Function at 0x1400a88e0
Capabilities:
Delete file
Execute command
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x830
mov eax, dword [0x14087c624]
mov esi, dword [rsp + 0x888]
test eax, eax
mov rbx, rcx
mov rdi, rdx
mov r12d, r8d
mov rbp, r9
jne 0x1400a8a20
lea rcx, str.SSH_CLIENT
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400a892f
mov r11d, dword [0x14087c620]
test r11d, r11d
je 0x1400a8dd0
test rbx, rbx
je 0x1400a894b
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a8e60
mov r8d, r12d
mov dword [rsp + 0x28], esi
mov r9, rbp
mov rdx, rdi
mov rax, qword [rsp + 0x880]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400a64d0
test rax, rax
mov r12, rax
je 0x1400a8eb0
cmp byte [r12], 0
je 0x1400a8eb0
test esi, esi
je 0x1400a8d80
mov edx, 0x7c
mov rcx, r12
call sub.msvcrt.dll_strchr
test rax, rax
mov rbx, rax
je 0x1400a8d80
mov rcx, r12
call sub.msvcrt.dll_strlen
test rax, rax
je 0x1400a8eb0
mov rbp, r12
mov rdi, r12
nop dword [rax]
mov rsi, rbx
mov rdx, rdi
mov rcx, rbp
sub rsi, rdi
mov r8, rsi
add rsi, rbp
call sub.msvcrt.dll_memmove
mov byte [rsi], 0
mov rcx, rbp
call fcn.1400a4e90
test eax, eax
je 0x1400a89ed
mov byte [rsi], 0x7c
lea rbp, [rsi + 1]
lea rdi, [rbx + 1]
mov edx, 0x7c
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
mov rbx, rax
jne 0x1400a89c0
mov rcx, rdi
call fcn.1400a4e90
test eax, eax
jne 0x1400a8e80
mov byte [rbp - 1], 0
jmp 0x1400a8d90
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400a8df0
call fcn.1400a3b20
test eax, eax
je 0x1400a8cb8
test rbx, rbx
je 0x1400a8ec0
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a8f2b
lea rbp, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
lea r12, [rsp + 0x430]
mov rcx, rbp
call sub.msvcrt.dll_memset
cmp byte [rbx], 0
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x430], rax
jne 0x1400a8e08
mov rcx, r12
call sub.msvcrt.dll_strlen
mov r8d, 0x594c
mov r9d, 0x2022
test rdi, rdi
movabs rdx, 0x69746b6361622d2d
mov rbx, rax
lea rax, [r12 + rax]
mov qword [rax], rdx
movabs rdx, 0x2220656c7469746b
mov qword [rax + 5], rdx
lea rax, [r12 + rbx + 0xd]
movabs rdx, 0x636f66203a626174
mov qword [rax], rdx
movabs rdx, 0x203a2f207c207375
mov qword [rax + 8], rdx
movabs rdx, 0x6574616c75706f70
mov qword [rax + 0x10], rdx
movabs rdx, 0x6563617073207c20
mov qword [rax + 0x18], rdx
movabs rdx, 0x6c6966203a726162
mov qword [rax + 0x20], rdx
movabs rdx, 0x662074786574206c
mov qword [rax + 0x28], rdx
movabs rdx, 0x6f207c20646c6569
mov qword [rax + 0x30], rdx
movabs rdx, 0x2054584554203a6b
mov qword [rax + 0x38], rdx
movabs rdx, 0x4e4f20444c454946
mov qword [rax + 0x40], rdx
movabs rdx, 0x63656c6573662d2d
mov word [rax + 0x48], r8w
lea rax, [r12 + rbx + 0x59]
mov word [r12 + rbx + 0x57], r9w
mov qword [rax], rdx
mov dword [rax + 8], 0x222074
je 0x1400a8ba6
cmp byte [rdi], 0
je 0x1400a8ba6
mov rcx, rbp
mov rdx, rdi
call sub.msvcrt.dll_strcpy
mov rcx, rbp
jmp 0x1400a8b97
mov byte [rax], 0x2f
lea rcx, [rax + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400a8b90
mov edx, 0x2f
mov rcx, rbp
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1400a8ef8
movabs rdi, 0x3220303620302022
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edx, 0x3e
lea rcx, str.TEMP
add rax, r12
mov qword [rax], rdi
