Function at 0x140002f70
Capabilities:
Accept command line arguments
Check if file exists
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Get file attributes
Query environment variable
Set environment variable
Terminate process

Disassembly:
movzx eax, word [pe_dos_header]
ud2
push r15
mov eax, 0xa4d8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140002c10
sub rsp, rax
xor ebx, ebx
call fcn.140001c60
mov r9d, 0x40
lea r8, [0x1400061d8]
mov edx, pe_nt_image_headers64
lea rcx, [0x14004a040]
mov dword [rsp + 0xcc], 1
call fcn.1400017e0
lea rax, [rsp + 0x64d0]
xor ecx, ecx
mov r8d, 0x1000
mov rdi, rax
mov rdx, rax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x44d0], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov qword [rsp + 0xb0], rax
call rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003bcc
lea r14, [rsp + 0x84d0]
xor r9d, r9d
mov r8d, 0x1000
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 0xffe
ja 0x1400030f9
mov r8d, 4
lea rdx, [0x1400061f0]
mov rcx, r14
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x140003b7e
lea rdi, [rsp + 0x4d0]
xor eax, eax
mov qword [rsp + 0x60], rdi
add rax, rax
mov r8, rbx
mov rcx, rdi
lea rdx, [r14 + rax]
call sub.msvcrt.dll_wcsncpy
mov word [rdi + rbx*2], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x24d0]
mov rcx, rax
mov qword [rsp + 0xa8], rax
mov rdx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140003115
mov ecx, 2
call qword [fcn.140002c90]
mov r8, rdi
lea rdx, str.Invalid_executable_path:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rsp + 0x4d0]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_wcscpy
jmp 0x14000309b
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_wcslen
xor r11d, r11d
mov dword [rsp + 0x7c], r11d
mov rdi, rax
mov edx, dword [rsp + 0x7c]
mov r9d, 0x10000
lea r8, [0x14000a040]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
mov dword [rsp + 0x84d0], eax
test eax, eax
je 0x140003922
cmp eax, 0xffff
jg 0x14000420d
mov dword [rsp + 0x70], 0
xor r12d, r12d
mov r15d, 0xffffffff
xor r13d, r13d
mov dword [rsp + 0x78], 0
lea r14, [rsp + 0x84d0]
lea rsi, [0x14000a040]
jmp 0x140003198
mov dword [rsp + 0x78], 1
lea rdx, str.MINIMAL_PATH1
mov rcx, r14
call fcn.1400018b0
test eax, eax
jne 0x140003190
lea rdx, str.ALLOC_CONSOLE1
mov rcx, r14
call fcn.1400018b0
test eax, eax
jne 0x140003290
lea rdx, str.SHOW_CONSOLE1
mov rcx, r14
call fcn.1400018b0
test eax, eax
jne 0x140003280
lea rdx, str.APPEND_QUOTE1
mov rcx, r14
call fcn.1400018b0
mov ebx, eax
test eax, eax
jne 0x1400032a0
lea rdx, str.APP_ID
mov rcx, r14
call fcn.1400018b0
test eax, eax
je 0x1400032ad
mov edx, 0x20
mov rcx, rsi
call sub.msvcrt.dll_wcschr
mov ebp, dword [rsp + 0x84d0]
mov rdx, rax
sub rdx, rsi
mov rcx, rdx
sar rcx, 1
mov qword [rsp + 0x50], rcx
test rax, rax
je 0x140003339
mov rcx, rsi
mov qword [rsp + 0x58], rdx
call sub.msvcrt.dll__wcsdup
mov rdx, qword [rsp + 0x58]
xor r10d, r10d
mov rcx, rsi
mov ebx, dword [rsp + 0x50]
mov r12, rax
mov word [rax + rdx], r10w
lea eax, [rbp - 1]
lea rdx, [rsi + rdx + 2]
sub eax, ebx
mov dword [rsp + 0x84d0], eax
cdqe
lea r8, [rax + rax]
call sub.msvcrt.dll_memmove
jmp 0x140003198
mov r15d, 1
jmp 0x140003198
mov r13d, 1
jmp 0x140003198
mov dword [rsp + 0x70], 1
jmp 0x140003198
mov ebp, ebx
movsxd rbx, dword [rsp + 0x84d0]
mov r9d, dword [rsp + 0x7c]
xor r8d, r8d
mov word [rsi + rbx*2], r8w
