Function at 0x1400a9be0
Capabilities:
Delete file
Execute command
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd48
mov eax, dword [0x14087f624]
mov byte [0x140880660], 0
test eax, eax
mov r12, rcx
mov qword [rsp + 0xd98], rdx
mov esi, r8d
mov r13, r9
jne 0x1400a9d20
lea rcx, str.SSH_CLIENT
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400a9c38
mov eax, dword [0x14087f620]
test eax, eax
je 0x1400aa2f0
test r12, r12
je 0x1400aa310
lea rdx, str.tinyfd_query
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400aa440
xor ebx, ebx
mov ecx, 0x20
xor edx, edx
lea rdi, [rsp + 0x40]
mov rax, rbx
mov r8d, 0x800
lea rbp, [rsp + 0x540]
mov qword [rsp + 0x30], rdi
rep stosq qword [rdi], rax
lea r14, [rsp + 0x140]
mov rcx, rbp
call sub.msvcrt.dll_memset
mov rdi, r14
mov rax, rbx
mov ecx, 0x20
rep stosq qword [rdi], rax
movsxd rax, esi
lea rcx, [rax*8]
mov qword [rsp + 0x38], rax
call sub.msvcrt.dll_malloc
test esi, esi
mov rdi, rax
jle 0x1400aa14d
xor ebx, ebx
jmp 0x1400a9d05
call fcn.1400a6970
mov r15, rax
mov rcx, r15
call sub.msvcrt.dll_wcslen
lea rcx, [rax*8 + 8]
call sub.msvcrt.dll_malloc
test rax, rax
mov rcx, rax
mov qword [rdi + rbx*8], rax
je 0x1400a9cf9
mov rdx, r15
call sub.msvcrt.dll_wcscpy
add rbx, 1
cmp esi, ebx
jle 0x1400aa148
mov eax, dword [0x140176b98]
mov rcx, qword [r13 + rbx*8]
test eax, eax
jne 0x1400a9cc8
call fcn.1400a68b0
mov r15, rax
jmp 0x1400a9cd0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400aa380
call fcn.1400a5760
test eax, eax
je 0x1400aa080
test r12, r12
je 0x1400aa470
lea rdx, str.tinyfd_query
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400aa4e8
lea rbp, [rsp + 0x540]
xor edx, edx
mov r8d, 0x400
lea r14, [rsp + 0x140]
mov rcx, rbp
call sub.msvcrt.dll_memset
cmp byte [r12], 0
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x140], rax
jne 0x1400aa398
movabs rdi, 0x69746b6361622d2d
mov rcx, r14
movabs rsi, 0x4e4f20444c454946
call sub.msvcrt.dll_strlen
mov r8d, 0x594c
cmp qword [rsp + 0xd98], 0
mov r9d, 0x2022
mov rbx, rax
lea rax, [r14 + rax]
mov qword [rax], rdi
movabs rdi, 0x2220656c7469746b
mov qword [rax + 5], rdi
lea rax, [r14 + rbx + 0xd]
movabs rdi, 0x636f66203a626174
mov qword [rax], rdi
movabs rdi, 0x203a2f207c207375
mov qword [rax + 8], rdi
movabs rdi, 0x6574616c75706f70
mov qword [rax + 0x10], rdi
movabs rdi, 0x6563617073207c20
mov qword [rax + 0x18], rdi
movabs rdi, 0x6c6966203a726162
mov qword [rax + 0x20], rdi
movabs rdi, 0x662074786574206c
mov qword [rax + 0x28], rdi
movabs rdi, 0x6f207c20646c6569
mov qword [rax + 0x30], rdi
movabs rdi, 0x2054584554203a6b
mov qword [rax + 0x38], rdi
movabs rdi, 0x63656c6573662d2d
mov qword [rax + 0x40], rsi
mov word [rax + 0x48], r8w
lea rax, [r14 + rbx + 0x59]
mov word [r14 + rbx + 0x57], r9w
mov qword [rax], rdi
mov dword [rax + 8], 0x222074
je 0x1400a9eb6
mov rax, qword [rsp + 0xd98]
cmp byte [rax], 0
je 0x1400a9eb6
mov rcx, rbp
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbp
jmp 0x1400a9ea7
mov byte [rax], 0x2f
lea rcx, [rax + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400a9ea0
mov edx, 0x2f
mov rcx, rbp
