Function at 0x140003080
Capabilities:
Accept command line arguments
Check if file exists
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Get file attributes
Query environment variable
Set environment variable
Terminate process

Disassembly:
movzx eax, word [pe_dos_header]
ud2
push r15
mov eax, 0xa4d8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140002d20
sub rsp, rax
xor ebx, ebx
call fcn.140001d70
mov r9d, 0x40
lea r8, [0x1400061d0]
mov edx, pe_nt_image_headers64
lea rcx, [0x14004a040]
mov dword [rsp + 0xcc], 1
call fcn.1400018e0
lea rax, [rsp + 0x64d0]
xor ecx, ecx
mov r8d, 0x1000
mov rdi, rax
mov rdx, rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x44d0], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov qword [rsp + 0xa8], rax
call rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003ce5
lea r14, [rsp + 0x84d0]
xor r9d, r9d
mov r8d, 0x1000
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 0xffe
ja 0x140003209
mov r8d, 4
lea rdx, str.__
mov rcx, r14
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x140003c9b
lea rdi, [rsp + 0x4d0]
xor eax, eax
mov qword [rsp + 0x60], rdi
add rax, rax
mov r8, rbx
mov rcx, rdi
lea rdx, [r14 + rax]
call sub.msvcrt.dll_wcsncpy
mov word [rdi + rbx*2], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x24d0]
mov rcx, rax
mov qword [rsp + 0xb0], rax
mov rdx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140003225
mov ecx, 2
call qword [fcn.140002db0]
mov r8, rdi
lea rdx, str.Invalid_executable_path:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rsp + 0x4d0]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_wcscpy
jmp 0x1400031ab
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_wcslen
xor r11d, r11d
mov dword [rsp + 0x7c], r11d
mov rdi, rax
mov edx, dword [rsp + 0x7c]
mov r9d, 0x10000
lea r8, [0x14000a040]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
mov dword [rsp + 0x84d0], eax
test eax, eax
je 0x140003a3f
cmp eax, 0xffff
jg 0x14000434d
mov dword [rsp + 0x78], 0
xor r12d, r12d
mov r15d, 0xffffffff
xor r13d, r13d
mov dword [rsp + 0x70], 0
lea r14, [rsp + 0x84d0]
lea rsi, [0x14000a040]
jmp 0x1400032a8
mov dword [rsp + 0x70], 1
lea rdx, str.MINIMAL_PATH1
mov rcx, r14
call fcn.1400019b0
test eax, eax
jne 0x1400032a0
lea rdx, str.ALLOC_CONSOLE1
mov rcx, r14
call fcn.1400019b0
test eax, eax
jne 0x1400033a0
lea rdx, str.SHOW_CONSOLE1
mov rcx, r14
call fcn.1400019b0
test eax, eax
jne 0x140003390
lea rdx, str.APPEND_QUOTE1
mov rcx, r14
call fcn.1400019b0
mov ebx, eax
test eax, eax
jne 0x1400033b0
lea rdx, str.APP_ID
mov rcx, r14
call fcn.1400019b0
test eax, eax
je 0x1400033bd
mov edx, 0x20
mov rcx, rsi
call sub.msvcrt.dll_wcschr
mov ebp, dword [rsp + 0x84d0]
mov rdx, rax
sub rdx, rsi
mov rcx, rdx
sar rcx, 1
mov qword [rsp + 0x50], rcx
test rax, rax
je 0x140003449
mov rcx, rsi
mov qword [rsp + 0x58], rdx
call sub.msvcrt.dll__wcsdup
mov rdx, qword [rsp + 0x58]
xor r10d, r10d
mov rcx, rsi
mov ebx, dword [rsp + 0x50]
mov r12, rax
mov word [rax + rdx], r10w
lea eax, [rbp - 1]
lea rdx, [rsi + rdx + 2]
sub eax, ebx
mov dword [rsp + 0x84d0], eax
cdqe
lea r8, [rax + rax]
call sub.msvcrt.dll_memmove
jmp 0x1400032a8
mov r15d, 1
jmp 0x1400032a8
mov r13d, 1
jmp 0x1400032a8
mov dword [rsp + 0x78], 1
jmp 0x1400032a8
mov ebp, ebx
movsxd rbx, dword [rsp + 0x84d0]
mov r9d, dword [rsp + 0x7c]
xor r8d, r8d
mov word [rsi + rbx*2], r8w
test r9d, r9d
