Function at 0x140002fa0
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Get common file path
Get file attributes
Query environment variable
Set environment variable
Terminate process

Disassembly:
movzx eax, word [pe_dos_header]
ud2
push r15
mov eax, 0xa4d8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140002c40
sub rsp, rax
call fcn.140001c70
mov r9d, 0x40
lea r8, [0x1400061d8]
mov edx, pe_nt_image_headers64
lea rcx, [0x14004a040]
mov dword [rsp + 0xcc], 1
call fcn.1400017e0
xor r10d, r10d
mov r8d, 0x1000
xor ecx, ecx
lea rax, [rsp + 0x64d0]
mov word [rsp + 0x44d0], r10w
mov rdi, rax
mov rdx, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov qword [rsp + 0xb0], rax
call rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003c47
lea rbp, [rsp + 0x84d0]
xor r9d, r9d
mov r8d, 0x1000
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 0xffe
ja 0x14000312c
mov r8d, 4
lea rdx, str.__
mov rcx, rbp
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x140003bf9
lea rdi, [rsp + 0x4d0]
xor eax, eax
mov qword [rsp + 0x60], rdi
add rax, rax
mov r8, rbx
mov rcx, rdi
lea rdx, [rbp + rax]
call sub.msvcrt.dll_wcsncpy
mov word [rdi + rbx*2], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x24d0]
mov rcx, rax
mov qword [rsp + 0xa8], rax
mov rdx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140003148
mov ecx, 2
call qword [fcn.140002cc0]
mov r8, rdi
lea rdx, str.Invalid_executable_path:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rsp + 0x4d0]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_wcscpy
jmp 0x1400030ce
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_wcslen
xor r9d, r9d
mov dword [rsp + 0x98], r9d
mov r12, rax
mov edx, dword [rsp + 0x98]
mov r9d, 0x10000
lea r8, [0x14000a040]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
mov dword [rsp + 0x84d0], eax
test eax, eax
je 0x1400039aa
cmp eax, 0xffff
jg 0x140004293
mov dword [rsp + 0x78], 0
xor edi, edi
mov r13d, 0xffffffff
xor r14d, r14d
mov dword [rsp + 0x74], 0
lea rbp, [rsp + 0x84d0]
lea rsi, [0x14000a040]
jmp 0x1400031d0
mov dword [rsp + 0x74], 1
lea rdx, str.MINIMAL_PATH1
mov rcx, rbp
call fcn.140001940
test eax, eax
jne 0x1400031c8
lea rdx, str.ALLOC_CONSOLE1
mov rcx, rbp
call fcn.140001940
test eax, eax
jne 0x1400032d0
lea rdx, str.SHOW_CONSOLE1
mov rcx, rbp
call fcn.140001940
test eax, eax
jne 0x1400032c0
lea rdx, str.APPEND_QUOTE1
mov rcx, rbp
call fcn.140001940
mov ebx, eax
test eax, eax
jne 0x1400032e0
lea rdx, str.APP_ID
mov rcx, rbp
call fcn.140001940
test eax, eax
je 0x1400032ed
mov edx, 0x20
mov rcx, rsi
call sub.msvcrt.dll_wcschr
mov r15d, dword [rsp + 0x84d0]
mov rdx, rax
sub rdx, rsi
mov rcx, rdx
sar rcx, 1
mov qword [rsp + 0x50], rcx
test rax, rax
je 0x14000337c
mov rcx, rsi
mov qword [rsp + 0x58], rdx
call sub.msvcrt.dll__wcsdup
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, rsi
mov ebx, dword [rsp + 0x50]
mov rdi, rax
mov word [rax + rdx], r8w
lea eax, [r15 - 1]
lea rdx, [rsi + rdx + 2]
sub eax, ebx
mov dword [rsp + 0x84d0], eax
cdqe
lea r8, [rax + rax]
call sub.msvcrt.dll_memmove
jmp 0x1400031d0
mov r13d, 1
jmp 0x1400031d0
mov r14d, 1
jmp 0x1400031d0
mov dword [rsp + 0x78], 1
jmp 0x1400031d0
mov r15d, ebx
movsxd rbx, dword [rsp + 0x84d0]
mov ecx, dword [rsp + 0x98]
xor edx, edx
mov word [rsi + rbx*2], dx
test ecx, ecx
je 0x1400033a9
mov rcx, rsi
mov edx, 0x10000
call fcn.140001500
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
