Function at 0x1400a7fa0
Capabilities:
Delete file
Execute command
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd48
mov eax, dword [0x14087c624]
mov byte [0x14087d660], 0
test eax, eax
mov r12, rcx
mov qword [rsp + 0xd98], rdx
mov esi, r8d
mov r13, r9
jne 0x1400a80e0
lea rcx, str.SSH_CLIENT
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400a7ff8
mov eax, dword [0x14087c620]
test eax, eax
je 0x1400a86b0
test r12, r12
je 0x1400a86d0
lea rdx, str.tinyfd_query
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a8800
xor ebx, ebx
mov ecx, 0x20
xor edx, edx
lea rdi, [rsp + 0x40]
mov rax, rbx
mov r8d, 0x800
lea rbp, [rsp + 0x540]
mov qword [rsp + 0x30], rdi
rep stosq qword [rdi], rax
lea r14, [rsp + 0x140]
mov rcx, rbp
call sub.msvcrt.dll_memset
mov rdi, r14
mov rax, rbx
mov ecx, 0x20
rep stosq qword [rdi], rax
movsxd rax, esi
lea rcx, [rax*8]
mov qword [rsp + 0x38], rax
call sub.msvcrt.dll_malloc
test esi, esi
mov rdi, rax
jle 0x1400a850d
xor ebx, ebx
jmp 0x1400a80c5
call fcn.1400a4d30
mov r15, rax
mov rcx, r15
call sub.msvcrt.dll_wcslen
lea rcx, [rax*8 + 8]
call sub.msvcrt.dll_malloc
test rax, rax
mov rcx, rax
mov qword [rdi + rbx*8], rax
je 0x1400a80b9
mov rdx, r15
call sub.msvcrt.dll_wcscpy
add rbx, 1
cmp esi, ebx
jle 0x1400a8508
mov eax, dword [0x140174b98]
mov rcx, qword [r13 + rbx*8]
test eax, eax
jne 0x1400a8088
call fcn.1400a4c70
mov r15, rax
jmp 0x1400a8090
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400a8740
call fcn.1400a3b20
test eax, eax
je 0x1400a8440
test r12, r12
je 0x1400a8830
lea rdx, str.tinyfd_query
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a88a8
lea rbp, [rsp + 0x540]
xor edx, edx
mov r8d, 0x400
lea r14, [rsp + 0x140]
mov rcx, rbp
call sub.msvcrt.dll_memset
cmp byte [r12], 0
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x140], rax
jne 0x1400a8758
movabs rdi, 0x69746b6361622d2d
mov rcx, r14
movabs rsi, 0x4e4f20444c454946
call sub.msvcrt.dll_strlen
mov r8d, 0x594c
cmp qword [rsp + 0xd98], 0
mov r9d, 0x2022
mov rbx, rax
lea rax, [r14 + rax]
mov qword [rax], rdi
movabs rdi, 0x2220656c7469746b
mov qword [rax + 5], rdi
lea rax, [r14 + rbx + 0xd]
movabs rdi, 0x636f66203a626174
mov qword [rax], rdi
movabs rdi, 0x203a2f207c207375
mov qword [rax + 8], rdi
movabs rdi, 0x6574616c75706f70
mov qword [rax + 0x10], rdi
movabs rdi, 0x6563617073207c20
mov qword [rax + 0x18], rdi
movabs rdi, 0x6c6966203a726162
mov qword [rax + 0x20], rdi
movabs rdi, 0x662074786574206c
mov qword [rax + 0x28], rdi
movabs rdi, 0x6f207c20646c6569
mov qword [rax + 0x30], rdi
movabs rdi, 0x2054584554203a6b
mov qword [rax + 0x38], rdi
movabs rdi, 0x63656c6573662d2d
mov qword [rax + 0x40], rsi
mov word [rax + 0x48], r8w
lea rax, [r14 + rbx + 0x59]
mov word [r14 + rbx + 0x57], r9w
mov qword [rax], rdi
mov dword [rax + 8], 0x222074
je 0x1400a8276
mov rax, qword [rsp + 0xd98]
cmp byte [rax], 0
je 0x1400a8276
mov rcx, rbp
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbp
jmp 0x1400a8267
mov byte [rax], 0x2f
lea rcx, [rax + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400a8260
mov edx, 0x2f
mov rcx, rbp