je 0x140003474
mov rcx, rsi
mov edx, 0x10000
call fcn.140001600
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
mov rbx, rax
mov r8, rsi
call fcn.140001830
xor edx, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__waccess]
cmp eax, 0xffffffff
jne 0x14000348b
mov ecx, 2
call qword [fcn.140002db0]
mov r9, rsi
mov r8, rbx
lea rdx, str.Skipping_command_line__s_n__s_not_found__n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
test r12, r12
je 0x14000343f
mov rcx, r12
call sub.msvcrt.dll_free
add dword [rsp + 0x7c], 1
jmp 0x14000323a
mov eax, ebp
mov ebp, ebx
lea rdx, [0x14000a04e]
mov rcx, rsi
mov ebx, eax
sub ebx, 7
mov dword [rsp + 0x84d0], ebx
movsxd rbx, ebx
lea r8, [rbx + rbx]
call sub.msvcrt.dll_memmove
jmp 0x1400033c7
mov rdx, qword [rsp + 0x60]
lea rcx, str.EXEPATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1400033dd
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov dword [rsp + 0x80], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x98], rax
call rax
mov rcx, rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rdx, rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x90], rax
call rax
cmp dword [rsp + 0xd0], 1
mov rsi, rax
jle 0x140004371
xor ecx, ecx
mov dword [rsp + 0x7c], 1
lea rdi, [rax + 8]
mov qword [rsp + 0x50], rcx
jmp 0x140003519
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x7c]
add rdi, 8
add eax, 1
cmp eax, dword [rsp + 0xd0]
jge 0x14000357a
mov dword [rsp + 0x7c], eax
mov rdx, qword [rdi]
lea rcx, str.__no_cd
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400034f8
mov rdx, qword [rdi]
lea rcx, str.__cd_to_home
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000354a
mov qword [rsp + 0x50], 1
jmp 0x140003501
mov rdx, qword [rdi]
mov r8d, 5
lea rcx, str.__cd
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x1400037fb
mov rax, qword [rdi]
lea rcx, [rax + 0xa]
call sub.msvcrt.dll__wcsdup
mov qword [rsp + 0x50], rax
jmp 0x140003501
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x70]
xor eax, 1
mov dword [rsp + 0xb8], eax
xor eax, eax
cmp dword [rsp + 0x78], 1
sete al
mov dword [rsp + 0x78], eax
test r12, r12
je 0x1400035d6
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1400035d6
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400035d6
mov rcx, r12
call rax
test eax, eax
js 0x140004403
mov rcx, rsi
lea rdi, [rsp + 0x44d0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rsp + 0x8c], 1
cmp word [rsp + 0x44d0], 0
je 0x1400042af
cmp dword [0x140005010], 0
jle 0x140003c36
mov rcx, qword [rsp + 0x58]
lea r8, str.ARM64
mov edx, pe_nt_image_headers64
call fcn.1400018e0
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rsi, str.PLINK_PROTOCOL
mov rdx, qword [rsp + 0x58]
lea rcx, str.MSYSTEM
mov qword [rsp + 0xa0], rax
call rax
xor r8d, r8d
xor edx, edx
mov r12, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, rsi
call r12
test eax, eax
je 0x140004296
xor r8d, r8d
xor edx, edx
lea rcx, str.HOME
call r12
test eax, eax
je 0x140004196
xor r8d, r8d
xor edx, edx
lea rcx, str.PATH
call r12
lea eax, [rax + rax + 0x8000]
cdqe
mov rcx, rax
mov qword [rsp + 0x70], rax
call sub.msvcrt.dll_malloc
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_wcscpy
cmp dword [rsp + 0xb8], 0
mov r8, qword [rsp + 0x70]
jne 0x140003983
lea rdx, str.cmd_
mov rcx, rsi
call fcn.140001550
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov r8, qword [rsp + 0x70]