mov rbx, rax
mov r8, rsi
call fcn.140001730
xor edx, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__waccess]
cmp eax, 0xffffffff
jne 0x1400033c0
mov ecx, 2
call qword [fcn.140002cc0]
mov r9, rsi
mov r8, rbx
lea rdx, str.Skipping_command_line__s_n__s_not_found__n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
test rdi, rdi
je 0x14000336f
mov rcx, rdi
call sub.msvcrt.dll_free
add dword [rsp + 0x98], 1
jmp 0x140003160
mov eax, r15d
mov r15d, ebx
lea rdx, [0x14000a04e]
mov rcx, rsi
mov ebx, eax
sub ebx, 7
mov dword [rsp + 0x84d0], ebx
movsxd rbx, ebx
lea r8, [rbx + rbx]
call sub.msvcrt.dll_memmove
jmp 0x1400032f8
mov rdx, qword [rsp + 0x60]
lea rcx, str.EXEPATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x14000330d
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r12d, eax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x88], rax
call rax
mov rcx, rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rdx, rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x90], rax
call rax
cmp dword [rsp + 0xd0], 1
mov qword [rsp + 0x80], rax
jle 0x1400034b8
mov dword [rsp + 0x98], 1
lea rsi, [rax + 8]
xor eax, eax
mov qword [rsp + 0x50], rax
jmp 0x140003457
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x98]
add rsi, 8
add eax, 1
cmp eax, dword [rsp + 0xd0]
jge 0x1400034c8
mov dword [rsp + 0x98], eax
mov rdx, qword [rsi]
lea rcx, str.__no_cd
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140003430
mov rdx, qword [rsi]
lea rcx, str.__cd_to_home
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140003488
mov qword [rsp + 0x50], 1
jmp 0x140003439
mov rdx, qword [rsi]
mov r8d, 5
lea rcx, str.__cd
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x14000375a
mov rax, qword [rsi]
lea rcx, [rax + 0xa]
call sub.msvcrt.dll__wcsdup
mov qword [rsp + 0x50], rax
jmp 0x140003439
xor eax, eax
mov dword [rsp + 0x98], eax
xor eax, eax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x74]
xor eax, 1
test r13d, r13d
mov dword [rsp + 0xb8], eax
mov eax, 0xffffffff
cmovns eax, r13d
mov dword [rsp + 0x74], eax
xor eax, eax
cmp dword [rsp + 0x78], 1
sete al
mov dword [rsp + 0x9c], eax
test rdi, rdi
je 0x140003530
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140003530
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003530
mov rcx, rdi
call rax
test eax, eax
js 0x140004317
mov rcx, qword [rsp + 0x80]
lea rsi, [rsp + 0x44d0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rsp + 0x80], 1
cmp word [rsp + 0x44d0], 0
je 0x1400041f3
cmp dword [section..data], 0
jle 0x140003b99
mov rcx, qword [rsp + 0x58]
lea r8, str.CLANGARM64
mov edx, pe_nt_image_headers64
call fcn.1400017e0
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdi, str.PLINK_PROTOCOL
mov rdx, qword [rsp + 0x58]
lea rcx, str.MSYSTEM
mov qword [rsp + 0xa0], rax
call rax
xor r8d, r8d
xor edx, edx
mov r13, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, rdi
call r13
test eax, eax
je 0x1400041da
xor r8d, r8d
xor edx, edx
lea rcx, str.HOME
call r13
test eax, eax
je 0x1400040da
xor r8d, r8d
xor edx, edx
lea rcx, str.PATH
call r13
lea eax, [rax + rax + 0x8000]
cdqe
mov rcx, rax
mov qword [rsp + 0x78], rax
call sub.msvcrt.dll_malloc
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call sub.msvcrt.dll_wcscpy
cmp dword [rsp + 0xb8], 0
mov r8, qword [rsp + 0x78]
jne 0x1400038fb
lea rdx, str.cmd_
mov rcx, rdi
call fcn.140001450