movabs rdi, 0x2e6466796e69745c
mov word [rax + 8], dx
call sub.msvcrt.dll_getenv
mov rcx, rbp
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rdx, rbp
mov rcx, r12
add rax, rbp
mov qword [rax], rdi
lea rdi, [0x14087ca60]
mov dword [rax + 8], 0x747874
call sub.msvcrt.dll_strcat
mov rcx, r12
call sub.msvcrt.dll_system
lea rdx, [0x1401a3232]
mov rcx, rbp
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
je 0x1400a8f44
nop dword [rax + rax]
mov r8, rbx
mov edx, 0x400
mov rcx, rdi
call sub.msvcrt.dll_fgets
test rax, rax
jne 0x1400a8c58
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rcx, rbp
call sub.msvcrt.dll_remove
lea rcx, [0x14087ca60]
jmp 0x1400a8c97
mov byte [rax], 0x5c
lea rcx, [rax + 1]
mov edx, 0x2f
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400a8c90
lea r12, [0x14087ca60]
jmp 0x1400a8979
test rbx, rbx
je 0x1400a8cd4
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400a8f0e
movabs rax, 0x6c6966206e65704f
mov edx, 0x400
mov qword [0x14087ce60], rax
lea rcx, [0x14087d260]
movabs rax, 0x206d6f72662065
lea rbp, [0x14087ce60]
mov qword [0x14087ce68], rax
call sub.msvcrt.dll__getcwd
mov rcx, rbp
mov rdx, rax
call sub.msvcrt.dll_strcat
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a7310
test rax, rax
mov rdi, rax
je 0x1400a8da8
lea r12, [rsp + 0x430]
mov rdx, rax
mov rcx, r12
call sub.msvcrt.dll_strcpy
lea r8, [0x1401a3334]
mov rdx, rbp
mov rcx, rbx
call fcn.1400a7310
test rax, rax
je 0x1400a8e50
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_strcpy
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_strcpy
lea r12, [0x14087ce60]
jmp 0x1400a8979
mov rcx, r12
call fcn.1400a4e90
test eax, eax
je 0x1400a8eb0
mov rax, r12
add rsp, 0x830
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r8, [0x1401a3334]
mov rdx, rbp
mov rcx, rbx
call fcn.1400a7310
test rax, rax
je 0x1400a8ea8
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_strcpy
jmp 0x1400a8d71
lea rcx, [0x1401a34a7]
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x1400a892f
jmp 0x1400a8a2f
call fcn.1400a3b20
test eax, eax
je 0x1400a890e
jmp 0x1400a8a2f
movabs rax, 0x20656c7469742d2d
mov rdx, rbx
mov byte [rsp + 0x43f], 0x22
lea rcx, [rsp + 0x440]
mov qword [rsp + 0x437], rax
call sub.msvcrt.dll_strcpy
mov rcx, r12
call sub.msvcrt.dll_strlen
mov r10d, 0x2022
add rax, r12
mov word [rax], r10w
mov byte [rax + 2], 0
jmp 0x1400a8a94
mov byte [0x14087ce60], 0
jmp 0x1400a8d66
movabs rax, 0x73776f646e6977
mov r12d, 1
mov qword [0x14087c220], rax
jmp 0x1400a8d90
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, rbp
mov rbx, rax
mov r8, rax
call sub.msvcrt.dll_memmove
mov byte [rbp + rbx], 0
jmp 0x1400a8d90
mov byte [0x14087ce60], 0
nop
xor r12d, r12d
jmp 0x1400a8d90
lea rbp, [rsp + 0x30]
mov r8d, 0x400
xor edx, edx
lea r12, [rsp + 0x430]
mov rcx, rbp
call sub.msvcrt.dll_memset
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x430], rax
jmp 0x1400a8a94
lea rax, [r12 + rbx + 0x64]
mov ecx, 0x2f2e
mov word [rax], cx
mov byte [rax + 2], 0
jmp 0x1400a8bbc
movabs rax, 0x706e696369736162
mov qword [0x14087c220], rax
mov dword [0x14087c227], 0x747570
jmp 0x1400a8eb0
mov dword [0x14087c220], 0x6c616964
mov dword [0x14087c223], 0x676f6c
jmp 0x1400a8eb0
mov rcx, rbp
call sub.msvcrt.dll_remove
jmp 0x1400a8eb0