Function at 0x180049a70
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp + 0x20], rax
movzx r14d, r8b
mov rbx, rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
test rdx, rdx
jne 0x180049abe
xor al, al
jmp 0x18004a1cf
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x180049acf
mov al, 1
jmp 0x18004a1cf
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov rdi, r15
mov qword [rbp - 0x30], r15
mov byte [rbp - 0x28], al
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
test r14b, r14b
je 0x180049bb0
movdqu xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
lea r8d, [rax + 0x46]
lea rdx, str.GlobalRCAV7E47DA93_AF41_4450_90CD_31C78125287D_RTPROTECT_INITIALEVENT
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x30], 1
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180099600
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049b9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049b95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a1f8
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov rdi, qword [rbp - 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x180049bd1
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.180003960
nop
lea rcx, [rbp - 0x50]
call fcn.180086ba0
test al, al
sete sil
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049c38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049c33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a1fe
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
test sil, sil
je 0x180049d3d
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6b60
mov ebx, eax
test eax, eax
je 0x180049d36
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x10
lea rdx, str.RTProtect_missed
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x31
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6bb0
cmp ebx, 1
jbe 0x180049ce4
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f50
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049d24
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049d1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a204
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x18004a1b1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], r15w
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x48], r15
lea rax, str.Open
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rax, [rbp]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea edx, [rax + 3]
lea rcx, [0x180213e70]
call fcn.1800b6b60
mov ebx, eax
lea rsi, str.RC::RCRTProtectCtrl::DirectStart
test eax, eax
je 0x180049e93
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xe
lea rdx, str.Call_RTProtect
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x3f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6bb0
cmp ebx, 1
jbe 0x180049e41
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f50
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049e81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049e7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a20a
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x180049f87
lea edx, [rax + 2]
lea rcx, [0x180213e70]
call fcn.1800b6b60
mov ebx, eax
test eax, eax
je 0x180049fa2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x14
lea rdx, str.Start_service_failed
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6bb0
cmp ebx, 1
jbe 0x180049f2e
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f50
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180049f6e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049f69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a210
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
xor bl, bl
jmp 0x18004a163
test r14b, r14b
je 0x18004a085
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180049fa9
xor bl, bl
jmp 0x18004a163
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6b60
mov ebx, eax
test eax, eax
je 0x18004a085
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0x12
lea rdx, str.Got_initial_events
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x4d
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6bb0
cmp ebx, 1
jbe 0x18004a033
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f50
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18004a073
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a06e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a216
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6b60
mov ebx, eax
test eax, eax
je 0x18004a161
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x50], r15w
mov r8d, 0xa
lea rdx, str.Call_leave
lea rcx, [rbp - 0x50]
call fcn.180003960
mov dword [rsp + 0x28], 0x4f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtloader_rcrtprotectctrl.cpp
lea r8, [rbp - 0x50]
mov edx, 3
lea rcx, [0x180213e70]
call fcn.1800b6bb0
cmp ebx, 1
jbe 0x18004a10f
lea rdx, [rbp - 0x50]
lea rcx, [0x180213e70]
call fcn.1800b6f50
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18004a14f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a14a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a21c
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov bl, 1
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x18004a19f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a19a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a1f2
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r15w
test rdi, rdi
je 0x18004a1c3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
lea rcx, [rbp - 0x20]
call fcn.1800038e0
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18011e4d0
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180146ae4
nop
call fcn.180146ae4
int3
call fcn.180146ae4
int3
call fcn.180146ae4
nop
call fcn.180146ae4
int3
call fcn.180146ae4
int3
call fcn.180146ae4
int3
call fcn.180146ae4
int3