Function at 0x1400a8f60
Capabilities:
Delete file
Execute command
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc28
mov eax, dword [0x14087c624]
test eax, eax
mov rbx, rcx
mov rbp, rdx
jne 0x1400a90a0
lea rcx, str.SSH_CLIENT
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400a8f9e
mov eax, dword [0x14087c620]
test eax, eax
je 0x1400a9400
test rbx, rbx
je 0x1400a9420
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a9530
lea rsi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
mov r8d, 0x800
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x420]
mov rcx, rdi
call sub.msvcrt.dll_memset
mov eax, dword [0x140174b98]
test eax, eax
jne 0x1400a93f0
mov rcx, rbx
call fcn.1400a4c70
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
test rbp, rbp
je 0x1400a902f
mov rcx, rbp
mov ebp, dword [0x140174b98]
test ebp, ebp
je 0x1400a9510
call fcn.1400a4d30
mov rdx, rax
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, rsi
mov rdx, rdi
call fcn.1400a6730
test rax, rax
mov rcx, rax
je 0x1400a92e3
mov ebx, dword [0x140174b98]
test ebx, ebx
je 0x1400a9500
call fcn.1400a5010
mov rdx, rax
lea rsi, [0x14087c660]
mov rcx, rsi
call sub.msvcrt.dll_strcpy
cmp byte [0x14087c660], 0
je 0x1400a92e3
mov rcx, rsi
call fcn.1400a4e00
test eax, eax
je 0x1400a92e3
lea rax, [0x14087c660]
add rsp, 0xc28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400a9450
call fcn.1400a3b20
test eax, eax
je 0x1400a92f0
test rbx, rbx
je 0x1400a9560
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a95d2
cmp byte [rbx], 0
lea rsi, [rsp + 0x20]
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x20], rax
jne 0x1400a94c0
movabs rdi, 0x69746b6361622d2d
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov r9d, 0x594c
mov r10d, 0x2022
test rbp, rbp
mov rbx, rax
lea rax, [rsi + rax]
mov qword [rax], rdi
movabs rdi, 0x2220656c7469746b
mov qword [rax + 5], rdi
lea rax, [rsi + rbx + 0xd]
movabs rdi, 0x636f66203a626174
mov qword [rax], rdi
movabs rdi, 0x203a2f207c207375
mov qword [rax + 8], rdi
movabs rdi, 0x6574616c75706f70
mov qword [rax + 0x10], rdi
movabs rdi, 0x6563617073207c20
mov qword [rax + 0x18], rdi
movabs rdi, 0x6c6966203a726162
mov qword [rax + 0x20], rdi
movabs rdi, 0x662074786574206c
mov qword [rax + 0x28], rdi
movabs rdi, 0x6f207c20646c6569
mov qword [rax + 0x30], rdi
movabs rdi, 0x2054584554203a6b
mov qword [rax + 0x38], rdi
movabs rdi, 0x4e4f20444c454946
mov qword [rax + 0x40], rdi
movabs rdi, 0x63656c6573642d2d
mov word [rax + 0x48], r9w
lea rax, [rsi + rbx + 0x59]
mov word [rsi + rbx + 0x57], r10w
mov qword [rax], rdi
mov dword [rax + 8], 0x222074
je 0x1400a91e4
cmp byte [rbp], 0
jne 0x1400a9468
lea rax, [rsi + rbx + 0x64]
mov ecx, 0x2f2e
mov word [rax], cx
lea rdi, [rsp + 0x420]
mov byte [rax + 2], 0
movabs rbx, 0x3220303620302022
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov edx, 0x3e
lea rcx, str.TEMP
add rax, rsi
mov qword [rax], rbx
movabs rbx, 0x2e6466796e69745c
mov word [rax + 8], dx
call sub.msvcrt.dll_getenv
mov rcx, rdi
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, rsi
add rax, rdi
mov qword [rax], rbx
mov dword [rax + 8], 0x747874
call sub.msvcrt.dll_strcat
mov rcx, rsi
call sub.msvcrt.dll_system
lea rdx, [0x1401a3232]
mov rcx, rdi
call sub.msvcrt.dll_fopen
lea rsi, [0x14087c660]
test rax, rax
mov rbx, rax
je 0x1400a95ed