mov rcx, rsi
shr r8, 1
sub r8d, eax
mov dword [rsp + 0x70], r8d
call sub.msvcrt.dll_wcslen
mov r8d, dword [rsp + 0x70]
lea rcx, str.PATH
lea rdx, [rsi + rax*2]
call r12
mov rdx, rsi
lea rcx, str.PATH
mov rax, qword [rsp + 0xa0]
call rax
mov rcx, rsi
call sub.msvcrt.dll_free
mov rdx, rdi
mov rcx, r14
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov r8d, 0xfff
lea rdx, str.etcgit_bash.config
mov rcx, r14
sub r8, rax
call sub.msvcrt.dll_wcsncat
lea rdx, [0x1400068e2]
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wfopen]
mov r12, rax
test rax, rax
je 0x140003855
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x58]
mov r8, r12
mov edx, 0x400
call sub.msvcrt.dll_fgets
test rax, rax
je 0x140003848
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_strlen
test rax, rax
je 0x140003820
lea edx, [rax - 1]
movsxd rbx, eax
movsxd rcx, edx
mov rsi, rbx
cmp byte [rsp + rcx + 0xd0], 0xa
je 0x140003826
mov rax, qword [rsp + 0x58]
mov byte [rsp + rbx + 0xd0], 0
cmp dword [rax], 0x5359534d
jne 0x140003769
cmp byte [rax + 4], 0x3d
jne 0x140003769
lea rdi, str.MSYS
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x140003d18
lea rdx, [rsp + 0xd5]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x140003769
mov rdx, qword [rdi]
lea rcx, str.__minimal_search_path
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400042c7
mov dword [rsp + 0x70], 1
jmp 0x140003501
xor esi, esi
xor ebx, ebx
jmp 0x1400037ad
test edx, edx
je 0x140003820
lea esi, [rax - 2]
movsxd rbx, esi
cmp byte [rsp + rbx + 0xd0], 0xd
je 0x1400037ad
mov esi, edx
mov rbx, rcx
jmp 0x1400037ad
mov rcx, r12
mov rbx, qword [rsp + 0x70]
call sub.msvcrt.dll_fclose
xor ecx, ecx
mov rax, qword [rsp + 0x98]
mov dword [rsp + 0x84d0], ecx
call rax
mov rdx, r14
mov rsi, rax
mov rcx, rax
mov rax, qword [rsp + 0x90]
call rax
mov rcx, rsi
mov qword [rsp + 0x58], rax
call sub.msvcrt.dll_wcslen
movsxd rdx, dword [rsp + 0x80]
lea rax, [rdx + rax + 0x1001]
movsxd rdx, dword [rsp + 0x78]
add rax, rdx
add rax, rax
mov rcx, rax
mov qword [rsp + 0x70], rax
mov rdi, rax
call sub.msvcrt.dll_malloc
mov r12, rax
test rbx, rbx
je 0x140004182
test ebp, ebp
je 0x140003c7b
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x28], rbx
lea r9, [0x140006726]
lea rdx, str.__s_s___.s
mov r8, qword [rsp + 0x60]
mov rcx, r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_swprintf]
mov eax, dword [rsp + 0x88]
cmp eax, dword [rsp + 0x84d0]
jl 0x14000407a
cmp dword [rsp + 0x78], 0
jne 0x140004057
cmp dword [rsp + 0x84d0], 1
jg 0x140003c57
mov ebx, dword [rsp + 0x8c]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x50], 1
je 0x140004015
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xb0]
mov rdx, rdi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140003b3f
mov ecx, 2
call qword [fcn.140002db0]
mov r8, rdi
lea rdx, str.BUG__fork_bomb_:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x14004a040]
mov rcx, rsi
call fcn.140001550
cmp dword [0x140005010], 0
jg 0x140003fe2
xor edx, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
je 0x140003d94
xor r8d, r8d
xor edx, edx
lea rcx, str.HOME
call r12
lea rdx, [0x140006862]
mov rcx, rsi
mov dword [rsp + 0xb8], eax
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov r8, qword [rsp + 0x70]
lea rdx, str.usr_bin_
mov rcx, rsi
call fcn.140001550
cmp dword [rsp + 0xb8], 0xff9
jg 0x1400036ce
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov r8d, dword [rsp + 0xb8]
