call fcn.1400a8f50
test rax, rax
je 0x1400aaa90
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_strcpy
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_strcpy
lea r12, [0x14087fe60]
jmp 0x1400aa5b9
mov rcx, r12
call fcn.1400a6ad0
test eax, eax
je 0x1400aaaf0
mov rax, r12
add rsp, 0x830
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r8, [0x1401a56c4]
mov rdx, rbp
mov rcx, rbx
call fcn.1400a8f50
test rax, rax
je 0x1400aaae8
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_strcpy
jmp 0x1400aa9b1
lea rcx, [0x1401a5837]
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x1400aa56f
jmp 0x1400aa66f
call fcn.1400a5760
test eax, eax
je 0x1400aa54e
jmp 0x1400aa66f
movabs rax, 0x20656c7469742d2d
mov rdx, rbx
mov byte [rsp + 0x43f], 0x22
lea rcx, [rsp + 0x440]
mov qword [rsp + 0x437], rax
call sub.msvcrt.dll_strcpy
mov rcx, r12
call sub.msvcrt.dll_strlen
mov r10d, 0x2022
add rax, r12
mov word [rax], r10w
mov byte [rax + 2], 0
jmp 0x1400aa6d4
mov byte [0x14087fe60], 0
jmp 0x1400aa9a6
movabs rax, 0x73776f646e6977
mov r12d, 1
mov qword [0x14087f220], rax
jmp 0x1400aa9d0
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, rbp
mov rbx, rax
mov r8, rax
call sub.msvcrt.dll_memmove
mov byte [rbp + rbx], 0
jmp 0x1400aa9d0
mov byte [0x14087fe60], 0
nop
xor r12d, r12d
jmp 0x1400aa9d0
lea rbp, [rsp + 0x30]
mov r8d, 0x400
xor edx, edx
lea r12, [rsp + 0x430]
mov rcx, rbp
call sub.msvcrt.dll_memset
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x430], rax
jmp 0x1400aa6d4
lea rax, [r12 + rbx + 0x64]
mov ecx, 0x2f2e
mov word [rax], cx
mov byte [rax + 2], 0
jmp 0x1400aa7fc
movabs rax, 0x706e696369736162
mov qword [0x14087f220], rax
mov dword [0x14087f227], 0x747570
jmp 0x1400aaaf0
mov dword [0x14087f220], 0x6c616964
mov dword [0x14087f223], 0x676f6c
jmp 0x1400aaaf0
mov rcx, rbp
call sub.msvcrt.dll_remove
jmp 0x1400aaaf0