nop dword [rax]
mov r8, rbx
mov edx, 0x400
mov rcx, rsi
call sub.msvcrt.dll_fgets
test rax, rax
jne 0x1400a9290
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rcx, rdi
call sub.msvcrt.dll_remove
lea rcx, [0x14087c660]
jmp 0x1400a92c7
mov byte [rax], 0x5c
lea rcx, [rax + 1]
mov edx, 0x2f
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400a92c0
cmp byte [0x14087c660], 0
jne 0x1400a9078
xor eax, eax
jmp 0x1400a908f
test rbx, rbx
je 0x1400a930c
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a95b0
movabs rax, 0x66207463656c6553
mov edx, 0x400
mov dword [0x14087c670], 0x206d6f
mov qword [0x14087c660], rax
lea rcx, [0x14087d260]
movabs rax, 0x7266207265646c6f
lea rsi, [0x14087c660]
mov qword [0x14087c668], rax
call sub.msvcrt.dll__getcwd
mov rcx, rsi
mov rdx, rax
call sub.msvcrt.dll_strcat
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a7310
test rax, rax
mov rbp, rax
je 0x1400a93c0
lea rdi, [rsp + 0x420]
mov rdx, rax
mov rcx, rdi
call sub.msvcrt.dll_strcpy
lea r8, [0x1401a3334]
mov rdx, rsi
mov rcx, rbx
call fcn.1400a7310
test rax, rax
je 0x1400a9520
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_strcpy
mov rdx, rdi
mov rcx, rbp
call sub.msvcrt.dll_strcpy
jmp 0x1400a906b
lea r8, [0x1401a3334]
mov rdx, rsi
mov rcx, rbx
call fcn.1400a7310
test rax, rax
je 0x1400a9550
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_strcpy
jmp 0x1400a906b
mov rcx, rbx
call fcn.1400a4d30
mov rdx, rax
jmp 0x1400a9001
lea rcx, [0x1401a34a7]
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x1400a8f9e
jmp 0x1400a90af
lea rsi, [rsp + 0x20]
mov rax, rbx
mov ecx, 0x20
mov rdi, rsi
mov r8d, 0x800
xor edx, edx
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x420]
mov rcx, rdi
call sub.msvcrt.dll_memset
jmp 0x1400a9009
call fcn.1400a3b20
test eax, eax
je 0x1400a8f7f
jmp 0x1400a90af
lea rdi, [rsp + 0x420]
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_strcpy
cmp byte [rsp + 0x420], 0
jne 0x1400a9580
mov rcx, rdi
jmp 0x1400a9497
mov byte [rax], 0x2f
lea rcx, [rax + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400a9490
lea rcx, [rsi + rbx + 0x64]
mov rdx, rdi
call sub.msvcrt.dll_strcpy
jmp 0x1400a91fd
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov byte [rsp + 0x2f], 0x22
movabs rax, 0x20656c7469742d2d
mov qword [rsp + 0x27], rax
call sub.msvcrt.dll_strcpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov r11d, 0x2022
add rax, rsi
mov word [rax], r11w
mov byte [rax + 2], 0
jmp 0x1400a90f9
call fcn.1400a4f10
mov rdx, rax
jmp 0x1400a905c
call fcn.1400a4c70
mov rdx, rax
jmp 0x1400a9027
mov byte [0x14087c660], 0
jmp 0x1400a93a8
movabs rax, 0x73776f646e6977
mov qword [0x14087c220], rax
mov eax, 1
jmp 0x1400a908f
mov byte [0x14087c660], 0
xor eax, eax
jmp 0x1400a908f
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x20]
jmp 0x1400a90f9
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rbp, [rdi + rax - 1]
cmp byte [rbp], 0x5c
je 0x1400a9489
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov r8d, 0x5c
mov word [rbp + rax], r8w
jmp 0x1400a9489
movabs rax, 0x706e696369736162
mov qword [0x14087c220], rax
xor eax, eax
mov dword [0x14087c227], 0x747570
jmp 0x1400a908f
mov dword [0x14087c220], 0x6c616964
xor eax, eax
mov dword [0x14087c223], 0x676f6c
jmp 0x1400a908f
mov rcx, rdi
call sub.msvcrt.dll_remove
xor eax, eax
jmp 0x1400a908f