lea rcx, str.HOME
lea rdx, [rsi + rax*2]
call r12
mov r8, qword [rsp + 0x70]
lea rdx, str.bin_
mov rcx, rsi
call fcn.140001550
jmp 0x1400036ce
cmp dword [rsp + 0x7c], 0
jne 0x14000448c
mov rax, qword [rsp + 0x60]
lea rsi, str.git_lfs.exe
mov rdx, rsi
lea rbx, [rax + rdi*2 + 2]
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp_1
mov r13d, eax
test eax, eax
jne 0x140003e40
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rdi
call fcn.140001b20
mov rbx, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rbx
call fcn.140001550
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call fcn.140001550
xor eax, eax
mov dword [rsp + 0x78], eax
xor r8d, r8d
or r15d, 0xffffffff
xor ebx, ebx
mov ebp, 1
mov qword [rsp + 0x50], r8
mov dword [rsp + 0xb8], 1
mov dword [rsp + 0x80], 0xffffffff
mov dword [rsp + 0x8c], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r14, [rsp + 0x84d0]
mov dword [rsp + 0x88], 1
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x90], rax
jmp 0x1400035f2
lea rdi, [rsp + 0xd0]
xor eax, eax
mov ecx, 6
lea rdx, [rsp + 0x84d4]
mov qword [rsp + 0x58], rdi
rep stosd dword [rdi], eax
mov ecx, 0x19
mov rdi, rdx
rep stosd dword [rdi], eax
mov dword [rsp + 0x84d0], 0x68
test r13d, r13d
jne 0x140003d72
cmp r15d, 1
jne 0x1400042e9
mov edx, 1
mov ecx, 0x410
mov eax, 5
mov dword [rsp + 0x850c], edx
mov word [rsp + 0x8510], ax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x68]
mov rdx, r12
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov eax, r13d
xor eax, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140003e1c
test ebx, ebx
jne 0x140003df0
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140003dd7
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call sub.msvcrt.dll_free
mov ecx, dword [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x58]
mov r9d, 0x40
mov edx, pe_nt_image_headers64
lea r8, str.MINGW_d
call fcn.1400018e0
jmp 0x140003624
mov rax, qword [rsp + 0x58]
lea rdx, [0x140006946]
mov rcx, qword [rax + 8]
call sub.msvcrt.dll_wcscmp
mov ebx, eax
test eax, eax
jne 0x140003920
jmp 0x140003927
mov r8d, dword [rsp + 0x80]
mov r9, rbx
lea rdx, str._.s
mov rcx, rax
call qword [sym.imp.msvcrt.dll_swprintf]
jmp 0x1400038f3
lea rcx, [rsp + 0x84d8]
mov r8d, 4
lea rdx, str.UNC_
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140003d04
lea rcx, [rsp + 0x4d0]
mov eax, 7
mov word [rsp + 0x4d0], 0x5c
lea rdi, [rsp + 0x4d2]
mov qword [rsp + 0x60], rcx
sub rbx, rax
jmp 0x140003193
lea rax, [rsp + 0x4d0]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_wcscpy
jmp 0x1400031b4
lea rdi, [rsp + 0x4d0]
mov eax, 4
mov qword [rsp + 0x60], rdi
jmp 0x140003cdd
lea ecx, [rsi + rax - 3]
mov dword [rsp + 0xb8], eax
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
lea rdx, [rsp + 0xd5]
mov rsi, rax
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov r8d, dword [rsp + 0xb8]
lea rdx, [rsi + rbx - 4]
mov rcx, rdi
mov byte [rsi + rbx - 5], 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x140003769
mov ecx, 0x410
cmp r15d, 0xffffffff
je 0x140003ba3
neg r15d
mov edx, 1
sbb ax, ax
and eax, 5
jmp 0x140003b94
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov r8, qword [rsp + 0x70]
mov rcx, rsi
lea rdx, str.bin_
call fcn.140001550
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov r8, qword [rsp + 0x70]
lea rdx, str.mingw_bin_
mov rcx, rsi