test r9d, r9d
je 0x140003364
mov rcx, rsi
mov edx, 0x10000
call fcn.140001500
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
mov rbx, rax
mov r8, rsi
call fcn.140001730
xor edx, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__waccess]
cmp eax, 0xffffffff
jne 0x14000337b
mov ecx, 2
call qword [fcn.140002c90]
mov r9, rsi
mov r8, rbx
lea rdx, str.Skipping_command_line__s_n__s_not_found__n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
test r12, r12
je 0x14000332f
mov rcx, r12
call sub.msvcrt.dll_free
add dword [rsp + 0x7c], 1
jmp 0x14000312a
mov eax, ebp
mov ebp, ebx
lea rdx, [0x14000a04e]
mov rcx, rsi
mov ebx, eax
sub ebx, 7
mov dword [rsp + 0x84d0], ebx
movsxd rbx, ebx
lea r8, [rbx + rbx]
call sub.msvcrt.dll_memmove
jmp 0x1400032b7
mov rdx, qword [rsp + 0x60]
lea rcx, str.EXEPATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1400032cd
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov dword [rsp + 0x80], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x90], rax
call rax
mov rcx, rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rdx, rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x98], rax
call rax
cmp dword [rsp + 0xd0], 1
mov rsi, rax
jle 0x140004231
xor ecx, ecx
mov dword [rsp + 0x7c], 1
lea rdi, [rax + 8]
mov qword [rsp + 0x50], rcx
jmp 0x140003409
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x7c]
add rdi, 8
add eax, 1
cmp eax, dword [rsp + 0xd0]
jge 0x14000346a
mov dword [rsp + 0x7c], eax
mov rdx, qword [rdi]
lea rcx, str.__no_cd
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400033e8
mov rdx, qword [rdi]
lea rcx, str.__cd_to_home
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000343a
mov qword [rsp + 0x50], 1
jmp 0x1400033f1
mov rdx, qword [rdi]
mov r8d, 5
lea rcx, str.__cd
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x1400036eb
mov rax, qword [rdi]
lea rcx, [rax + 0xa]
call sub.msvcrt.dll__wcsdup
mov qword [rsp + 0x50], rax
jmp 0x1400033f1
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x78]
xor eax, 1
mov dword [rsp + 0xb8], eax
xor eax, eax
cmp dword [rsp + 0x70], 1
sete al
mov dword [rsp + 0x78], eax
test r12, r12
je 0x1400034c6
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1400034c6
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400034c6
mov rcx, r12
call rax
test eax, eax
js 0x1400042c3
mov rcx, rsi
lea rdi, [rsp + 0x44d0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rsp + 0x8c], 1
cmp word [rsp + 0x44d0], 0
je 0x14000416f
cmp dword [section..data], 0
jle 0x140003b19
mov rcx, qword [rsp + 0x58]
lea r8, str.CLANGARM64
mov edx, pe_nt_image_headers64
call fcn.1400017e0
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rsi, str.PLINK_PROTOCOL
mov rdx, qword [rsp + 0x58]
lea rcx, str.MSYSTEM
mov qword [rsp + 0xa0], rax
call rax
xor r8d, r8d
xor edx, edx
mov r12, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, rsi
call r12
test eax, eax
je 0x140004156
xor r8d, r8d
xor edx, edx
lea rcx, str.HOME
call r12
test eax, eax
je 0x140004056
xor r8d, r8d
xor edx, edx
lea rcx, str.PATH
call r12
lea eax, [rax + rax + 0x8000]
cdqe
mov rcx, rax
mov qword [rsp + 0x70], rax
call sub.msvcrt.dll_malloc
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_wcscpy
cmp dword [rsp + 0xb8], 0
mov r8, qword [rsp + 0x70]
jne 0x140003873
lea rdx, str.cmd_
mov rcx, rsi
call fcn.140001450