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov r8, qword [rsp + 0x78]
mov rcx, rdi
shr r8, 1
sub r8d, eax
mov dword [rsp + 0x78], r8d
call sub.msvcrt.dll_wcslen
mov r8d, dword [rsp + 0x78]
lea rcx, str.PATH
lea rdx, [rdi + rax*2]
call r13
mov rdx, rdi
lea rcx, str.PATH
mov rax, qword [rsp + 0xa0]
call rax
mov rcx, rdi
call sub.msvcrt.dll_free
mov rdx, rsi
mov rcx, rbp
call sub.msvcrt.dll_wcscpy
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov r8d, 0xfff
lea rdx, str.etcgit_bash.config
mov rcx, rbp
sub r8, rax
call sub.msvcrt.dll_wcsncat
lea rdx, [0x1400068da]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__wfopen]
mov r13, rax
test rax, rax
je 0x1400037b5
mov qword [rsp + 0x78], rbx
mov rcx, qword [rsp + 0x58]
mov r8, r13
mov edx, 0x400
call sub.msvcrt.dll_fgets
test rax, rax
je 0x1400037a8
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_strlen
test rax, rax
je 0x140003780
lea edx, [rax - 1]
movsxd rbx, eax
movsxd rcx, edx
mov rsi, rbx
cmp byte [rsp + rcx + 0xd0], 0xa
je 0x140003786
mov rax, qword [rsp + 0x58]
mov byte [rsp + rbx + 0xd0], 0
cmp dword [rax], 0x5359534d
jne 0x1400036c8
cmp byte [rax + 4], 0x3d
jne 0x1400036c8
lea rdi, str.MSYS
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x140003cf5
lea rdx, [rsp + 0xd5]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x1400036c8
mov rdx, qword [rsi]
lea rcx, str.__minimal_search_path
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000420b
mov dword [rsp + 0x74], 1
jmp 0x140003439
xor esi, esi
xor ebx, ebx
jmp 0x14000370c
test edx, edx
je 0x140003780
lea esi, [rax - 2]
movsxd rbx, esi
cmp byte [rsp + rbx + 0xd0], 0xd
je 0x14000370c
mov esi, edx
mov rbx, rcx
jmp 0x14000370c
mov rcx, r13
mov rbx, qword [rsp + 0x78]
call sub.msvcrt.dll_fclose
mov eax, dword [rsp + 0x98]
movsxd r13, r12d
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x98], eax
xor ecx, ecx
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0x84d0], ecx
call rax
mov rdx, rbp
mov rsi, rax
mov rcx, rax
mov rax, qword [rsp + 0x90]
call rax
mov rcx, rsi
mov qword [rsp + 0x78], rax
call sub.msvcrt.dll_wcslen
movsxd rdx, dword [rsp + 0x98]
lea rax, [r13 + rax + 0x1001]
add rax, rdx
add rax, rax
mov rcx, rax
mov qword [rsp + 0x88], rax
mov rdi, rax
call sub.msvcrt.dll_malloc
mov r13, rax
test rbx, rbx
je 0x1400040c6
test r15d, r15d
je 0x140003bde
mov qword [rsp + 0x28], rbx
mov r8, qword [rsp + 0x60]
mov rcx, rax
lea r9, [0x14000672e]
mov dword [rsp + 0x20], r12d
lea rdx, str.__s_s___.s
call qword [sym.imp.msvcrt.dll_swprintf]
mov eax, dword [rsp + 0x58]
add eax, 1
cmp eax, dword [rsp + 0x84d0]
jl 0x140003fb7
cmp dword [rsp + 0x98], 0
jne 0x140003f94
cmp dword [rsp + 0x84d0], 1
jg 0x140003bba
mov ebx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x50], 1
je 0x140003f51
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xa8]
mov rdx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140003aa1
mov ecx, 2
call qword [fcn.140002cc0]
mov r8, rsi
lea rdx, str.BUG__fork_bomb_:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x14004a040]
mov rcx, rdi
call fcn.140001450
xor edx, edx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
je 0x140003f0e
xor r8d, r8d
xor edx, edx
lea rcx, str.HOME
call r13
lea rdx, [0x140006874]
mov rcx, rdi
mov dword [rsp + 0xb8], eax
call sub.msvcrt.dll_wcscat
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_wcscat
mov r8, qword [rsp + 0x78]
lea rdx, [0x140006878]