call fcn.140001550
jmp 0x1400036ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_reading_exit_code
mov edx, eax
call fcn.140001900
jmp 0x140003c13
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov edx, 1
call rbx
mov rcx, qword [rsp + 0xd0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
xor ecx, ecx
call rbx
jmp 0x140003bf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_launching_git
mov edx, eax
call fcn.140001900
mov dword [rsp + 0xcc], 1
jmp 0x140003c21
lea rdx, str.scalar.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp_1
test eax, eax
je 0x1400044b0
lea rdx, str.git_gui.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp_1
test eax, eax
je 0x140003e81
lea rdx, str.gitk.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp_1
test eax, eax
jne 0x140004511
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44d0]
mov r8d, 1
lea rsi, [0x1400061c2]
mov rcx, rdi
call fcn.140001b20
mov r15, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, r15
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, r15
call fcn.140001550
mov r8d, 0x1000
lea rdx, str.wish.exe
mov rcx, r15
call fcn.140001550
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rdx, str.gitk
mov rcx, rbx
mov word [rbx + rax*2 - 8], 0
call sub.msvcrt.dll__wcsicmp_1
mov rcx, r15
test eax, eax
lea rax, str.libexecgit_core
cmovne rsi, rax
xor edx, edx
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
je 0x1400045b6
lea rcx, [0x14004a040]
call sub.msvcrt.dll_wcslen
mov qword [rsp + 0x38], rsi
lea rsi, [0x14004a040]
mov r9, qword [rsp + 0x68]
sub rax, 4
mov qword [rsp + 0x30], rsi
lea rsi, [0x14002a040]
lea r8, str.__s____s_.s_s_
mov qword [rsp + 0x28], rax
mov edx, 0x10000
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.1400018e0
mov rdx, rbx
mov r8d, 0x10000
mov rcx, rsi
xor r15d, r15d
call fcn.140001550
mov rcx, rsi
xor ebp, ebp
lea rbx, [0x14002a040]
call sub.msvcrt.dll_wcslen
mov r8d, 0xffff
mov rcx, rsi
lea rdx, [0x1400066b6]
sub r8, rax
mov r13d, 1
call sub.msvcrt.dll_wcsncat
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov dword [rsp + 0x78], r15d
or r15d, 0xffffffff
mov dword [rsp + 0x80], eax
xor eax, eax
mov dword [rsp + 0x8c], eax
xor eax, eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0xb8], 1
jmp 0x140003afc
mov rcx, rsi
lea rdx, [0x140006862]
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov r8, qword [rsp + 0x70]
lea rdx, str.mingw32_bin_
mov rcx, rsi
call fcn.140001550
jmp 0x14000399f
lea rdi, str.HOME
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rsi
mov ebp, eax
test eax, eax
je 0x14000393e
movsxd rcx, eax
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r8d, ebp
mov rcx, rdi
mov qword [rsp + 0x50], rax
mov rdx, rax
call rsi
jmp 0x14000393e
lea rdx, [rdi + 2]
mov rcx, r12
call sub.msvcrt.dll_realloc
lea rdx, [0x140006942]
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_wcscat
jmp 0x140003912
mov edx, 0x20
mov rcx, r12
call sub.msvcrt.dll_wcschr
mov rbp, rax
test rsi, rsi
je 0x140003070
movzx edx, word [rsi]
test dx, dx
je 0x14000411a
xor ebx, ebx
mov dword [rsp + 0x60], ebx
test rbx, rbx
jne 0x140004144
lea rax, [rsi + 2]
cmp dx, 0x22
cmove rsi, rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + rbx*8]
call sub.msvcrt.dll_wcslen
lea rsi, [rsi + rax*2]
movzx eax, word [rsi]
cmp ax, 0x22
jne 0x1400040d9
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x1400040ed