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov r8, qword [rsp + 0x70]
mov rcx, rsi
shr r8, 1
sub r8d, eax
mov dword [rsp + 0x70], r8d
call sub.msvcrt.dll_wcslen
mov r8d, dword [rsp + 0x70]
lea rcx, str.PATH
lea rdx, [rsi + rax*2]
call r12
mov rdx, rsi
lea rcx, str.PATH
mov rax, qword [rsp + 0xa0]
call rax
mov rcx, rsi
call sub.msvcrt.dll_free
mov rdx, rdi
mov rcx, r14
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov r8d, 0xfff
lea rdx, str.etcgit_bash.config
mov rcx, r14
sub r8, rax
call sub.msvcrt.dll_wcsncat
lea rdx, [0x1400068da]
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wfopen]
mov r12, rax
test rax, rax
je 0x140003745
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x58]
mov r8, r12
mov edx, 0x400
call sub.msvcrt.dll_fgets
test rax, rax
je 0x140003738
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_strlen
test rax, rax
je 0x140003710
lea edx, [rax - 1]
movsxd rbx, eax
movsxd rcx, edx
mov rsi, rbx
cmp byte [rsp + rcx + 0xd0], 0xa
je 0x140003716
mov rax, qword [rsp + 0x58]
mov byte [rsp + rbx + 0xd0], 0
cmp dword [rax], 0x5359534d
jne 0x140003659
cmp byte [rax + 4], 0x3d
jne 0x140003659
lea rdi, str.MSYS
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x140003c76
lea rdx, [rsp + 0xd5]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x140003659
mov rdx, qword [rdi]
lea rcx, str.__minimal_search_path
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004187
mov dword [rsp + 0x78], 1
jmp 0x1400033f1
xor esi, esi
xor ebx, ebx
jmp 0x14000369d
test edx, edx
je 0x140003710
lea esi, [rax - 2]
movsxd rbx, esi
cmp byte [rsp + rbx + 0xd0], 0xd
je 0x14000369d
mov esi, edx
mov rbx, rcx
jmp 0x14000369d
mov rcx, r12
mov rbx, qword [rsp + 0x70]
call sub.msvcrt.dll_fclose
xor ecx, ecx
mov rax, qword [rsp + 0x90]
mov dword [rsp + 0x84d0], ecx
call rax
mov rdx, r14
mov rsi, rax
mov rcx, rax
mov rax, qword [rsp + 0x98]
call rax
mov rcx, rsi
mov qword [rsp + 0x58], rax
call sub.msvcrt.dll_wcslen
movsxd rdx, dword [rsp + 0x80]
lea rax, [rdx + rax + 0x1001]
movsxd rdx, dword [rsp + 0x78]
add rax, rdx
add rax, rax
mov rcx, rax
mov qword [rsp + 0x70], rax
mov rdi, rax
call sub.msvcrt.dll_malloc
mov r12, rax
test rbx, rbx
je 0x140004042
test ebp, ebp
je 0x140003b5e
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x28], rbx
lea r9, [0x14000672e]
lea rdx, str.__s_s___.s
mov r8, qword [rsp + 0x60]
mov rcx, r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_swprintf]
mov eax, dword [rsp + 0x88]
cmp eax, dword [rsp + 0x84d0]
jl 0x140003f31
cmp dword [rsp + 0x78], 0
jne 0x140003f0e
cmp dword [rsp + 0x84d0], 1
jg 0x140003b3a
mov ebx, dword [rsp + 0x8c]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x50], 1
je 0x140003ecc
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xa8]
mov rdx, rdi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140003a22
mov ecx, 2
call qword [fcn.140002c90]
mov r8, rdi
lea rdx, str.BUG__fork_bomb_:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x14004a040]
mov rcx, rsi
call fcn.140001450
xor edx, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
je 0x140003e89
xor r8d, r8d
xor edx, edx
lea rcx, str.HOME
call r12
lea rdx, [0x140006874]
mov rcx, rsi
mov dword [rsp + 0xb8], eax
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov r8, qword [rsp + 0x70]
lea rdx, [0x140006878]
mov rcx, rsi
call fcn.140001450
cmp dword [rsp + 0xb8], 0xff9
jg 0x1400035be
