Function at 0x140011d80
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x20]
xor r13d, r13d
test rax, rax
je 0x1400120a2
cmp word [rax], r13w
je 0x1400120a2
mov r14d, r13d
lea rcx, [rbp - 0x51]
call fcn.140114c40
nop
xor r8d, r8d
lea rdx, [rbp - 0x51]
mov rcx, rbx
call fcn.140015b38
mov r12, rax
mov dword [rbp - 0x39], 0x68
xor edx, edx
lea r8d, [r13 + 0x60]
lea rcx, [rbp - 0x31]
call fcn.14012d4b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x59], rax
or r9, 0xffffffffffffffff
test r12, r12
je 0x140011e23
mov rax, r9
inc rax
cmp word [r12 + rax*2], r13w
jne 0x140011e11
add rax, 0xac
jmp 0x140011e28
mov eax, 0xaa
mov rdx, qword [rdi + 0x30]
test rdx, rdx
je 0x140011e40
mov rcx, r9
inc rcx
cmp word [rdx + rcx*2], r13w
jne 0x140011e34
jmp 0x140011e43
mov rcx, r13
lea r15, [rbx + 0xae0]
mov rdx, r9
inc rdx
cmp word [r15 + rdx*2], r13w
jne 0x140011e4d
mov r8, qword [rdi + 0x20]
mov rsi, r9
inc rsi
cmp word [r8 + rsi*2], r13w
jne 0x140011e5e
add rax, rdx
add rsi, rax
add rsi, rcx
lea rcx, [rsi + rsi]
call fcn.140113e8c
mov rbx, rax
test rax, rax
je 0x14001208f
mov dword [rax], 0x22
mov r8, r15
mov rdx, rsi
mov rcx, rax
call fcn.140001e48
lea r8, [0x140179210]
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
test r12, r12
je 0x140011ed1
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
lea r8, [0x14017669c]
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
lea r8, [0x14017a600]
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
mov rax, qword [0x14022ab50]
cmp byte [rax + 0x10fe5], r13b
je 0x140011f05
lea r8, [0x14017a618]
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
mov r8, qword [rdi + 0x30]
test r8, r8
je 0x140011f19
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
lea r8, [0x14017a630]
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
mov r8, qword [rdi + 0x20]
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
mov r14d, 2
cmp dword [rdi + 0x68], r14d
je 0x140011f61
cmp dword [rdi + 0x70], r14d
je 0x140011f58
cmp qword [rdi + 0x78], r13
je 0x140011f73
cmp dword [rdi + 0x70], r14d
jne 0x140011f73
lea r8, str.__new_console:r
jmp 0x140011f68
lea r8, str.__new_console:a
mov rdx, rsi
mov rcx, rbx
call fcn.140001e48
cmp dword [rdi + 0x68], r14d
je 0x140011fe4
cmp dword [rdi + 0x70], r14d
je 0x140011fe4
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x140011fe4
cmp word [rcx], r13w
je 0x140011fe4
mov r9d, r13d
cmp dword [rdi + 0x74], r14d
sete r9b
inc r9d
lea r8, [rdi + 0x88]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x4000020
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x140012022
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r14d, eax
test eax, eax
jne 0x14001204b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x20], r13
lea r9, str.Failed_to_start_new_ConEmu_window
lea r8d, [r14 + 0x10]
mov edx, eax
mov rcx, rbx
call fcn.140113304
jmp 0x140012087
mov rcx, qword [rbp - 0x69]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140012069
mov qword [rbp - 0x69], r13
cmp rcx, 0xffffffffffffffff
je 0x140012069
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x61]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140012087
mov qword [rbp - 0x61], r13
cmp rcx, 0xffffffffffffffff
je 0x140012087
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140113e18
test r14d, r14d
setne bl
lea rcx, [rbp - 0x51]
call fcn.140114ca4
mov al, bl
jmp 0x1400120a4
xor al, al
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret