Function at 0x18005b230
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
lea r12d, [rcx + 0xd]
xor ebx, ebx
mov r14, r9
mov dword [rsp + 0x48], r12d
mov r9, r8
lea r10, [0x180000000]
mov r8d, ecx
mov r15d, ecx
cmp ecx, r12d
lea r11d, [rbx + 2]
mov ecx, dword [rbp + 0x130]
mov r13, rdx
mov dword [rsp + 0x40], ecx
jae 0x18005b6d2
mov rdi, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x78]
mov r8d, 0x61
lea eax, [r15 - 0xc7]
lea edx, [r8 - 0x1e]
cmp eax, 0x29
ja case.default.0x18005b2c6
movzx eax, byte [r10 + rax + 0x5bd48]
mov ecx, dword [r10 + rax*4 + 0x5bd10]
add rcx, r10
jmp rcx
mov r8, qword [r9 + 0x48]
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [r9 + 0x18]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x18005b310
mov rdx, qword [rbp + 0x140]
mov r8, qword [rdx + 0x38]
test r8, r8
je 0x18005b4f1
mov rdx, qword [rdx + 0x48]
lea rcx, str.vim.event.TemplateBeingUpgradedEvent
call r8
mov rcx, qword [rbp - 0x70]
mov r15d, 0xd9
call fcn.180073cf4
jmp case.0x18005b2c6.202
mov rax, qword [rbp + 0x140]
xor edx, edx
mov r8, qword [rax + 0x48]
lea ecx, [rdx + 0xc]
call qword [rax + 0x10]
mov dword [rsp + 0x40], eax
mov ecx, eax
test eax, eax
je case.default.0x18005b2c6
mov rdx, qword [rbp + 0x140]
mov rax, qword [rdx + 0x38]
test rax, rax
je 0x18005b4f1
mov rdx, qword [rdx + 0x48]
lea rcx, str.mUnsupported_compression_version:__d
call rax
mov rcx, qword [rbp - 0x70]
mov r15d, 0xd9
call fcn.180073cf4
jmp case.0x18005b2c6.202
test r9, r9
je 0x18005bcf1
test r13, r13
je 0x18005bcf1
mov rdi, r9
mov rsi, r13
mov ecx, dword [rsp + 0x40]
mov r9, qword [rbp + 0x140]
inc r15d
cmp r15d, r12d
jae 0x18005b6cb
lea r10, [0x180000000]
mov r11d, 2
jmp 0x18005b298
movsxd rcx, dword [r13]
shl rcx, 2
call fcn.180073cfc
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov qword [rbp - 0x70], rax
test rax, rax
jne 0x18005b3ef
mov rax, qword [rdx + 0x38]
test rax, rax
je 0x18005b3d6
mov rdx, qword [rdx + 0x48]
lea rcx, str.UNSIGNEDINTEGER8
call rax
mov rcx, qword [rbp - 0x70]
mov r15d, 0xd9
mov dword [rsp + 0x40], 0xffffffff
call fcn.180073cf4
jmp case.0x18005b2c6.202
mov eax, dword [r13]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x50], eax
mov r9d, 0x81
mov eax, dword [r14 + 0xc]
mov dword [rsp + 0x60], eax
mov eax, dword [r14 + 8]
mov qword [rsp + 0x28], rdx
mov rdx, rcx
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.180043e10
jmp case.0x18005b2c6.202
mov rax, qword [rbp + 0x150]
mov r12d, r11d
cmp dword [rax], 2
jle 0x18005b4ba
mov dword [rsp + 0x50], 0xf
lea r15, [r14 + 0x10]
nop
mov eax, dword [r13]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x60]
mov eax, dword [r15 + 4]
mov edx, 0x56
mov dword [rsp + 0x58], eax
mov eax, dword [r15]
mov qword [rsp + 0x30], r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x60], eax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.18005bdd0
mov dword [rsp + 0x40], eax
test eax, eax
js 0x18005b4ec
mov rax, qword [rbp + 0x150]
inc r12d
mov r9, qword [rbp + 0x140]
add r15, 8
cmp r12d, dword [rax]
jl 0x18005b450
