Function at 0x1800498b0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp + 0x20], rax
movzx r14d, r8b
mov rbx, rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
test rdx, rdx
jne 0x1800498fe
xor al, al
jmp 0x18004a00f
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x18004990f
mov al, 1
jmp 0x18004a00f
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov rdi, r15
mov qword [rbp - 0x30], r15
mov byte [rbp - 0x28], al
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
test r14b, r14b
je 0x1800499f0
movdqu xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
lea r8d, [rax + 0x46]
lea rdx, str.GlobalRCAV7E47DA93_AF41_4450_90CD_31C78125287D_RTPROTECT_INITIALEVENT
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x30], 1
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180099480
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1800499da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800499d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a038
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov rdi, qword [rbp - 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x180049a11
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.180003950
nop
lea rcx, [rbp - 0x50]
call fcn.180086a20
test al, al
sete sil
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049a78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049a73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a03e
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
test sil, sil
je 0x180049b7d
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b69e0
mov ebx, eax
test eax, eax
je 0x180049b76
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x10
lea rdx, str.RTProtect_missed
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x31
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6a30
cmp ebx, 1
jbe 0x180049b24
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6dd0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049b64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049b5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a044
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x180049ff1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], r15w
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x48], r15
lea rax, str.Open
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rax, [rbp]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea edx, [rax + 3]
lea rcx, [0x180213e70]
call fcn.1800b69e0
mov ebx, eax
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
test eax, eax
je 0x180049cd3
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xe
lea rdx, str.Call_RTProtect
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x3f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6a30
cmp ebx, 1
jbe 0x180049c81
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6dd0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049cc1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049cbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a04a
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x180049dc7
lea edx, [rax + 2]
lea rcx, [0x180213e70]
call fcn.1800b69e0
mov ebx, eax
test eax, eax
je 0x180049de2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x14
lea rdx, [0x1801a85d0]
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6a30
cmp ebx, 1
jbe 0x180049d6e
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6dd0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049dae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049da9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a050
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x180049fa3
test r14b, r14b
je 0x180049ec5
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180049de9
xor bl, bl
jmp 0x180049fa3
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b69e0
mov ebx, eax
test eax, eax
je 0x180049ec5
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x12
lea rdx, str.Got_initial_events
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x4d
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6a30
cmp ebx, 1
jbe 0x180049e73
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6dd0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049eb3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049eae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a056
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b69e0
mov ebx, eax
test eax, eax
je 0x180049fa1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xa
lea rdx, str.Call_leave
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x4f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6a30
cmp ebx, 1
jbe 0x180049f4f
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6dd0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049f8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049f8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a05c
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov bl, 1
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x180049fdf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049fda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a032
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r15w
test rdi, rdi
je 0x18004a003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
lea rcx, [rbp - 0x20]
call fcn.1800038d0
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18011e330
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180146944
nop
call fcn.180146944
int3
call fcn.180146944
int3
call fcn.180146944
nop
call fcn.180146944
int3
call fcn.180146944
int3
call fcn.180146944
int3
call fcn.180146944
int3