mov rcx, rdi
call fcn.140001450
cmp dword [rsp + 0xb8], 0xff9
jg 0x14000362d
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov r8d, dword [rsp + 0xb8]
lea rcx, str.HOME
lea rdx, [rdi + rax*2]
call r13
mov r8, qword [rsp + 0x78]
lea rdx, str.bin_
mov rcx, rdi
call fcn.140001450
jmp 0x14000362d
cmp dword [rsp + 0x98], 0
jne 0x1400043a0
mov rax, qword [rsp + 0x60]
lea rbx, str.git_lfs.exe
mov rdx, rbx
lea rdi, [rax + r12*2 + 2]
mov rcx, rdi
call sub.msvcrt.dll__wcsicmp
mov dword [rsp + 0x9c], eax
test eax, eax
jne 0x140003d66
mov rdx, qword [rsp + 0x60]
lea rsi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rsi
call fcn.140001a20
mov rdi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rdi
call fcn.140001450
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140001450
xor r8d, r8d
mov dword [rsp + 0x74], 0xffffffff
xor r14d, r14d
xor ebx, ebx
mov qword [rsp + 0x50], r8
mov r15d, 1
or r12d, 0xffffffff
mov dword [rsp + 0xb8], 1
mov dword [rsp + 0x80], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rbp, [rsp + 0x84d0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x90], rax
jmp 0x140003551
lea rdi, [rsp + 0xd0]
xor eax, eax
mov ecx, 6
lea rdx, [rsp + 0x84d4]
mov qword [rsp + 0x58], rdi
rep stosd dword [rdi], eax
mov ecx, 0x19
mov rdi, rdx
rep stosd dword [rdi], eax
mov dword [rsp + 0x84d0], 0x68
test r14d, r14d
jne 0x140003c66
cmp dword [rsp + 0x74], 0
jle 0x14000422d
mov edx, 1
mov ecx, 0x410
mov eax, 5
mov dword [rsp + 0x850c], edx
mov word [rsp + 0x8510], ax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov rcx, qword [rsp + 0x68]
mov rdx, r13
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov eax, r14d
xor eax, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140003cd1
test ebx, ebx
jne 0x140003ca5
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140003c8c
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call sub.msvcrt.dll_free
mov ecx, dword [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x58]
mov r9d, 0x40
mov edx, pe_nt_image_headers64
lea r8, str.MINGW_d
call fcn.1400017e0
jmp 0x140003583
mov rax, qword [rsp + 0x78]
lea rdx, [0x14000693e]
mov rcx, qword [rax + 8]
call sub.msvcrt.dll_wcscmp
mov ebx, eax
test eax, eax
jne 0x140003898
jmp 0x14000389f
mov r9, rbx
mov r8d, r12d
lea rdx, str._.s
mov rcx, rax
call qword [sym.imp.msvcrt.dll_swprintf]
jmp 0x140003868
lea rcx, [rsp + 0x84d8]
mov r8d, 4
lea rdx, str.UNC_
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140003d4f
lea rcx, [rsp + 0x4d0]
mov eax, 7
mov word [rsp + 0x4d0], 0x5c
lea rdi, [rsp + 0x4d2]
mov qword [rsp + 0x60], rcx
sub rbx, rax
jmp 0x1400030b5
lea rax, [rsp + 0x4d0]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_wcscpy
jmp 0x1400030d7
cmp dword [rsp + 0x74], 0xffffffff
mov ecx, 0x410
je 0x140003b06
mov eax, dword [rsp + 0x74]
mov edx, 1
neg eax
sbb ax, ax
and eax, 5
jmp 0x140003af7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_reading_exit_code
mov edx, eax
call fcn.140001890
jmp 0x140003b76
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov edx, 1
call rbx
mov rcx, qword [rsp + 0xd0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
xor ecx, ecx
call rbx
jmp 0x140003b58
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_launching_git
mov edx, eax
call fcn.140001890
mov dword [rsp + 0xcc], 1
jmp 0x140003b84
lea ecx, [rsi + rax - 3]
mov dword [rsp + 0xb8], eax
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
