Function at 0x1400aaba0
Capabilities:
Delete file
Execute command
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc28
mov eax, dword [0x14087f624]
test eax, eax
mov rbx, rcx
mov rbp, rdx
jne 0x1400aace0
lea rcx, str.SSH_CLIENT
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1400aabde
mov eax, dword [0x14087f620]
test eax, eax
je 0x1400ab040
test rbx, rbx
je 0x1400ab060
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400ab170
lea rsi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
mov r8d, 0x800
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x420]
mov rcx, rdi
call sub.msvcrt.dll_memset
mov eax, dword [0x140176b98]
test eax, eax
jne 0x1400ab030
mov rcx, rbx
call fcn.1400a68b0
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
test rbp, rbp
je 0x1400aac6f
mov rcx, rbp
mov ebp, dword [0x140176b98]
test ebp, ebp
je 0x1400ab150
call fcn.1400a6970
mov rdx, rax
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, rsi
mov rdx, rdi
call fcn.1400a8370
test rax, rax
mov rcx, rax
je 0x1400aaf23
mov ebx, dword [0x140176b98]
test ebx, ebx
je 0x1400ab140
call fcn.1400a6c50
mov rdx, rax
lea rsi, [0x14087f660]
mov rcx, rsi
call sub.msvcrt.dll_strcpy
cmp byte [0x14087f660], 0
je 0x1400aaf23
mov rcx, rsi
call fcn.1400a6a40
test eax, eax
je 0x1400aaf23
lea rax, [0x14087f660]
add rsp, 0xc28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400ab090
call fcn.1400a5760
test eax, eax
je 0x1400aaf30
test rbx, rbx
je 0x1400ab1a0
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400ab212
cmp byte [rbx], 0
lea rsi, [rsp + 0x20]
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x20], rax
jne 0x1400ab100
movabs rdi, 0x69746b6361622d2d
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov r9d, 0x594c
mov r10d, 0x2022
test rbp, rbp
mov rbx, rax
lea rax, [rsi + rax]
mov qword [rax], rdi
movabs rdi, 0x2220656c7469746b
mov qword [rax + 5], rdi
lea rax, [rsi + rbx + 0xd]
movabs rdi, 0x636f66203a626174
mov qword [rax], rdi
movabs rdi, 0x203a2f207c207375
mov qword [rax + 8], rdi
movabs rdi, 0x6574616c75706f70
mov qword [rax + 0x10], rdi
movabs rdi, 0x6563617073207c20
mov qword [rax + 0x18], rdi
movabs rdi, 0x6c6966203a726162
mov qword [rax + 0x20], rdi
movabs rdi, 0x662074786574206c
mov qword [rax + 0x28], rdi
movabs rdi, 0x6f207c20646c6569
mov qword [rax + 0x30], rdi
movabs rdi, 0x2054584554203a6b
mov qword [rax + 0x38], rdi
movabs rdi, 0x4e4f20444c454946
mov qword [rax + 0x40], rdi
movabs rdi, 0x63656c6573642d2d
mov word [rax + 0x48], r9w
lea rax, [rsi + rbx + 0x59]
mov word [rsi + rbx + 0x57], r10w
mov qword [rax], rdi
mov dword [rax + 8], 0x222074
je 0x1400aae24
cmp byte [rbp], 0
jne 0x1400ab0a8
lea rax, [rsi + rbx + 0x64]
mov ecx, 0x2f2e
mov word [rax], cx
lea rdi, [rsp + 0x420]
mov byte [rax + 2], 0
movabs rbx, 0x3220303620302022
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov edx, 0x3e
lea rcx, str.TEMP
add rax, rsi
mov qword [rax], rbx
movabs rbx, 0x2e6466796e69745c
mov word [rax + 8], dx
call sub.msvcrt.dll_getenv
mov rcx, rdi
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, rsi
add rax, rdi
mov qword [rax], rbx
mov dword [rax + 8], 0x747874
call sub.msvcrt.dll_strcat
mov rcx, rsi
call sub.msvcrt.dll_system
lea rdx, [0x1401a55c2]
mov rcx, rdi
call sub.msvcrt.dll_fopen
lea rsi, [0x14087f660]
test rax, rax
mov rbx, rax
je 0x1400ab22d
nop dword [rax]
mov r8, rbx
