Function at 0x180046360
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180201020]
xor rax, rsp
mov qword [rbp + 0x20], rax
movzx r14d, r8b
mov rbx, rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
test rdx, rdx
jne 0x1800463ae
xor al, al
jmp 0x180046abf
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x1800463bf
mov al, 1
jmp 0x180046abf
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov rdi, r15
mov qword [rbp - 0x30], r15
mov byte [rbp - 0x28], al
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
test r14b, r14b
je 0x1800464a0
movdqu xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
lea r8d, [rax + 0x46]
lea rdx, str.GlobalRCAV7E47DA93_AF41_4450_90CD_31C78125287D_RTPROTECT_INITIALEVENT
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x30], 1
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180095c70
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18004648a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046485
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046ae8
call fcn.180116bc4
movdqa xmm0, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov rdi, qword [rbp - 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x1800464c1
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.180003950
nop
lea rcx, [rbp - 0x50]
call fcn.180083210
test al, al
sete sil
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180046528
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046523
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046aee
call fcn.180116bc4
movdqa xmm0, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
test sil, sil
je 0x18004662d
mov edx, 2
lea rcx, [0x180207cd0]
call fcn.1800b31d0
mov ebx, eax
test eax, eax
je 0x180046626
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x10
lea rdx, str.RTProtect_missed
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x31
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
mov qword [rsp + 0x20], rsi
lea r9, str.d:_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180207cd0]
call fcn.1800b3220
cmp ebx, 1
jbe 0x1800465d4
lea rdx, [rbp - 0x50]
lea rcx, [0x180207cd0]
call fcn.1800b35c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180046614
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004660f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046af4
call fcn.180116bc4
movdqa xmm0, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x180046aa1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1801a9390]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], r15w
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x48], r15
lea rax, str.Open
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rax, [rbp]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea edx, [rax + 3]
lea rcx, [0x180207cd0]
call fcn.1800b31d0
mov ebx, eax
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
test eax, eax
je 0x180046783
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xe
lea rdx, str.Call_RTProtect
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x3f
mov qword [rsp + 0x20], rsi
lea r9, str.d:_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180207cd0]
call fcn.1800b3220
cmp ebx, 1
jbe 0x180046731
lea rdx, [rbp - 0x50]
lea rcx, [0x180207cd0]
call fcn.1800b35c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180046771
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004676c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046afa
call fcn.180116bc4
movdqa xmm0, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x180046877
lea edx, [rax + 2]
lea rcx, [0x180207cd0]
call fcn.1800b31d0
mov ebx, eax
test eax, eax
je 0x180046892
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x14
lea rdx, str.Start_service_failed
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rsi
lea r9, str.d:_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180207cd0]
call fcn.1800b3220
cmp ebx, 1
jbe 0x18004681e
lea rdx, [rbp - 0x50]
lea rcx, [0x180207cd0]
call fcn.1800b35c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18004685e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046859
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046b00
call fcn.180116bc4
movdqa xmm0, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x180046a53
test r14b, r14b
je 0x180046975
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180046899
xor bl, bl
jmp 0x180046a53
mov edx, 3
lea rcx, [0x180207cd0]
call fcn.1800b31d0
mov ebx, eax
test eax, eax
je 0x180046975
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x12
lea rdx, str.Got_initial_events
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x4d
mov qword [rsp + 0x20], rsi
lea r9, str.d:_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180207cd0]
call fcn.1800b3220
cmp ebx, 1
jbe 0x180046923
lea rdx, [rbp - 0x50]
lea rcx, [0x180207cd0]
call fcn.1800b35c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180046963
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004695e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046b06
call fcn.180116bc4
movdqa xmm0, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov edx, 3
lea rcx, [0x180207cd0]
call fcn.1800b31d0
mov ebx, eax
test eax, eax
je 0x180046a51
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xa
lea rdx, str.Call_leave
lea rcx, [rbp - 0x50]
call fcn.180003950
mov dword [rsp + 0x28], 0x4f
mov qword [rsp + 0x20], rsi
lea r9, str.d:_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180207cd0]
call fcn.1800b3220
cmp ebx, 1
jbe 0x1800469ff
lea rdx, [rbp - 0x50]
lea rcx, [0x180207cd0]
call fcn.1800b35c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180046a3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046a3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046b0c
call fcn.180116bc4
movdqa xmm0, xmmword [0x1801a9390]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov bl, 1
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x180046a8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046a8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046ae2
call fcn.180116bc4
movdqa xmm0, xmmword [0x1801a9390]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r15w
test rdi, rdi
je 0x180046ab3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
lea rcx, [rbp - 0x20]
call fcn.1800038d0
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180116780
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.18013ed94
nop
call fcn.18013ed94
int3
call fcn.18013ed94
int3
call fcn.18013ed94
nop
call fcn.18013ed94
int3
call fcn.18013ed94
int3
call fcn.18013ed94
int3
call fcn.18013ed94
int3