Function at 0x1400034e0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rsi, rcx
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
lea r8d, [r12 + 0x60]
lea rdx, str.https:__github.com_git_for_windows_git_releases_download_v2.45.2.windows.1_Git_2.45.2_64_bit.exe
lea rcx, [rbp]
call fcn.140006220
nop
mov r14, qword [rsi + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, r14
cmp rax, 0x11
jb 0x140003cf6
cmp qword [rsi + 0x18], 0xf
jbe 0x140003565
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea r15, [r14 + 0x11]
mov ebx, 0xf
lea rdi, [rbp - 0x60]
movabs rax, 0x8000000000000000
lea ecx, [rbx + 7]
cmp r15, rbx
jbe 0x1400035fe
mov rbx, r15
or rbx, 0xf
cmp rbx, r13
jbe 0x1400035c5
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.140007de0
test rax, rax
je 0x140003c4b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400035fa
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400035e8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ce4
jmp 0x1400035a6
test rcx, rcx
je 0x1400035f7
call fcn.140007de0
mov rdi, rax
jmp 0x1400035fa
mov rdi, r12
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], rbx
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.GitInstaller.exe]
movups xmmword [rdi + r14], xmm0
movzx eax, byte [0x14000a758]
mov byte [rdi + r14 + 0x10], al
mov byte [rdi + r15], 0
mov rax, r13
mov r12, qword [rbp + 0x10]
sub rax, r12
cmp rax, 0x45
jb 0x140003cfc
lea r15, [rbp]
mov rsi, qword [rbp]
mov r13, qword [rbp + 0x18]
cmp r13, 0xf
cmova r15, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r14, [r12 + 0x45]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp r14, rbx
jbe 0x14000370a
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x1400036c4
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140007de0
test rax, rax
je 0x1400036ed
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003705
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400036f4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003cea
jmp 0x1400036a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140003703
call fcn.140007de0
mov rdi, rax
jmp 0x140003705
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [str.powershell__command___New_Object_System.Net.WebClient_.DownloadFile_]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14000a780]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14000a790]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14000a7a0]
movups xmmword [rdi + 0x30], xmm1
mov eax, dword [0x14000a7b0]
mov dword [rdi + 0x40], eax
movzx eax, byte [0x14000a7b4]
mov byte [rdi + 0x44], al
lea rcx, [rdi + 0x45]
mov r8, r12
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 4
lea rdx, str.__
lea rcx, [rsp + 0x40]
call fcn.140005690
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
lea rcx, [rsp + 0x20]
call fcn.140005690
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r8d, [rbx + 3]
lea rdx, [0x14000a75c]
lea rcx, [rbp - 0x80]
call fcn.140005690
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140003875
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003870
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003870
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007e24
movdqa xmm0, xmmword [0x14000ab70]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400038c6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007e24
movdqa xmm0, xmmword [0x14000ab70]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003919
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003914
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003914
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007e24
movdqa xmm0, xmmword [0x14000ab70]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r15, qword [rbp - 0x50]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 1
jb 0x140003d02
lea r12, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r12, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r14, [r15 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x60]
cmp r14, rbx
jbe 0x140003a0e
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400039c8
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140007de0
test rax, rax
je 0x1400039f1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003a09
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400039f8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003cf0
jmp 0x1400039ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140003a07
call fcn.140007de0
mov rdi, rax
jmp 0x140003a09
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
mov byte [rdi], 0x22
lea rcx, [rdi + 1]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 0x14
lea rdx, str.___SILENT__NORESTART
lea rcx, [rsp + 0x60]
call fcn.140005690
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140003ab6
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ab1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ab1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007e24
movdqa xmm0, xmmword [0x14000ab70]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], r14b
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdi, qword [rbp - 0x50]
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rbx, qword [rbp - 0x60]
call fcn.1400074ec
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140001850
nop
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
call fcn.140007b80
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140003cce
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140003b7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007e24
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140003bb9
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007e24
movdqa xmm0, xmmword [0x14000ab70]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140003c08
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007e24
movdqa xmm0, xmmword [0x14000ab70]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140003c57
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007e24
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
cmp r13, 0xf
jbe 0x140003ca1
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003c99
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140007e24
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140007dc0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rdx, 0x20
lea r8, [rsp + 0x20]
lea rcx, str.remove
call fcn.1400028b0
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.1400011a0
nop
call fcn.1400011a0
nop
call fcn.1400011a0
int3