mov r8, qword [r9 + 0x48]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [r9 + 0x18]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x18005b4ec
mov rdx, qword [rbp + 0x140]
mov rax, qword [rdx + 0x38]
test rax, rax
je 0x18005b4ec
mov rdx, qword [rdx + 0x48]
lea rcx, str.d:_tortoisegitextlibgit2_src_tag.c
call rax
mov r12d, dword [rsp + 0x48]
mov rcx, qword [rbp - 0x70]
mov r15d, 0xd9
call fcn.180073cf4
jmp case.0x18005b2c6.202
mov rcx, qword [r9]
mov rdx, qword [r9 + 8]
cmp rcx, rdx
je case.0x18005b2c6.202
nop word [rax + rax]
movzx eax, byte [rcx + 0xc]
cmp al, byte [r13]
je 0x18005b6bb
add rcx, 0x10
cmp rcx, rdx
jne 0x18005b520
jmp case.0x18005b2c6.202
mov r8, qword [r9 + 0x48]
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [r9 + 0x10]
mov rdx, qword [rbp + 0x140]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x18005b582
mov rax, qword [rdx + 0x38]
test rax, rax
je 0x18005b4f1
mov rdx, qword [rdx + 0x48]
lea rcx, str.VMODL_VIM_HOST_SCSI_DISK_EMULATED512
call rax
mov rcx, qword [rbp - 0x70]
mov r15d, 0xd9
call fcn.180073cf4
jmp case.0x18005b2c6.202
mov eax, dword [r13]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x40]
mov eax, dword [r14 + 4]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], eax
mov eax, dword [r14]
mov qword [rsp + 0x30], rdx
mov edx, 0x56
mov dword [rsp + 0x60], eax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 0xe
call fcn.18005bdd0
mov dword [rsp + 0x40], eax
mov ecx, eax
test eax, eax
jns case.default.0x18005b2c6
mov rcx, qword [rbp - 0x70]
mov r15d, 0xd9
call fcn.180073cf4
jmp case.0x18005b2c6.202
cmp rdi, rsi
jae 0x18005b636
movsxd rcx, dword [r14]
lea rax, [rdi + rcx]
cmp rax, rsi
jbe 0x18005b636
dec ecx
movsxd rax, ecx
add rdi, rax
mov dword [r14], ecx
add rsi, rax
test ecx, ecx
js case.0x18005b2c6.202
nop dword [rax + rax]
movzx eax, byte [rdi]
dec rdi
mov byte [rsi], al
dec rsi
sub dword [r14], 1
jns 0x18005b620
jmp case.0x18005b2c6.202
sub dword [r14], 1
js case.0x18005b2c6.202
movzx eax, byte [rdi]
inc rdi
mov byte [rsi], al
inc rsi
sub dword [r14], 1
jns 0x18005b640
jmp case.0x18005b2c6.202
mov dword [rbp - 0x5d], 0x784565
mov dword [rbp - 0x58], 0x6c006f
jmp case.0x18005b2c6.202
movzx eax, word [0x1800a2fa0]
mov word [rbp - 0x63], ax
movzx eax, word [0x1800a0b64]
mov word [rbp - 0x61], r8w
mov word [rbp - 0x60], ax
movzx eax, word [0x1800a2fa4]
mov word [rbp - 0x5e], ax
jmp case.0x18005b2c6.202
mov eax, dword [str.oIni]
mov word [rbp - 0x68], dx
mov dword [rbp - 0x67], eax
movzx eax, byte [0x1800a2fac]
mov byte [rbp - 0x63], al
jmp case.0x18005b2c6.202
mov ecx, ebx
mov dword [rsp + 0x40], ebx
jmp case.default.0x18005b2c6
mov rax, rcx
jmp 0x18005bcf5
mov rax, rbx
jmp 0x18005bcf5
mov r8d, dword [rbp + 0x130]
imul edx, r8d, 0x3f6
mov esi, r8d
mov dword [rsp + 0x48], edx
cmp r8d, edx
ja 0x18005bcf1
mov r12, qword [rbp - 0x78]
mov edi, 0x65
mov r13, qword [rbp - 0x78]
mov r15, qword [rbp - 0x78]
mov r14, qword [rbp - 0x78]
lea r10d, [rdi - 0x64]
cmp esi, 0x122fe
ja 0x18005b8ae
je 0x18005b847
cmp esi, 0x4972
ja 0x18005b759
je 0x18005b74d
mov eax, esi
sub eax, 0xd4
je 0x18005b745
sub eax, 0x1a
je 0x18005b73c
cmp eax, 0x407e