lea rdx, [rsp + 0xd5]
mov rsi, rax
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov r8d, dword [rsp + 0xb8]
lea rdx, [rsi + rbx - 4]
mov rcx, rdi
mov byte [rsi + rbx - 5], 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x1400036c8
lea rdi, [rsp + 0x4d0]
mov eax, 4
mov qword [rsp + 0x60], rdi
jmp 0x140003c3f
lea rdx, str.scalar.exe
mov rcx, rdi
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x1400043c4
lea rdx, str.git_gui.exe
mov rcx, rdi
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140003da7
lea rdx, str.gitk.exe
mov rcx, rdi
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140004425
mov rdx, qword [rsp + 0x60]
lea rsi, [rsp + 0x44d0]
mov r8d, 1
lea rbx, [0x1400061ca]
mov rcx, rsi
call fcn.140001a20
mov r15, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, r15
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, r15
call fcn.140001450
mov r8d, 0x1000
lea rdx, str.wish.exe
mov rcx, r15
call fcn.140001450
mov rcx, rdi
call sub.msvcrt.dll_wcslen
lea rdx, str.gitk
mov rcx, rdi
mov word [rdi + rax*2 - 8], 0
call sub.msvcrt.dll__wcsicmp
mov rcx, r15
test eax, eax
lea rax, str.libexecgit_core
cmovne rbx, rax
xor edx, edx
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
je 0x1400044bf
lea rcx, [0x14004a040]
call sub.msvcrt.dll_wcslen
mov qword [rsp + 0x38], rbx
lea rbx, [0x14004a040]
mov r9, qword [rsp + 0x68]
sub rax, 4
mov qword [rsp + 0x30], rbx
lea rbx, [0x14002a040]
lea r8, str.__s____s_.s_s_
mov qword [rsp + 0x28], rax
mov edx, 0x10000
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.1400017e0
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rbx
xor r14d, r14d
call fcn.140001450
mov rcx, rbx
xor r13d, r13d
xor r15d, r15d
call sub.msvcrt.dll_wcslen
mov r8d, 0xffff
mov rcx, rbx
lea rdx, [0x1400066be]
sub r8, rax
call sub.msvcrt.dll_wcsncat
mov rcx, rbx
lea rbx, [0x14002a040]
call sub.msvcrt.dll_wcslen
mov dword [rsp + 0x80], r14d
mov r14d, 1
mov r12d, eax
xor eax, eax
mov dword [rsp + 0x9c], r13d
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x74], 0xffffffff
mov dword [rsp + 0xb8], 1
jmp 0x140003a69
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov r8, qword [rsp + 0x78]
mov rcx, rdi
lea rdx, str.bin_
call fcn.140001450
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_wcscat
mov r8, qword [rsp + 0x78]
lea rdx, str.mingw_bin_
mov rcx, rdi
call fcn.140001450
jmp 0x14000362d
lea rdi, str.HOME
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rsi
mov r12d, eax
test eax, eax
je 0x1400038b6
movsxd rcx, eax
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r8d, r12d
mov rcx, rdi
mov qword [rsp + 0x50], rax
mov rdx, rax
call rsi
jmp 0x1400038b6
lea rdx, [rdi + 2]
mov rcx, r13
call sub.msvcrt.dll_realloc
lea rdx, [0x14000693a]
mov rcx, rax
mov r13, rax
call sub.msvcrt.dll_wcscat
jmp 0x14000388a
mov edx, 0x20
mov rcx, r13
call sub.msvcrt.dll_wcschr
mov r12, rax
test rsi, rsi
je 0x140002f90
movzx edx, word [rsi]
test dx, dx
je 0x140004067
mov r15, qword [sym.imp.msvcrt.dll_isspace]
xor ebx, ebx
mov dword [rsp + 0x60], ebx
test rbx, rbx
jne 0x140004091
lea rax, [rsi + 2]
cmp dx, 0x22
cmove rsi, rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + rbx*8]
call sub.msvcrt.dll_wcslen
lea rsi, [rsi + rax*2]
movzx eax, word [rsi]
cmp ax, 0x22
jne 0x140004021
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14000403d
jmp 0x14000405d
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