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov r8d, dword [rsp + 0xb8]
lea rcx, str.HOME
lea rdx, [rsi + rax*2]
call r12
mov r8, qword [rsp + 0x70]
lea rdx, str.bin_
mov rcx, rsi
call fcn.140001450
jmp 0x1400035be
cmp dword [rsp + 0x7c], 0
jne 0x14000434c
mov rax, qword [rsp + 0x60]
lea rsi, str.git_lfs.exe
mov rdx, rsi
lea rbx, [rax + rdi*2 + 2]
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp
mov r13d, eax
test eax, eax
jne 0x140003ce7
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rdi
call fcn.140001a20
mov rbx, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rbx
call fcn.140001450
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call fcn.140001450
xor eax, eax
mov dword [rsp + 0x78], eax
xor r8d, r8d
or r15d, 0xffffffff
xor ebx, ebx
mov ebp, 1
mov qword [rsp + 0x50], r8
mov dword [rsp + 0xb8], 1
mov dword [rsp + 0x80], 0xffffffff
mov dword [rsp + 0x8c], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r14, [rsp + 0x84d0]
mov dword [rsp + 0x88], 1
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x98], rax
jmp 0x1400034e2
lea rdi, [rsp + 0xd0]
xor eax, eax
mov ecx, 6
lea rdx, [rsp + 0x84d4]
mov qword [rsp + 0x58], rdi
rep stosd dword [rdi], eax
mov ecx, 0x19
mov rdi, rdx
rep stosd dword [rdi], eax
mov dword [rsp + 0x84d0], 0x68
test r13d, r13d
jne 0x140003beb
cmp r15d, 1
jne 0x1400041a9
mov edx, 1
mov ecx, 0x410
mov eax, 5
mov dword [rsp + 0x850c], edx
mov word [rsp + 0x8510], ax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x68]
mov rdx, r12
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov eax, r13d
xor eax, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140003c52
test ebx, ebx
jne 0x140003c26
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140003c0d
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call sub.msvcrt.dll_free
mov ecx, dword [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x58]
mov r9d, 0x40
mov edx, pe_nt_image_headers64
lea r8, str.MINGW_d
call fcn.1400017e0
jmp 0x140003514
mov rax, qword [rsp + 0x58]
lea rdx, [0x14000693e]
mov rcx, qword [rax + 8]
call sub.msvcrt.dll_wcscmp
mov ebx, eax
test eax, eax
jne 0x140003810
jmp 0x140003817
mov r8d, dword [rsp + 0x80]
mov r9, rbx
lea rdx, str._.s
mov rcx, rax
call qword [sym.imp.msvcrt.dll_swprintf]
jmp 0x1400037e3
lea rcx, [rsp + 0x84d8]
mov r8d, 4
lea rdx, str.UNC_
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140003cd0
lea rcx, [rsp + 0x4d0]
mov eax, 7
mov word [rsp + 0x4d0], 0x5c
lea rdi, [rsp + 0x4d2]
mov qword [rsp + 0x60], rcx
sub rbx, rax
jmp 0x140003083
lea rax, [rsp + 0x4d0]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_wcscpy
jmp 0x1400030a4
mov ecx, 0x410
cmp r15d, 0xffffffff
je 0x140003a86
neg r15d
mov edx, 1
sbb ax, ax
and eax, 5
jmp 0x140003a77
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_reading_exit_code
mov edx, eax
call fcn.140001800
jmp 0x140003af6
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov edx, 1
call rbx
mov rcx, qword [rsp + 0xd0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
xor ecx, ecx
call rbx
jmp 0x140003ad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_launching_git
mov edx, eax
call fcn.140001800
mov dword [rsp + 0xcc], 1
jmp 0x140003b04
lea ecx, [rsi + rax - 3]
mov dword [rsp + 0xb8], eax
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
lea rdx, [rsp + 0xd5]
mov rsi, rax