jmp 0x140004110
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
je 0x1400040fa
movzx ecx, ax
call qword [sym.imp.msvcrt.dll_isspace]
test eax, eax
je 0x1400040e0
movzx edx, word [rsi]
mov ecx, dword [rsp + 0x7c]
add rbx, 1
cmp dword [rsp + 0x60], ecx
jge 0x140004110
test dx, dx
jne 0x14000409d
cmp word [rsi], 0x20
je 0x140004746
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rcx, r12
lea rdi, [rdi + rax*2]
mov rdx, rdi
call sub.msvcrt.dll_realloc
mov rdx, rsi
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_wcscat
jmp 0x140003907
mov qword [rsp + 0x80], r14
mov r14, rbp
mov rbp, rdi
mov rdi, rbx
jmp 0x14000415b
add rsi, 2
movzx ecx, word [rsi]
mov ebx, ecx
call qword [sym.imp.msvcrt.dll_isspace]
test eax, eax
jne 0x140004157
mov edx, ebx
mov rbx, rdi
mov rdi, rbp
mov rbp, r14
mov r14, qword [rsp + 0x80]
jmp 0x1400040aa
lea rdx, [0x140006726]
mov rcx, rax
call sub.msvcrt.dll_wcscpy
jmp 0x1400038f3
xor r8d, r8d
xor edx, edx
lea rcx, str.HOMEPATH
call r12
mov esi, eax
test eax, eax
je 0x14000423a
lea r9, str.HOMEDRIVE
xor r8d, r8d
xor edx, edx
mov rcx, r9
call r12
mov dword [rsp + 0x70], esi
lea ecx, [rsi + rax]
mov dword [rsp + 0xbc], eax
add rcx, rcx
call sub.msvcrt.dll_malloc
lea r9, str.HOMEDRIVE
mov r8d, dword [rsp + 0xbc]
mov rcx, r9
mov rsi, rax
mov rdx, rax
call r12
lea rcx, str.HOMEPATH
mov r8d, dword [rsp + 0x70]
mov eax, eax
add rax, rax
lea rdx, [rsi + rax]
call r12
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400047ce
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004232
test al, 0x10
jne 0x140004275
mov rcx, rsi
call sub.msvcrt.dll_free
xor r8d, r8d
xor edx, edx
lea rcx, str.USERPROFILE
call r12
test eax, eax
je 0x140003679
movsxd rcx, eax
mov dword [rsp + 0x70], eax
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r8d, dword [rsp + 0x70]
lea rcx, str.USERPROFILE
mov rsi, rax
mov rdx, rax
call r12
mov rax, qword [rsp + 0xa0]
mov rdx, rsi
lea rcx, str.HOME
call rax
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x140003679
mov rax, qword [rsp + 0xa0]
lea rdx, [0x1400067fe]
mov rcx, rsi
call rax
jmp 0x140003662
mov rdx, qword [rsp + 0x60]
mov r8d, 0xfffffffc
mov rcx, rdi
call fcn.140001b20
jmp 0x140003601
mov rdx, qword [rdi]
lea rcx, str.__no_minimal_search_path
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000441c
xor edx, edx
mov dword [rsp + 0x70], edx
jmp 0x140003501
xor edx, edx
lea rcx, str.CONOUT_
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov edx, 0x40000000
mov r8d, 2
mov dword [rsp + 0x20], 3
call rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14000438e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x400
test r15d, r15d
jne 0x140003ba3
mov edx, dword [rsp + 0x850c]
xor eax, eax
or edx, 1
jmp 0x140003b94
mov ecx, 2
call qword [fcn.140002db0]
lea rdx, str.Could_not_read_resource__too_large__n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov dword [rsp + 0x88], 1
xor eax, eax
mov dword [rsp + 0x7c], eax
xor eax, eax
mov qword [rsp + 0x50], rax
jmp 0x140003581
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
test rax, rax
je 0x140004464
mov qword [rsp + 0x8520], rax
mov ecx, 0xfffffff5
call rsi
test rax, rax
je 0x14000445b
mov qword [rsp + 0x8528], rax
mov ecx, 0xfffffff4
call rsi
test rax, rax
je 0x14000443a
mov qword [rsp + 0x8530], rax
mov ecx, 0x8000400
mov dword [rsp + 0x850c], 0x100
test r15d, r15d
jne 0x140003ba3