je 0x140004047
movzx ecx, ax
call r15
test eax, eax
je 0x140004030
movzx edx, word [rsi]
mov ecx, dword [rsp + 0x58]
add rbx, 1
cmp dword [rsp + 0x60], ecx
jge 0x14000405d
test dx, dx
jne 0x140003fe5
cmp word [rsi], 0x20
je 0x14000468e
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rcx, r13
lea rdi, [rdi + rax*2]
mov rdx, rdi
call sub.msvcrt.dll_realloc
mov rdx, rsi
mov rcx, rax
mov r13, rax
call sub.msvcrt.dll_wcscat
jmp 0x14000387c
mov qword [rsp + 0x90], rbp
mov rbp, rdi
mov rdi, rbx
jmp 0x1400040a5
add rsi, 2
movzx ecx, word [rsi]
mov ebx, ecx
call r15
test eax, eax
jne 0x1400040a1
mov edx, ebx
mov rbx, rdi
mov rdi, rbp
mov rbp, qword [rsp + 0x90]
jmp 0x140003ff2
lea rdx, [0x14000672e]
mov rcx, rax
call sub.msvcrt.dll_wcscpy
jmp 0x140003868
xor r8d, r8d
xor edx, edx
lea rcx, str.HOMEPATH
call r13
mov edi, eax
test eax, eax
je 0x14000417e
lea r9, str.HOMEDRIVE
xor r8d, r8d
xor edx, edx
mov rcx, r9
call r13
mov dword [rsp + 0x78], edi
lea ecx, [rdi + rax]
mov dword [rsp + 0xbc], eax
add rcx, rcx
call sub.msvcrt.dll_malloc
lea r9, str.HOMEDRIVE
mov r8d, dword [rsp + 0xbc]
mov rcx, r9
mov rdi, rax
mov rdx, rax
call r13
lea rcx, str.HOMEPATH
mov r8d, dword [rsp + 0x78]
mov eax, eax
add rax, rax
lea rdx, [rdi + rax]
call r13
mov edx, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000471a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004176
test al, 0x10
jne 0x1400041b9
mov rcx, rdi
call sub.msvcrt.dll_free
xor r8d, r8d
xor edx, edx
lea rcx, str.USERPROFILE
call r13
test eax, eax
je 0x1400035d8
movsxd rcx, eax
mov dword [rsp + 0x78], eax
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r8d, dword [rsp + 0x78]
lea rcx, str.USERPROFILE
mov rdi, rax
mov rdx, rax
call r13
mov rax, qword [rsp + 0xa0]
mov rdx, rdi
lea rcx, str.HOME
call rax
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x1400035d8
mov rax, qword [rsp + 0xa0]
lea rdx, [0x140006810]
mov rcx, rdi
call rax
jmp 0x1400035c1
mov rdx, qword [rsp + 0x60]
mov r8d, 0xfffffffc
mov rcx, rsi
call fcn.140001a20
jmp 0x140003560
mov rdx, qword [rsi]
lea rcx, str.__no_minimal_search_path
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004330
xor eax, eax
mov dword [rsp + 0x74], eax
jmp 0x140003439
xor edx, edx
lea rcx, str.CONOUT_
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov edx, 0x40000000
mov r8d, 2
mov dword [rsp + 0x20], 3
call rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x1400042b7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x400
cmp dword [rsp + 0x74], 0xffffffff
je 0x140003b06
mov edx, dword [rsp + 0x850c]
xor eax, eax
or edx, 1
jmp 0x140003af7
mov ecx, 2
call qword [fcn.140002cc0]
lea rdx, str.Could_not_read_resource__too_large__n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
test rax, rax
je 0x140004378
mov qword [rsp + 0x8520], rax
mov ecx, 0xfffffff5
call rsi
test rax, rax
je 0x14000436f
mov qword [rsp + 0x8528], rax
mov ecx, 0xfffffff4
call rsi
test rax, rax
je 0x14000434e
mov qword [rsp + 0x8530], rax
mov ecx, 0x8000400
mov dword [rsp + 0x850c], 0x100
jmp 0x140004277
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.warning:_could_not_set_app_ID
mov edx, eax
call fcn.140001890
jmp 0x140003530
mov rdx, qword [rsi]
lea rcx, str.__needs_console
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004354
mov r14d, 1
jmp 0x140003439
or rax, 0xffffffffffffffff
jmp 0x1400042fa
mov rdx, qword [rsi]