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov r8d, dword [rsp + 0xb8]
lea rdx, [rsi + rbx - 4]
mov rcx, rdi
mov byte [rsi + rbx - 5], 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x140003659
lea rdi, [rsp + 0x4d0]
mov eax, 4
mov qword [rsp + 0x60], rdi
jmp 0x140003bc4
lea rdx, str.scalar.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140004370
lea rdx, str.git_gui.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140003d28
lea rdx, str.gitk.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x1400043d1
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44d0]
mov r8d, 1
lea rsi, [0x1400061ca]
mov rcx, rdi
call fcn.140001a20
mov r15, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, r15
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, r15
call fcn.140001450
mov r8d, 0x1000
lea rdx, str.wish.exe
mov rcx, r15
call fcn.140001450
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rdx, str.gitk
mov rcx, rbx
mov word [rbx + rax*2 - 8], 0
call sub.msvcrt.dll__wcsicmp
mov rcx, r15
test eax, eax
lea rax, str.libexecgit_core
cmovne rsi, rax
xor edx, edx
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
je 0x140004476
lea rcx, [0x14004a040]
call sub.msvcrt.dll_wcslen
mov qword [rsp + 0x38], rsi
lea rsi, [0x14004a040]
mov r9, qword [rsp + 0x68]
sub rax, 4
mov qword [rsp + 0x30], rsi
lea rsi, [0x14002a040]
lea r8, str.__s____s_.s_s_
mov qword [rsp + 0x28], rax
mov edx, 0x10000
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.1400017e0
mov rdx, rbx
mov r8d, 0x10000
mov rcx, rsi
xor r15d, r15d
call fcn.140001450
mov rcx, rsi
xor ebp, ebp
lea rbx, [0x14002a040]
call sub.msvcrt.dll_wcslen
mov r8d, 0xffff
mov rcx, rsi
lea rdx, [0x1400066be]
sub r8, rax
mov r13d, 1
call sub.msvcrt.dll_wcsncat
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov dword [rsp + 0x78], r15d
or r15d, 0xffffffff
mov dword [rsp + 0x80], eax
xor eax, eax
mov dword [rsp + 0x8c], eax
xor eax, eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0xb8], 1
jmp 0x1400039df
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov r8, qword [rsp + 0x70]
mov rcx, rsi
lea rdx, str.bin_
call fcn.140001450
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov r8, qword [rsp + 0x70]
lea rdx, str.mingw_bin_
mov rcx, rsi
call fcn.140001450
jmp 0x1400035be
lea rdi, str.HOME
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rsi
mov ebp, eax
test eax, eax
je 0x14000382e
movsxd rcx, eax
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r8d, ebp
mov rcx, rdi
mov qword [rsp + 0x50], rax
mov rdx, rax
call rsi
jmp 0x14000382e
lea rdx, [rdi + 2]
mov rcx, r12
call sub.msvcrt.dll_realloc
lea rdx, [0x14000693a]
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_wcscat
jmp 0x140003802
mov edx, 0x20
mov rcx, r12
call sub.msvcrt.dll_wcschr
mov rbp, rax
test rsi, rsi
je 0x140002f60
movzx edx, word [rsi]
test dx, dx
je 0x140003fda
xor ebx, ebx
mov dword [rsp + 0x60], ebx
test rbx, rbx
jne 0x140004004
lea rax, [rsi + 2]
cmp dx, 0x22
cmove rsi, rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + rbx*8]
call sub.msvcrt.dll_wcslen
lea rsi, [rsi + rax*2]
movzx eax, word [rsi]
cmp ax, 0x22
jne 0x140003f94
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x140003fad
jmp 0x140003fd0
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
je 0x140003fba
movzx ecx, ax
call qword [sym.imp.msvcrt.dll_isspace]
test eax, eax
je 0x140003fa0