mov edx, 0x400
mov rcx, rsi
call sub.msvcrt.dll_fgets
test rax, rax
jne 0x1400aaed0
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rcx, rdi
call sub.msvcrt.dll_remove
lea rcx, [0x14087f660]
jmp 0x1400aaf07
mov byte [rax], 0x5c
lea rcx, [rax + 1]
mov edx, 0x2f
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400aaf00
cmp byte [0x14087f660], 0
jne 0x1400aacb8
xor eax, eax
jmp 0x1400aaccf
test rbx, rbx
je 0x1400aaf4c
lea rdx, str.tinyfd_query
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400ab1f0
movabs rax, 0x66207463656c6553
mov edx, 0x400
mov dword [0x14087f670], 0x206d6f
mov qword [0x14087f660], rax
lea rcx, [0x140880260]
movabs rax, 0x7266207265646c6f
lea rsi, [0x14087f660]
mov qword [0x14087f668], rax
call sub.msvcrt.dll__getcwd
mov rcx, rsi
mov rdx, rax
call sub.msvcrt.dll_strcat
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400a8f50
test rax, rax
mov rbp, rax
je 0x1400ab000
lea rdi, [rsp + 0x420]
mov rdx, rax
mov rcx, rdi
call sub.msvcrt.dll_strcpy
lea r8, [0x1401a56c4]
mov rdx, rsi
mov rcx, rbx
call fcn.1400a8f50
test rax, rax
je 0x1400ab160
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_strcpy
mov rdx, rdi
mov rcx, rbp
call sub.msvcrt.dll_strcpy
jmp 0x1400aacab
lea r8, [0x1401a56c4]
mov rdx, rsi
mov rcx, rbx
call fcn.1400a8f50
test rax, rax
je 0x1400ab190
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_strcpy
jmp 0x1400aacab
mov rcx, rbx
call fcn.1400a6970
mov rdx, rax
jmp 0x1400aac41
lea rcx, [0x1401a5837]
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x1400aabde
jmp 0x1400aacef
lea rsi, [rsp + 0x20]
mov rax, rbx
mov ecx, 0x20
mov rdi, rsi
mov r8d, 0x800
xor edx, edx
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x420]
mov rcx, rdi
call sub.msvcrt.dll_memset
jmp 0x1400aac49
call fcn.1400a5760
test eax, eax
je 0x1400aabbf
jmp 0x1400aacef
lea rdi, [rsp + 0x420]
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_strcpy
cmp byte [rsp + 0x420], 0
jne 0x1400ab1c0
mov rcx, rdi
jmp 0x1400ab0d7
mov byte [rax], 0x2f
lea rcx, [rax + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400ab0d0
lea rcx, [rsi + rbx + 0x64]
mov rdx, rdi
call sub.msvcrt.dll_strcpy
jmp 0x1400aae3d
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov byte [rsp + 0x2f], 0x22
movabs rax, 0x20656c7469742d2d
mov qword [rsp + 0x27], rax
call sub.msvcrt.dll_strcpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov r11d, 0x2022
add rax, rsi
mov word [rax], r11w
mov byte [rax + 2], 0
jmp 0x1400aad39
call fcn.1400a6b50
mov rdx, rax
jmp 0x1400aac9c
call fcn.1400a68b0
mov rdx, rax
jmp 0x1400aac67
mov byte [0x14087f660], 0
jmp 0x1400aafe8
movabs rax, 0x73776f646e6977
mov qword [0x14087f220], rax
mov eax, 1
jmp 0x1400aaccf
mov byte [0x14087f660], 0
xor eax, eax
jmp 0x1400aaccf
movabs rax, 0x20676f6c616964
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x20]
jmp 0x1400aad39
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rbp, [rdi + rax - 1]
cmp byte [rbp], 0x5c
je 0x1400ab0c9
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov r8d, 0x5c
mov word [rbp + rax], r8w
jmp 0x1400ab0c9
movabs rax, 0x706e696369736162
mov qword [0x14087f220], rax
xor eax, eax
mov dword [0x14087f227], 0x747570
jmp 0x1400aaccf
mov dword [0x14087f220], 0x6c616964
xor eax, eax
mov dword [0x14087f223], 0x676f6c
jmp 0x1400aaccf
mov rcx, rdi
call sub.msvcrt.dll_remove
xor eax, eax
jmp 0x1400aaccf