je 0x18005bcf1
jmp 0x18005bccf
mov word [rbp - 0x54], di
jmp 0x18005bccf
mov dword [rbp - 0x78], ecx
jmp 0x18005bccf
mov dword [rbp - 0x52], 0x320033
jmp 0x18005bccf
cmp esi, 0x91f6
je 0x18005b834
cmp esi, 0xda7a
jne 0x18005bccf
mov word [rbp - 0x46], bx
mov edi, 0xe1
nop word [rax + rax]
mov eax, edi
sub eax, 0xe1
je 0x18005b7f9
sub eax, 0x23
je 0x18005b7a6
sub eax, 0x721f
je 0x18005b82b
cmp eax, 0x11e9
je 0x18005b82b
jmp 0x18005b819
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movsxd rcx, eax
sub rcx, 0x471
je 0x18005b7cf
cmp rcx, 0xf
jne 0x18005b7e8
test qword [0x1800d57d0], 0x4000
jmp 0x18005b7da
test qword [0x1800d57d0], 0x100
je 0x18005b7e8
mov rcx, qword [rbp - 0x58]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov r10d, 1
mov edi, 0x104
mov dword [rbp - 0x70], r10d
jmp 0x18005b819
xor r8d, r8d
lea rcx, [rbp - 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
lea rdx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x70], rax
add edi, 0x7242
cmp edi, 0x1c908
jbe 0x18005b780
mov r14, qword [rbp - 0x70]
jmp 0x18005bcc4
mov dword [rbp - 0x4e], 0x64002e
mov dword [rbp - 0x4a], 0x6c006c
jmp 0x18005bccf
mov rax, qword [r9]
lea rcx, [rsp + 0x58]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rbp - 0x40], rbx
mov edx, 0x10e
mov word [rsp + 0x68], r10w
call fcn.1800322b0
mov rdx, qword [rbp + 0x140]
lea r9, [rsp + 0x70]
mov qword [rbp - 0x38], rax
xor r8d, r8d
mov eax, 2
mov word [rsp + 0x70], ax
mov rcx, qword [rdx]
mov edx, 0x10e
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x58]
call fcn.1800322b0
mov qword [rsp + 0x58], rax
jmp 0x18005bcc4
cmp esi, 0x2450e
ja 0x18005ba16
je 0x18005b9e8
cmp esi, 0x16b82
je 0x18005b929
cmp esi, 0x1b406
je 0x18005b8fb
cmp esi, 0x1fc8a
jne 0x18005bccf
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov ecx, 0xda
call fcn.1800207d0
inc eax
cdqe
mov qword [rbp - 0x40], rax
jmp 0x18005bcc4
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x105
call fcn.180034e80
mov r12, rax
jmp 0x18005bcc4
mov eax, 3
lea rcx, [rsp + 0x50]
mov word [rsp + 0x78], ax
xor r8d, r8d
mov rax, qword [r9]
mov edx, 0x10e
lea r9, [rsp + 0x78]
mov qword [rsp + 0x50], rax
call fcn.1800322b0
mov rdi, qword [rbp + 0x140]
lea r9, [rbp - 0x80]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov eax, 4
mov edx, 0x10e
mov word [rbp - 0x80], ax
mov rcx, qword [rdi]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.1800322b0
mov rcx, qword [rdi]
lea r9, [rsp + 0x60]
mov qword [rbp - 0x18], rax
xor edx, edx
mov eax, 5
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
mov word [rsp + 0x60], ax
mov qword [rsp + 0x20], rbx
lea r8d, [rax + 0x23]
call fcn.180068730
cdqe
xor r9d, r9d
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rax, qword [rbp - 0x38]
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
call fcn.180034e80
mov r13, rax
jmp 0x18005bcc4
mov rax, qword [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x105
call fcn.180034e80
mov qword [rbp - 0x28], rax
jmp 0x18005bcc4
cmp esi, 0x28d92
je 0x18005bc9c
cmp esi, 0x2d616
jne 0x18005bccf
lea rdx, str.open