movzx edx, word [rsi]
mov ecx, dword [rsp + 0x7c]
add rbx, 1
cmp dword [rsp + 0x60], ecx
jge 0x140003fd0
test dx, dx
jne 0x140003f58
cmp word [rsi], 0x20
je 0x140004606
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rcx, r12
lea rdi, [rdi + rax*2]
mov rdx, rdi
call sub.msvcrt.dll_realloc
mov rdx, rsi
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_wcscat
jmp 0x1400037f7
mov qword [rsp + 0x80], r14
mov r14, rbp
mov rbp, rdi
mov rdi, rbx
jmp 0x14000401b
add rsi, 2
movzx ecx, word [rsi]
mov ebx, ecx
call qword [sym.imp.msvcrt.dll_isspace]
test eax, eax
jne 0x140004017
mov edx, ebx
mov rbx, rdi
mov rdi, rbp
mov rbp, r14
mov r14, qword [rsp + 0x80]
jmp 0x140003f65
lea rdx, [0x14000672e]
mov rcx, rax
call sub.msvcrt.dll_wcscpy
jmp 0x1400037e3
xor r8d, r8d
xor edx, edx
lea rcx, str.HOMEPATH
call r12
mov esi, eax
test eax, eax
je 0x1400040fa
lea r9, str.HOMEDRIVE
xor r8d, r8d
xor edx, edx
mov rcx, r9
call r12
mov dword [rsp + 0x70], esi
lea ecx, [rsi + rax]
mov dword [rsp + 0xbc], eax
add rcx, rcx
call sub.msvcrt.dll_malloc
lea r9, str.HOMEDRIVE
mov r8d, dword [rsp + 0xbc]
mov rcx, r9
mov rsi, rax
mov rdx, rax
call r12
lea rcx, str.HOMEPATH
mov r8d, dword [rsp + 0x70]
mov eax, eax
add rax, rax
lea rdx, [rsi + rax]
call r12
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000468e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400040f2
test al, 0x10
jne 0x140004135
mov rcx, rsi
call sub.msvcrt.dll_free
xor r8d, r8d
xor edx, edx
lea rcx, str.USERPROFILE
call r12
test eax, eax
je 0x140003569
movsxd rcx, eax
mov dword [rsp + 0x70], eax
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r8d, dword [rsp + 0x70]
lea rcx, str.USERPROFILE
mov rsi, rax
mov rdx, rax
call r12
mov rax, qword [rsp + 0xa0]
mov rdx, rsi
lea rcx, str.HOME
call rax
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x140003569
mov rax, qword [rsp + 0xa0]
lea rdx, [0x140006810]
mov rcx, rsi
call rax
jmp 0x140003552
mov rdx, qword [rsp + 0x60]
mov r8d, 0xfffffffc
mov rcx, rdi
call fcn.140001a20
jmp 0x1400034f1
mov rdx, qword [rdi]
lea rcx, str.__no_minimal_search_path
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400042dc
xor edx, edx
mov dword [rsp + 0x78], edx
jmp 0x1400033f1
xor edx, edx
lea rcx, str.CONOUT_
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov edx, 0x40000000
mov r8d, 2
mov dword [rsp + 0x20], 3
call rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14000424e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x400
test r15d, r15d
jne 0x140003a86
mov edx, dword [rsp + 0x850c]
xor eax, eax
or edx, 1
jmp 0x140003a77
mov ecx, 2
call qword [fcn.140002c90]
lea rdx, str.Could_not_read_resource__too_large__n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov dword [rsp + 0x88], 1
xor eax, eax
mov dword [rsp + 0x7c], eax
xor eax, eax
mov qword [rsp + 0x50], rax
jmp 0x140003471
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
test rax, rax
je 0x140004324
mov qword [rsp + 0x8520], rax
mov ecx, 0xfffffff5
call rsi
test rax, rax
je 0x14000431b
mov qword [rsp + 0x8528], rax
mov ecx, 0xfffffff4
call rsi
test rax, rax
je 0x1400042fa
mov qword [rsp + 0x8530], rax
mov ecx, 0x8000400
mov dword [rsp + 0x850c], 0x100
test r15d, r15d
jne 0x140003a86
mov edx, 0x101
mov ecx, 0x8000400
xor eax, eax
jmp 0x140003a77
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.warning:_could_not_set_app_ID
mov edx, eax