lea rcx, str.__no_needs_console
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004381
xor r14d, r14d
jmp 0x140003439
or rax, 0xffffffffffffffff
jmp 0x1400042e6
or rax, 0xffffffffffffffff
jmp 0x1400042ce
mov rdx, qword [rsi]
lea rcx, str.__hide
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004813
xor r13d, r13d
jmp 0x140003439
mov ecx, 2
call qword [fcn.140002cc0]
lea rdx, str.Need_a_valid_command_line__Edit_the_string_resources_accordingly_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov rdx, qword [rsp + 0x60]
lea rsi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rsi
call fcn.140001a20
mov rbx, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rbx
call fcn.140001450
mov r8d, 0x1000
mov rdx, rdi
mov rcx, rbx
call fcn.140001450
xor r9d, r9d
mov dword [rsp + 0x9c], r9d
jmp 0x140003a34
lea rdx, str.git_remote_http.exe
mov rcx, rdi
call sub.msvcrt.dll__wcsicmp
mov r15d, eax
test eax, eax
jne 0x140004511
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
xor ebp, ebp
xor r12d, r12d
xor r14d, r14d
or r13, 0xffffffffffffffff
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov rcx, rbx
xor ebx, ebx
mov r8d, 0x1000
lea rdx, str.git_remote_https.exe
call fcn.140001450
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [rsp + 0x58], ebp
lea rbp, [rsp + 0x84d0]
mov qword [rsp + 0x50], r12
or r12d, 0xffffffff
mov qword [rsp + 0x88], rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [rsp + 0x74], 0xffffffff
mov dword [rsp + 0x80], 1
mov qword [rsp + 0x90], rax
jmp 0x1400037d1
mov r15, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, r15
call sub.msvcrt.dll_wcscpy
mov rcx, r15
mov r8d, 0x1000
lea rdx, str.mingw_binwish.exe
call fcn.140001450
mov qword [rsp + 0x28], rbx
mov r9, r15
lea rbx, [0x14002a040]
mov qword [rsp + 0x20], rsi
lea r8, str.__s____smingw_s_
mov edx, 0x10000
mov rcx, rbx
call fcn.1400017e0
jmp 0x140003e8d
mov r8d, 4
lea rdx, str.git_
mov rcx, rdi
call sub.msvcrt.dll__wcsnicmp
mov dword [rsp + 0x58], eax
test eax, eax
jne 0x1400045e5
lea rbx, [rdi + 8]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rdx, str..exe
lea r12d, [rax - 4]
mov rsi, rax
movsxd r13, r12d
lea rcx, [r13 + r13]
add rcx, rdi
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140004567
lea r12d, [rsi - 8]
movsxd r13, r12d
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
xor esi, esi
xor r14d, r14d
mov r15d, 1
lea rbp, [rsp + 0x84d0]
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
xor edi, edi
mov r8d, 0x1000
lea rdx, [0x14000672e]
call fcn.140001450
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [rsp + 0x98], esi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x88], rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [rsp + 0x74], 0xffffffff
mov dword [rsp + 0x80], 1
mov qword [rsp + 0x90], rax
jmp 0x1400037d1
lea rbx, [0x14000672e]
mov rcx, rdi
mov rdx, rbx
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140004733
mov rdx, qword [rsp + 0x60]
lea rsi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rsi
call fcn.140001a20
mov rdi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rdi
call fcn.140001450
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140001450
xor edx, edx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
jne 0x140004415
mov rbx, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, str.bingit.exe
mov rcx, rbx
call fcn.140001450
jmp 0x140004415
lea rdx, [0x140006910]