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1400aa4b0
movabs rsi, 0x3220303620302022
mov rdx, rbp
mov rcx, r14
call sub.msvcrt.dll_strcat
mov rcx, r14
movabs rdi, 0x2e6466796e69745c
call sub.msvcrt.dll_strlen
mov edx, 0x3e
lea rcx, str.TEMP
add rax, r14
mov qword [rax], rsi
lea rbx, [0x140880660]
mov word [rax + 8], dx
call sub.msvcrt.dll_getenv
mov rcx, rbp
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rdx, rbp
mov rcx, r14
add rax, rbp
mov qword [rax], rdi
mov dword [rax + 8], 0x747874
call sub.msvcrt.dll_strcat
mov rcx, r14
call sub.msvcrt.dll_system
lea rdx, [0x1401a55c2]
mov rcx, rbp
call sub.msvcrt.dll_fopen
test rax, rax
mov rsi, rax
je 0x1400aa503
nop dword [rax + rax]
mov r8, rsi
mov edx, 0x400
mov rcx, rbx
call sub.msvcrt.dll_fgets
test rax, rax
jne 0x1400a9f68
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rcx, rbp
call sub.msvcrt.dll_remove
lea rcx, [0x140880660]
jmp 0x1400a9fa7
mov byte [rax], 0x5c
lea rcx, [rax + 1]
mov edx, 0x2f
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400a9fa0
mov rdx, rbx
mov rcx, r14
call fcn.1400a5ee0
cmp byte [rsp + 0x140], 0
je 0x1400aa062
cmp byte [0x140880660], 0
je 0x1400aa062
mov edx, 0x2f
mov rcx, rbx
call sub.msvcrt.dll_strrchr
test rax, rax
mov r8, rax
je 0x1400aa3e0
lea rbp, [rsp + 0x540]
mov rsi, r8
mov rdx, rbx
sub rsi, rbx
mov rcx, rbp
mov r8, rsi
call sub.msvcrt.dll_strncpy
mov byte [rsp + rsi + 0x540], 0
cmp byte [rsp + 0x540], 0
je 0x1400aa02f
mov rcx, rbp
call fcn.1400a6a40
test eax, eax
je 0x1400aa062
mov rdx, rbx
mov rcx, rbp
call fcn.1400a5ee0
cmp byte [rsp + 0x540], 0
je 0x1400aa062
lea rdx, str._:____
mov rcx, rbp
call sub.msvcrt.dll_strpbrk
mov rdx, rax
lea rax, [0x140880660]
test rdx, rdx
je 0x1400aa064
xor eax, eax
add rsp, 0xd48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r12, r12
je 0x1400aa09c
lea rdx, str.tinyfd_query
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400aa4c6
movabs rax, 0x6c69662065766153
mov edx, 0x400
mov qword [0x140880660], rax
lea rcx, [0x140880260]
movabs rax, 0x206e6920656c69
lea rbx, [0x140880660]
mov qword [0x140880666], rax
call sub.msvcrt.dll__getcwd
mov rcx, rbx
mov rdx, rax
call sub.msvcrt.dll_strcat
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a8f50
test rax, rax
mov rsi, rax
je 0x1400aa290
lea rbp, [rsp + 0x540]
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_strcpy
lea r8, [0x1401a56c4]
mov rdx, rbx
mov rcx, r12
call fcn.1400a8f50
test rax, rax
je 0x1400aa430
mov rdx, rax
mov rcx, rbx
call sub.msvcrt.dll_strcpy
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_strcpy
jmp 0x1400a9fcf
test r12, r12
je 0x1400aa172
mov r15d, dword [0x140176b98]
mov rcx, r12
test r15d, r15d
jne 0x1400aa2e0
call fcn.1400a68b0
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_wcscpy
cmp qword [rsp + 0xd98], 0
je 0x1400aa1a5
mov r13d, dword [0x140176b98]
mov rcx, qword [rsp + 0xd98]
test r13d, r13d
jne 0x1400aa2d0
call fcn.1400a68b0
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_wcscpy
cmp qword [rsp + 0xdb0], 0
je 0x1400aa1d8
mov r12d, dword [0x140176b98]
mov rcx, qword [rsp + 0xdb0]