mov edx, 0x101
mov ecx, 0x8000400
xor eax, eax
jmp 0x140003b94
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.warning:_could_not_set_app_ID
mov edx, eax
call fcn.140001900
jmp 0x1400035d6
mov rdx, qword [rdi]
lea rcx, str.__needs_console
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004440
mov r13d, 1
jmp 0x140003501
or rax, 0xffffffffffffffff
jmp 0x1400043d1
mov rdx, qword [rdi]
lea rcx, str.__no_needs_console
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000446d
xor r13d, r13d
jmp 0x140003501
or rax, 0xffffffffffffffff
jmp 0x1400043bd
or rax, 0xffffffffffffffff
jmp 0x1400043a5
mov rdx, qword [rdi]
lea rcx, str.__hide
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004891
xor r15d, r15d
jmp 0x140003501
mov ecx, 2
call qword [fcn.140002db0]
lea rdx, str.Need_a_valid_command_line__Edit_the_string_resources_accordingly_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rdi
call fcn.140001b20
mov rsi, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rsi
call fcn.140001550
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rsi
call fcn.140001550
xor r9d, r9d
xor r13d, r13d
mov dword [rsp + 0x78], r9d
jmp 0x140003ac8
lea rdx, str.git_remote_http.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp_1
mov ebp, eax
test eax, eax
jne 0x140004608
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
xor r12d, r12d
xor r14d, r14d
xor r13d, r13d
or r15d, 0xffffffff
xor ebx, ebx
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, str.git_remote_https.exe
mov rcx, rdi
call fcn.140001550
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x80], 0xffffffff
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r14, [rsp + 0x84d0]
mov dword [rsp + 0x8c], 1
mov dword [rsp + 0x88], 1
mov qword [rsp + 0x98], rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x90], rax
jmp 0x140003855
mov r15, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, r15
call sub.msvcrt.dll_wcscpy
mov rcx, r15
mov r8d, 0x1000
lea rdx, str.mingw_binwish.exe
call fcn.140001550
mov qword [rsp + 0x28], rsi
mov r9, r15
lea rsi, [0x14002a040]
mov qword [rsp + 0x20], rdi
lea r8, str.__s____smingw_s_
mov edx, 0x10000
mov rcx, rsi
call fcn.1400018e0
jmp 0x140003f67
mov r8d, 4
lea rdx, str.git_
mov rcx, rbx
call sub.msvcrt.dll__wcsnicmp
mov ebp, eax
test eax, eax
jne 0x14000469d
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rdx, str..exe
mov dword [rsp + 0x80], eax
mov rsi, rax
cdqe
add rax, rax
lea rcx, [rbx + rax - 8]
call sub.msvcrt.dll__wcsicmp_1
test eax, eax
jne 0x140004659
lea eax, [rsi - 4]
mov dword [rsp + 0x80], eax
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
xor esi, esi
xor r13d, r13d
or r15d, 0xffffffff
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
xor edi, edi
mov r8d, 0x1000
lea rdx, [0x140006726]
call fcn.140001550
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x7c], esi
mov qword [rsp + 0x50], rdi
jmp 0x140004575
lea rsi, [0x140006726]
mov rcx, rbx
mov rdx, rsi
call sub.msvcrt.dll__wcsicmp_1
test eax, eax
jne 0x1400047e7
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rdi
call fcn.140001b20
mov rbx, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rbx
call fcn.140001550
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call fcn.140001550
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
jne 0x140004501
mov rbx, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, str.bingit.exe