mov rcx, rsi
call sub.msvcrt.dll_wcsspn
cmp word [rsi + rax*2], 0x22
jne 0x140004067
mov rax, r12
sub rax, r13
cmp rax, 0xe
jle 0x140004067
lea rcx, [r12 - 0x10]
mov r8d, 0xd
lea rdx, [0x140006914]
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140004067
mov rdi, qword [rsp + 0x88]
mov rcx, r13
add rdi, 6
mov rdx, rdi
call sub.msvcrt.dll_realloc
mov rcx, rax
mov r13, rax
call sub.msvcrt.dll_wcslen
lea rcx, [r13 + rax*2 - 2]
cmp word [rcx], 0x22
je 0x140004835
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0x20
je 0x140004708
jmp 0x140004067
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__wcsicmp_1]
test eax, eax
jne 0x140004164
jmp 0x140004176
lea rdx, str.sh.exe
mov rcx, rdi
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140004765
lea rdx, str.ash.exe
mov rcx, rdi
lea rsi, [rsp + 0x44d0]
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140004415
lea rcx, [0x1400061d2]
lea rdi, str.busybox.exe
call sub.msvcrt.dll_wcslen
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov r12, rax
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
mov rdx, rdi
mov rcx, rbx
call fcn.140001450
xor edx, edx
mov rsi, qword [sym.imp.msvcrt.dll__waccess]
mov rcx, rbx
call rsi
add eax, 1
je 0x140004846
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r10d, r10d
xor r11d, r11d
xor r14d, r14d
mov dword [rsp + 0x58], r10d
xor r15d, r15d
lea rbx, [0x1400061d2]
lea rbp, [rsp + 0x84d0]
mov qword [rsp + 0x88], rax
movsxd r13, r12d
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x74], 0xffffffff
mov dword [rsp + 0x80], 1
mov qword [rsp + 0x90], rax
jmp 0x1400037d1
mov rdx, qword [rsi]
lea rcx, str.__no_hide
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400048d0
mov r13d, 1
jmp 0x140003439
lea rdx, str._
call sub.msvcrt.dll_wcscpy
jmp 0x140004708
mov rdx, qword [rsp + 0x60]
lea rbp, [rsp + 0x44d0]
mov r8d, 0xfffffffc
mov rcx, rbp
call fcn.140001a20
mov rbx, qword [rsp + 0x68]
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rbx
call fcn.140001450
mov r8d, 0x1000
mov rdx, rdi
mov rcx, rbx
call fcn.140001450
xor edx, edx
mov rcx, rbx
call rsi
add eax, 1
jne 0x1400047b5
mov ecx, 2
call qword [fcn.140002cc0]
mov r8, qword [rsp + 0x68]
lea rdx, str.Could_not_find__ls_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov rdx, qword [rsi]
lea rcx, str.__append_quote
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400048f0
mov dword [rsp + 0x78], 1
jmp 0x140003439
mov rdx, qword [rsi]
lea rcx, str.__no_append_quote
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004910
mov dword [rsp + 0x78], 0xffffffff
jmp 0x140003439
mov rdx, qword [rsi]
mov r8d, 0xa
lea rcx, str.__command
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14000495e
mov rdx, qword [rsi]
mov r8d, 9
lea rcx, str.__app_id
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x1400049ad
mov rcx, rdi
call sub.msvcrt.dll_free
mov rax, qword [rsi]
lea rcx, [rax + 0x12]
call sub.msvcrt.dll__wcsdup
mov rdi, rax
jmp 0x140003439
mov rax, qword [rsi]
lea rcx, [rax + 0x14]
mov qword [rsi], rcx
call sub.msvcrt.dll_wcslen
mov rcx, qword [rsi]
mov rdx, rax
call fcn.140001500
mov rbx, rax
cmp rax, qword [rsi]
jne 0x14000498b
mov rcx, rax
call sub.msvcrt.dll__wcsdup
mov rbx, rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.140001730
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r12d, eax
jmp 0x1400034c8
sub dword [rsp + 0x98], 1
jmp 0x1400034c8