call fcn.140001800
jmp 0x1400034c6
mov rdx, qword [rdi]
lea rcx, str.__needs_console
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004300
mov r13d, 1
jmp 0x1400033f1
or rax, 0xffffffffffffffff
jmp 0x140004291
mov rdx, qword [rdi]
lea rcx, str.__no_needs_console
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000432d
xor r13d, r13d
jmp 0x1400033f1
or rax, 0xffffffffffffffff
jmp 0x14000427d
or rax, 0xffffffffffffffff
jmp 0x140004265
mov rdx, qword [rdi]
lea rcx, str.__hide
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004751
xor r15d, r15d
jmp 0x1400033f1
mov ecx, 2
call qword [fcn.140002c90]
lea rdx, str.Need_a_valid_command_line__Edit_the_string_resources_accordingly_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rdi
call fcn.140001a20
mov rsi, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rsi
call fcn.140001450
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rsi
call fcn.140001450
xor r9d, r9d
xor r13d, r13d
mov dword [rsp + 0x78], r9d
jmp 0x1400039ab
lea rdx, str.git_remote_http.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp
mov ebp, eax
test eax, eax
jne 0x1400044c8
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
xor r12d, r12d
xor r14d, r14d
xor r13d, r13d
or r15d, 0xffffffff
xor ebx, ebx
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, str.git_remote_https.exe
mov rcx, rdi
call fcn.140001450
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x80], 0xffffffff
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r14, [rsp + 0x84d0]
mov dword [rsp + 0x8c], 1
mov dword [rsp + 0x88], 1
mov qword [rsp + 0x90], rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x98], rax
jmp 0x140003745
mov r15, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, r15
call sub.msvcrt.dll_wcscpy
mov rcx, r15
mov r8d, 0x1000
lea rdx, str.mingw_binwish.exe
call fcn.140001450
mov qword [rsp + 0x28], rsi
mov r9, r15
lea rsi, [0x14002a040]
mov qword [rsp + 0x20], rdi
lea r8, str.__s____smingw_s_
mov edx, 0x10000
mov rcx, rsi
call fcn.1400017e0
jmp 0x140003e0e
mov r8d, 4
lea rdx, str.git_
mov rcx, rbx
call sub.msvcrt.dll__wcsnicmp
mov ebp, eax
test eax, eax
jne 0x14000455d
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rdx, str..exe
mov dword [rsp + 0x80], eax
mov rsi, rax
cdqe
add rax, rax
lea rcx, [rbx + rax - 8]
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140004519
lea eax, [rsi - 4]
mov dword [rsp + 0x80], eax
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
xor esi, esi
xor r13d, r13d
or r15d, 0xffffffff
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
xor edi, edi
mov r8d, 0x1000
lea rdx, [0x14000672e]
call fcn.140001450
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x7c], esi
mov qword [rsp + 0x50], rdi
jmp 0x140004435
lea rsi, [0x14000672e]
mov rcx, rbx
mov rdx, rsi
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x1400046a7
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44d0]
mov r8d, 1
mov rcx, rdi
call fcn.140001a20
mov rbx, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, rbx
call fcn.140001450
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call fcn.140001450
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__waccess]
add eax, 1
jne 0x1400043c1
mov rbx, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, str.bingit.exe
mov rcx, rbx
call fcn.140001450
jmp 0x1400043c1
lea rdx, [0x140006910]