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18005ba94
lea rdx, str.explore
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18005ba94
lea rdx, [0x1800a2fd0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18005ba94
test r12, r12
je 0x18005ba76
cmp qword [rbp - 0x40], 0
jne 0x18005ba94
mov rdx, qword [0x1800bc130]
lea rcx, [rbp - 0x10]
mov r8d, 0xff
mov rdx, qword [rdx]
call fcn.180073af0
jmp 0x18005bc5b
cmp qword [rsp + 0x50], 0xb
jle 0x18005babb
mov rdx, qword [0x1800bc130]
lea rcx, [rbp - 0x10]
mov r8d, 0xff
mov rdx, qword [rdx + 8]
call fcn.180073af0
jmp 0x18005bc5b
mov rbx, qword [rsp + 0x50]
mov edi, 0xd8
mov eax, edi
sub eax, 0xd6
je 0x18005bb3d
sub eax, 1
je 0x18005bb05
cmp eax, 1
jne 0x18005bc4b
mov rax, r12
mov ebx, 0x5c
movzx ecx, word [rax]
cmp cx, 0x2f
jne 0x18005baf2
mov word [rax], bx
mov ecx, ebx
add rax, 2
test cx, cx
jne 0x18005bae4
mov rbx, qword [rsp + 0x50]
jmp 0x18005bc4b
test r15, r15
je 0x18005bb2e
mov rax, r15
mov ebx, 0x5c
movzx ecx, word [rax]
cmp cx, 0x2f
jne 0x18005bb20
mov word [rax], bx
mov ecx, ebx
add rax, 2
test cx, cx
jne 0x18005bb12
mov rbx, qword [rsp + 0x50]
mov edx, 6
xor ecx, ecx
call r14
jmp 0x18005bc4b
mov r9, qword [rbp - 0x28]
mov r8, r12
mov dword [rsp + 0x28], ebx
mov rdx, r13
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [rbp - 0x10], 0
cmp rax, 0x20
jg 0x18005bc4b
add rax, 0xfffffffffffffffe
cmp rax, 0x1e
ja case.0x18005bb8d.4
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x5bda4]
mov ecx, dword [rdx + rax*4 + 0x5bd74]
add rcx, rdx
jmp rcx
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x10]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x18]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x20]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x28]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x30]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x38]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x40]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x48]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x50]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x58]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x60]
jmp 0x18005bc32
mov rax, qword [0x1800bc130]
mov rdx, qword [rax + 0x68]
mov r8d, 0xff
lea rcx, [rbp - 0x10]
call fcn.180073af0
mov edi, 0xd6
mov esi, 0x2d616
dec edi
cmp edi, 0xd5
ja 0x18005bac5
xor ebx, ebx
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18005bc66
mov rdx, qword [rbp + 0x140]
lea r9, [rbp - 0x10]
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
mov r8d, 0xb2
mov rax, qword [rdx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
call fcn.1800395d0
jmp 0x18005bcc4
mov rax, qword [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x105
call fcn.180034e80
mov r15, rax
mov r8d, dword [rbp + 0x130]
mov edx, dword [rsp + 0x48]
mov r9, qword [rbp + 0x140]
mov edi, 0x65
imul ecx, r8d, 0x4e
lea r10d, [rdi - 0x64]
add esi, ecx
mov ecx, dword [rsp + 0x40]
cmp esi, edx
jbe 0x18005b702
mov rax, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x238]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret