Function at 0x180049a60
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp + 0x20], rax
movzx r14d, r8b
mov rbx, rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
test rdx, rdx
jne 0x180049aae
xor al, al
jmp 0x18004a1bf
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x180049abf
mov al, 1
jmp 0x18004a1bf
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov rdi, r15
mov qword [rbp - 0x30], r15
mov byte [rbp - 0x28], al
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
test r14b, r14b
je 0x180049ba0
movdqu xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
lea r8d, [rax + 0x46]
lea rdx, str.GlobalRCAV7E47DA93_AF41_4450_90CD_31C78125287D_RTPROTECT_INITIALEVENT
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x30], 1
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1800995f0
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049b8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049b85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a1e8
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov rdi, qword [rbp - 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x180049bc1
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.180003960
nop
lea rcx, [rbp - 0x50]
call fcn.180086b90
test al, al
sete sil
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049c28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049c23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a1ee
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
test sil, sil
je 0x180049d2d
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6b50
mov ebx, eax
test eax, eax
je 0x180049d26
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x10
lea rdx, str.RTProtect_missed
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x31
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6ba0
cmp ebx, 1
jbe 0x180049cd4
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f40
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049d14
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049d0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a1f4
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x18004a1a1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], r15w
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x48], r15
lea rax, str.Open
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rax, [rbp]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea edx, [rax + 3]
lea rcx, [0x180213e70]
call fcn.1800b6b50
mov ebx, eax
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
test eax, eax
je 0x180049e83
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xe
lea rdx, str.Call_RTProtect
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x3f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6ba0
cmp ebx, 1
jbe 0x180049e31
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f40
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049e71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a1fa
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x180049f77
lea edx, [rax + 2]
lea rcx, [0x180213e70]
call fcn.1800b6b50
mov ebx, eax
test eax, eax
je 0x180049f92
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x14
lea rdx, str.Start_service_failed
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6ba0
cmp ebx, 1
jbe 0x180049f1e
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f40
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049f5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049f59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a200
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x18004a153
test r14b, r14b
je 0x18004a075
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180049f99
xor bl, bl
jmp 0x18004a153
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6b50
mov ebx, eax
test eax, eax
je 0x18004a075
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x12
lea rdx, str.Got_initial_events
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x4d
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6ba0
cmp ebx, 1
jbe 0x18004a023
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f40
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18004a063
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a05e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a206
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6b50
mov ebx, eax
test eax, eax
je 0x18004a151
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xa
lea rdx, str.Call_leave
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x4f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6ba0
cmp ebx, 1
jbe 0x18004a0ff
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f40
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18004a13f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a13a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a20c
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov bl, 1
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x18004a18f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a18a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a1e2
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r15w
test rdi, rdi
je 0x18004a1b3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
lea rcx, [rbp - 0x20]
call fcn.1800038e0
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18011e4c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180146ad4
nop
call fcn.180146ad4
int3
call fcn.180146ad4
int3
call fcn.180146ad4
nop
call fcn.180146ad4
int3
call fcn.180146ad4
int3
call fcn.180146ad4
int3
call fcn.180146ad4
int3