mov rcx, rsi
call sub.msvcrt.dll_wcsspn
cmp word [rsi + rax*2], 0x22
jne 0x140003fda
mov rax, rbp
sub rax, r12
cmp rax, 0xe
jle 0x140003fda
lea rcx, [rbp - 0x10]
mov r8d, 0xd
lea rdx, [0x140006914]
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140003fda
mov rdi, qword [rsp + 0x70]
mov rcx, r12
add rdi, 6
mov rdx, rdi
call sub.msvcrt.dll_realloc
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_wcslen
lea rcx, [r12 + rax*2 - 2]
cmp word [rcx], 0x22
je 0x140004773
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0x20
je 0x14000467c
jmp 0x140003fda
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsicmp_1]
test eax, eax
jne 0x1400040e0
jmp 0x1400040f2
lea rdx, str.sh.exe
mov rcx, rbx
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x1400046d9
lea rdx, str.ash.exe
mov rcx, rbx
lea rdi, [rsp + 0x44d0]
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x1400043c1
lea rcx, [0x1400061d2]
lea rdi, str.busybox.exe
call sub.msvcrt.dll_wcslen
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rbx, rax
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rcx, rsi
mov r8d, 0x1000
mov rdx, rdi
call fcn.140001450
xor edx, edx
mov rcx, rsi
mov rsi, qword [sym.imp.msvcrt.dll__waccess]
call rsi
add eax, 1
je 0x140004784
xor r10d, r10d
xor r11d, r11d
mov dword [rsp + 0x80], ebx
xor r13d, r13d
mov dword [rsp + 0x78], r10d
xor ebp, ebp
or r15d, 0xffffffff
lea rbx, [0x1400061d2]
mov qword [rsp + 0x50], r11
jmp 0x140004435
mov rdx, qword [rdi]
lea rcx, str.__no_hide
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000480e
mov r15d, 1
jmp 0x1400033f1
lea rdx, [0x140006930]
call sub.msvcrt.dll_wcscpy
jmp 0x14000467c
mov rdx, qword [rsp + 0x60]
lea rbp, [rsp + 0x44d0]
mov r8d, 0xfffffffc
mov rcx, rbp
call fcn.140001a20
mov r15, qword [rsp + 0x68]
mov rdx, rbp
mov rcx, r15
call sub.msvcrt.dll_wcscpy
mov r8d, 0x1000
lea rdx, [0x14004a040]
mov rcx, r15
call fcn.140001450
mov r8d, 0x1000
mov rdx, rdi
mov rcx, r15
call fcn.140001450
xor edx, edx
mov rcx, r15
call rsi
add eax, 1
jne 0x140004725
mov ecx, 2
call qword [fcn.140002c90]
mov r8, qword [rsp + 0x68]
lea rdx, str.Could_not_find__ls_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov rdx, qword [rdi]
lea rcx, str.__append_quote
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000482e
mov dword [rsp + 0x70], 1
jmp 0x1400033f1
mov rdx, qword [rdi]
lea rcx, str.__no_append_quote
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000484e
mov dword [rsp + 0x70], 0xffffffff
jmp 0x1400033f1
mov rdx, qword [rdi]
mov r8d, 0xa
lea rcx, str.__command
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14000489c
mov rdx, qword [rdi]
mov r8d, 9
lea rcx, str.__app_id
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x1400048fd
mov rcx, r12
call sub.msvcrt.dll_free
mov rax, qword [rdi]
lea rcx, [rax + 0x12]
call sub.msvcrt.dll__wcsdup
mov r12, rax
jmp 0x1400033f1
mov rax, qword [rdi]
lea rcx, [rax + 0x14]
mov qword [rdi], rcx
call sub.msvcrt.dll_wcslen
mov rcx, qword [rdi]
mov rdx, rax
call fcn.140001500
mov rbx, rax
cmp rax, qword [rdi]
jne 0x1400048c9
mov rcx, rax
call sub.msvcrt.dll__wcsdup
mov rbx, rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.140001730
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x88], eax
jmp 0x140003471
sub dword [rsp + 0x7c], 1
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x88], eax
jmp 0x140003471