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1400a8870
movabs rsi, 0x3220303620302022
mov rdx, rbp
mov rcx, r14
call sub.msvcrt.dll_strcat
mov rcx, r14
movabs rdi, 0x2e6466796e69745c
call sub.msvcrt.dll_strlen
mov edx, 0x3e
lea rcx, str.TEMP
add rax, r14
mov qword [rax], rsi
lea rbx, [0x14087d660]
mov word [rax + 8], dx
call sub.msvcrt.dll_getenv
mov rcx, rbp
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rdx, rbp
mov rcx, r14
add rax, rbp
mov qword [rax], rdi
mov dword [rax + 8], 0x747874
call sub.msvcrt.dll_strcat
mov rcx, r14
call sub.msvcrt.dll_system
lea rdx, [0x1401a3232]
mov rcx, rbp
call sub.msvcrt.dll_fopen
test rax, rax
mov rsi, rax
je 0x1400a88c3
nop dword [rax + rax]
mov r8, rsi
mov edx, 0x400
mov rcx, rbx
call sub.msvcrt.dll_fgets
test rax, rax
jne 0x1400a8328
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rcx, rbp
call sub.msvcrt.dll_remove
lea rcx, [0x14087d660]
jmp 0x1400a8367
mov byte [rax], 0x5c
lea rcx, [rax + 1]
mov edx, 0x2f
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400a8360
mov rdx, rbx
mov rcx, r14
call fcn.1400a42a0
cmp byte [rsp + 0x140], 0
je 0x1400a8422
cmp byte [0x14087d660], 0
je 0x1400a8422
mov edx, 0x2f
mov rcx, rbx
call sub.msvcrt.dll_strrchr
test rax, rax
mov r8, rax
je 0x1400a87a0
lea rbp, [rsp + 0x540]
mov rsi, r8
mov rdx, rbx
sub rsi, rbx
mov rcx, rbp
mov r8, rsi
call sub.msvcrt.dll_strncpy
mov byte [rsp + rsi + 0x540], 0
cmp byte [rsp + 0x540], 0
je 0x1400a83ef
mov rcx, rbp
call fcn.1400a4e00
test eax, eax
je 0x1400a8422
mov rdx, rbx
mov rcx, rbp
call fcn.1400a42a0
cmp byte [rsp + 0x540], 0
je 0x1400a8422
lea rdx, str._:____
mov rcx, rbp
call sub.msvcrt.dll_strpbrk
mov rdx, rax
lea rax, [0x14087d660]
test rdx, rdx
je 0x1400a8424
xor eax, eax
add rsp, 0xd48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r12, r12
je 0x1400a845c
lea rdx, str.tinyfd_query
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a8886
movabs rax, 0x6c69662065766153
mov edx, 0x400
mov qword [0x14087d660], rax
lea rcx, [0x14087d260]
movabs rax, 0x206e6920656c69
lea rbx, [0x14087d660]
mov qword [0x14087d666], rax
call sub.msvcrt.dll__getcwd
mov rcx, rbx
mov rdx, rax
call sub.msvcrt.dll_strcat
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a7310
test rax, rax
mov rsi, rax
je 0x1400a8650
lea rbp, [rsp + 0x540]
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_strcpy
lea r8, [0x1401a3334]
mov rdx, rbx
mov rcx, r12
call fcn.1400a7310
test rax, rax
je 0x1400a87f0
mov rdx, rax
mov rcx, rbx
call sub.msvcrt.dll_strcpy
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_strcpy
jmp 0x1400a838f
test r12, r12
je 0x1400a8532
mov r15d, dword [0x140174b98]
mov rcx, r12
test r15d, r15d
jne 0x1400a86a0
call fcn.1400a4c70
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_wcscpy
cmp qword [rsp + 0xd98], 0
je 0x1400a8565
mov r13d, dword [0x140174b98]
mov rcx, qword [rsp + 0xd98]
test r13d, r13d
jne 0x1400a8690
call fcn.1400a4c70
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_wcscpy
cmp qword [rsp + 0xdb0], 0
je 0x1400a8598
mov r12d, dword [0x140174b98]
mov rcx, qword [rsp + 0xdb0]