mov rcx, rbx
call fcn.140001550
jmp 0x140004501
lea rdx, [0x140006918]
mov rcx, rsi
call sub.msvcrt.dll_wcsspn
cmp word [rsi + rax*2], 0x22
jne 0x14000411a
mov rax, rbp
sub rax, r12
cmp rax, 0xe
jle 0x14000411a
lea rcx, [rbp - 0x10]
mov r8d, 0xd
lea rdx, [0x14000691c]
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x14000411a
mov rdi, qword [rsp + 0x70]
mov rcx, r12
add rdi, 6
mov rdx, rdi
call sub.msvcrt.dll_realloc
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_wcslen
lea rcx, [r12 + rax*2 - 2]
cmp word [rcx], 0x22
je 0x1400048b3
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0x20
je 0x1400047bc
jmp 0x14000411a
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140004220
jmp 0x140004232
lea rdx, str.sh.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp_1
test eax, eax
je 0x140004819
lea rdx, str.ash.exe
mov rcx, rbx
lea rdi, [rsp + 0x44d0]
call sub.msvcrt.dll__wcsicmp_1
test eax, eax
jne 0x140004501
lea rcx, [0x1400061ca]
lea rdi, str.busybox.exe
call sub.msvcrt.dll_wcslen
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rbx, rax
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rcx, rsi
mov r8d, 0x1000
mov rdx, rdi
call fcn.140001550
xor edx, edx
mov rcx, rsi
mov rsi, qword [sym.imp.msvcrt.dll__waccess]
call rsi
add eax, 1
je 0x1400048c4
xor r10d, r10d
xor r11d, r11d
mov dword [rsp + 0x80], ebx
xor r13d, r13d
mov dword [rsp + 0x78], r10d
xor ebp, ebp
or r15d, 0xffffffff
lea rbx, [0x1400061ca]
mov qword [rsp + 0x50], r11
jmp 0x140004575
mov rdx, qword [rdi]
lea rcx, str.__no_hide
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000494e
mov r15d, 1
jmp 0x140003501
lea rdx, str._
call sub.msvcrt.dll_wcscpy
jmp 0x1400047bc
mov rdx, qword [rsp + 0x60]
lea rbp, [rsp + 0x44d0]
mov r8d, 0xfffffffc
mov rcx, rbp
call fcn.140001b20
mov r15, qword [rsp + 0x68]
mov rdx, rbp
mov rcx, r15
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, r15
call fcn.140001550
mov r8d, 0x1000
mov rdx, rdi
mov rcx, r15
call fcn.140001550
xor edx, edx
mov rcx, r15
call rsi
add eax, 1
jne 0x140004865
mov ecx, 2
call qword [fcn.140002db0]
mov r8, qword [rsp + 0x68]
lea rdx, str.Could_not_find__ls_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov rdx, qword [rdi]
lea rcx, str.__append_quote
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000496e
mov dword [rsp + 0x78], 1
jmp 0x140003501
mov rdx, qword [rdi]
lea rcx, str.__no_append_quote
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000498e
mov dword [rsp + 0x78], 0xffffffff
jmp 0x140003501
mov rdx, qword [rdi]
mov r8d, 0xa
lea rcx, str.__command
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x1400049dc
mov rdx, qword [rdi]
mov r8d, 9
lea rcx, str.__app_id
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140004a3d
mov rcx, r12
call sub.msvcrt.dll_free
mov rax, qword [rdi]
lea rcx, [rax + 0x12]
call sub.msvcrt.dll__wcsdup
mov r12, rax
jmp 0x140003501
mov rax, qword [rdi]
lea rcx, [rax + 0x14]
mov qword [rdi], rcx
call sub.msvcrt.dll_wcslen
mov rcx, qword [rdi]
mov rdx, rax
call fcn.140001600
mov rbx, rax
cmp rax, qword [rdi]
jne 0x140004a09
mov rcx, rax
call sub.msvcrt.dll__wcsdup
mov rbx, rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.140001830
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x88], eax
jmp 0x140003581
sub dword [rsp + 0x7c], 1
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x88], eax
jmp 0x140003581