Function at 0x1800498c0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp + 0x20], rax
movzx r14d, r8b
mov rbx, rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
test rdx, rdx
jne 0x18004990e
xor al, al
jmp 0x18004a01f
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x18004991f
mov al, 1
jmp 0x18004a01f
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov rdi, r15
mov qword [rbp - 0x30], r15
mov byte [rbp - 0x28], al
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
test r14b, r14b
je 0x180049a00
movdqu xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
lea r8d, [rax + 0x46]
lea rdx, str.GlobalRCAV7E47DA93_AF41_4450_90CD_31C78125287D_RTPROTECT_INITIALEVENT
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x30], 1
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180099490
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1800499ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800499e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a048
call fcn.18011e7a4
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov rdi, qword [rbp - 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x180049a21
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.180003950
nop
lea rcx, [rbp - 0x50]
call fcn.180086a30
test al, al
sete sil
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049a88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a04e
call fcn.18011e7a4
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
test sil, sil
je 0x180049b8d
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b69f0
mov ebx, eax
test eax, eax
je 0x180049b86
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x10
lea rdx, str.RTProtect_missed
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x31
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6a40
cmp ebx, 1
jbe 0x180049b34
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6de0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049b74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049b6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a054
call fcn.18011e7a4
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x18004a001
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], r15w
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x48], r15
lea rax, str.Open
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rax, [rbp]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea edx, [rax + 3]
lea rcx, [0x180213e70]
call fcn.1800b69f0
mov ebx, eax
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
test eax, eax
je 0x180049ce3
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xe
lea rdx, str.Call_RTProtect
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x3f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6a40
cmp ebx, 1
jbe 0x180049c91
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6de0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049cd1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049ccc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a05a
call fcn.18011e7a4
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x180049dd7
lea edx, [rax + 2]
lea rcx, [0x180213e70]
call fcn.1800b69f0
mov ebx, eax
test eax, eax
je 0x180049df2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x14
lea rdx, [0x1801a85d0]
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6a40
cmp ebx, 1
jbe 0x180049d7e
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6de0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049dbe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049db9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a060
call fcn.18011e7a4
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x180049fb3
test r14b, r14b
je 0x180049ed5
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180049df9
xor bl, bl
jmp 0x180049fb3
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b69f0
mov ebx, eax
test eax, eax
je 0x180049ed5
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x12
lea rdx, str.Got_initial_events
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x4d
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6a40
cmp ebx, 1
jbe 0x180049e83
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6de0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049ec3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049ebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a066
call fcn.18011e7a4
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b69f0
mov ebx, eax
test eax, eax
je 0x180049fb1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xa
lea rdx, str.Call_leave
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x4f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6a40
cmp ebx, 1
jbe 0x180049f5f
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6de0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049f9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049f9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a06c
call fcn.18011e7a4
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov bl, 1
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x180049fef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049fea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a042
call fcn.18011e7a4
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r15w
test rdi, rdi
je 0x18004a013
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
lea rcx, [rbp - 0x20]
call fcn.1800038d0
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18011e360
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180146974
nop
call fcn.180146974
int3
call fcn.180146974
int3
call fcn.180146974
nop
call fcn.180146974
int3
call fcn.180146974
int3
call fcn.180146974
int3
call fcn.180146974
int3