test r12d, r12d
jne 0x1400a8680
call fcn.1400a4c70
mov rdx, rax
mov rcx, r14
call sub.msvcrt.dll_wcscpy
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x20], r14
mov r9, rdi
mov r8d, esi
mov rbx, rdi
call fcn.1400a5b10
test esi, esi
mov r12, rax
mov rax, qword [rsp + 0x38]
lea rbp, [rdi + rax*8]
jle 0x1400a85d9
nop dword [rax + rax]
mov rcx, qword [rbx]
add rbx, 8
call sub.msvcrt.dll_free
cmp rbp, rbx
jne 0x1400a85c8
mov rcx, rdi
call sub.msvcrt.dll_free
test r12, r12
je 0x1400a8422
mov ebx, dword [0x140174b98]
mov rcx, r12
test ebx, ebx
jne 0x1400a8640
call fcn.1400a4f10
mov rdx, rax
lea rbx, [0x14087d660]
mov rcx, rbx
call sub.msvcrt.dll_strcpy
mov r11d, dword [0x140174b98]
test r11d, r11d
je 0x1400a87d0
mov rcx, qword [0x14087f6a0]
call sub.msvcrt.dll_free
mov qword [0x14087f6a0], 0
jmp 0x1400a838f
call fcn.1400a5010
mov rdx, rax
jmp 0x1400a85ff
lea r8, [0x1401a3334]
mov rdx, rbx
mov rcx, r12
call fcn.1400a7310
test rax, rax
je 0x1400a8820
mov rdx, rax
mov rcx, rbx
call sub.msvcrt.dll_strcpy
jmp 0x1400a838f
call fcn.1400a4d30
mov rdx, rax
jmp 0x1400a8590
call fcn.1400a4d30
mov rdx, rax
jmp 0x1400a855d
call fcn.1400a4d30
mov rdx, rax
jmp 0x1400a8528
lea rcx, [0x1401a34a7]
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x1400a7ff8
jmp 0x1400a80ef
lea rdi, [rsp + 0x40]
mov rax, r12
xor edx, edx
mov ecx, 0x20
mov qword [rsp + 0x30], rdi
mov r8d, 0x800
rep stosq qword [rdi], rax
lea rbp, [rsp + 0x540]
lea r14, [rsp + 0x140]
mov rcx, rbp
call sub.msvcrt.dll_memset
mov rdi, r14
mov rax, r12
mov ecx, 0x20
rep stosq qword [rdi], rax
movsxd rax, esi
lea rcx, [rax*8]
mov qword [rsp + 0x38], rax
call sub.msvcrt.dll_malloc
test esi, esi
mov rdi, rax
jg 0x1400a807d
jmp 0x1400a8532
call fcn.1400a3b20
test eax, eax
je 0x1400a7fd9
jmp 0x1400a80ef
movabs rax, 0x20656c7469742d2d
mov rdx, r12
mov byte [rsp + 0x14f], 0x22
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x147], rax
call sub.msvcrt.dll_strcpy
mov rcx, r14
call sub.msvcrt.dll_strlen
mov r10d, 0x2022
add rax, r14
mov word [rax], r10w
mov byte [rax + 2], 0
jmp 0x1400a8159
mov edx, 0x5c
mov rcx, rbx
call sub.msvcrt.dll_strrchr
test rax, rax
mov r8, rax
jne 0x1400a83b5
mov byte [rsp + 0x540], 0
lea rbp, [rsp + 0x540]
jmp 0x1400a83ef
mov rcx, qword [0x14087f6a8]
call sub.msvcrt.dll_free
mov qword [0x14087f6a8], 0
jmp 0x1400a838f
mov byte [0x14087d660], 0
jmp 0x1400a84f2
movabs rax, 0x73776f646e6977
mov qword [0x14087c220], rax
mov eax, 1
jmp 0x1400a8424
mov byte [0x14087d660], 0
xor eax, eax
jmp 0x1400a8424
lea rbp, [rsp + 0x540]
mov r8d, 0x400
xor edx, edx
lea r14, [rsp + 0x140]
mov rcx, rbp
call sub.msvcrt.dll_memset
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x140], rax
jmp 0x1400a8159
lea rax, [r14 + rbx + 0x64]
mov ecx, 0x2f2e
mov word [rax], cx
mov byte [rax + 2], 0
jmp 0x1400a828c
movabs rax, 0x706e696369736162
mov qword [0x14087c220], rax
xor eax, eax
mov dword [0x14087c227], 0x747570
jmp 0x1400a8424
mov dword [0x14087c220], 0x6c616964
xor eax, eax
mov dword [0x14087c223], 0x676f6c
jmp 0x1400a8424
mov rcx, rbp
call sub.msvcrt.dll_remove
xor eax, eax
jmp 0x1400a8424