test r12d, r12d
jne 0x1400aa2c0
call fcn.1400a68b0
mov rdx, rax
mov rcx, r14
call sub.msvcrt.dll_wcscpy
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x20], r14
mov r9, rdi
mov r8d, esi
mov rbx, rdi
call fcn.1400a7750
test esi, esi
mov r12, rax
mov rax, qword [rsp + 0x38]
lea rbp, [rdi + rax*8]
jle 0x1400aa219
nop dword [rax + rax]
mov rcx, qword [rbx]
add rbx, 8
call sub.msvcrt.dll_free
cmp rbp, rbx
jne 0x1400aa208
mov rcx, rdi
call sub.msvcrt.dll_free
test r12, r12
je 0x1400aa062
mov ebx, dword [0x140176b98]
mov rcx, r12
test ebx, ebx
jne 0x1400aa280
call fcn.1400a6b50
mov rdx, rax
lea rbx, [0x140880660]
mov rcx, rbx
call sub.msvcrt.dll_strcpy
mov r11d, dword [0x140176b98]
test r11d, r11d
je 0x1400aa410
mov rcx, qword [0x1408826a0]
call sub.msvcrt.dll_free
mov qword [0x1408826a0], 0
jmp 0x1400a9fcf
call fcn.1400a6c50
mov rdx, rax
jmp 0x1400aa23f
lea r8, [0x1401a56c4]
mov rdx, rbx
mov rcx, r12
call fcn.1400a8f50
test rax, rax
je 0x1400aa460
mov rdx, rax
mov rcx, rbx
call sub.msvcrt.dll_strcpy
jmp 0x1400a9fcf
call fcn.1400a6970
mov rdx, rax
jmp 0x1400aa1d0
call fcn.1400a6970
mov rdx, rax
jmp 0x1400aa19d
call fcn.1400a6970
mov rdx, rax
jmp 0x1400aa168
lea rcx, [0x1401a5837]
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x1400a9c38
jmp 0x1400a9d2f
lea rdi, [rsp + 0x40]
mov rax, r12
xor edx, edx
mov ecx, 0x20
mov qword [rsp + 0x30], rdi
mov r8d, 0x800
rep stosq qword [rdi], rax
lea rbp, [rsp + 0x540]
lea r14, [rsp + 0x140]
mov rcx, rbp
call sub.msvcrt.dll_memset
mov rdi, r14
mov rax, r12
mov ecx, 0x20
rep stosq qword [rdi], rax
movsxd rax, esi
lea rcx, [rax*8]
mov qword [rsp + 0x38], rax
call sub.msvcrt.dll_malloc
test esi, esi
mov rdi, rax
jg 0x1400a9cbd
jmp 0x1400aa172
call fcn.1400a5760
test eax, eax
je 0x1400a9c19
jmp 0x1400a9d2f
movabs rax, 0x20656c7469742d2d
mov rdx, r12
mov byte [rsp + 0x14f], 0x22
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x147], rax
call sub.msvcrt.dll_strcpy
mov rcx, r14
call sub.msvcrt.dll_strlen
mov r10d, 0x2022
add rax, r14
mov word [rax], r10w
mov byte [rax + 2], 0
jmp 0x1400a9d99
mov edx, 0x5c
mov rcx, rbx
call sub.msvcrt.dll_strrchr
test rax, rax
mov r8, rax
jne 0x1400a9ff5
mov byte [rsp + 0x540], 0
lea rbp, [rsp + 0x540]
jmp 0x1400aa02f
mov rcx, qword [0x1408826a8]
call sub.msvcrt.dll_free
mov qword [0x1408826a8], 0
jmp 0x1400a9fcf
mov byte [0x140880660], 0
jmp 0x1400aa132
movabs rax, 0x73776f646e6977
mov qword [0x14087f220], rax
mov eax, 1
jmp 0x1400aa064
mov byte [0x140880660], 0
xor eax, eax
jmp 0x1400aa064
lea rbp, [rsp + 0x540]
mov r8d, 0x400
xor edx, edx
lea r14, [rsp + 0x140]
mov rcx, rbp
call sub.msvcrt.dll_memset
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x140], rax
jmp 0x1400a9d99
lea rax, [r14 + rbx + 0x64]
mov ecx, 0x2f2e
mov word [rax], cx
mov byte [rax + 2], 0
jmp 0x1400a9ecc
movabs rax, 0x706e696369736162
mov qword [0x14087f220], rax
xor eax, eax
mov dword [0x14087f227], 0x747570
jmp 0x1400aa064
mov dword [0x14087f220], 0x6c616964
xor eax, eax
mov dword [0x14087f223], 0x676f6c
jmp 0x1400aa064
mov rcx, rbp
call sub.msvcrt.dll_remove
xor eax, eax
jmp 0x1400aa064