Function at 0x1400223c0
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5c8]
sub rsp, 0x6c8
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
cmp byte [rcx + 0x70], 0
mov r14, r9
mov rax, qword [rbp + 0x630]
mov r15, r8
mov r13, qword [rbp + 0x638]
mov esi, edx
mov qword [rsp + 0x68], rax
mov rbx, rcx
je 0x140022419
or eax, 0xffffffff
jmp 0x14002271a
mov eax, dword [0x140178680]
lea rcx, [rbp - 0x78]
movsd xmm0, qword [0x140178678]
or edi, 0xffffffff
mov dword [rbp - 8], eax
xor edx, edx
movzx eax, word [0x140178684]
mov word [rbp - 4], ax
xor eax, eax
movsd qword [rbp - 0x10], xmm0
lea r8d, [rdi + 0x61]
xorps xmm0, xmm0
mov word [rbp + 0x2e], ax
mov qword [rsp + 0x60], rax
movups xmmword [rbp - 2], xmm0
mov dword [rbp - 0x80], 0x68
movups xmmword [rbp + 0xe], xmm0
movups xmmword [rbp + 0x1e], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.14012d4b0
and dword [r13], 0
lea r8, str.ConEmuDefTermProc._u
mov r9d, esi
lea edx, [rdi + 0x41]
lea rcx, [rbp + 0x120]
call fcn.1401140d0
call fcn.140116ec4
mov rcx, rax
lea r8, [rbp + 0x120]
lea edx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400224bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x1400224c0
xor r12d, r12d
mov rdx, qword [r15]
test rdx, rdx
jne 0x140022512
mov r8d, esi
mov ecx, 0x100400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r15], rax
mov rdx, rax
test rax, rax
jne 0x140022512
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13], eax
lea rdx, str.OpenProcess_fails__code_u
mov r8d, eax
lea rcx, [rbp + 0x30]
call fcn.140003ab0
mov rax, qword [rbx]
lea r8, [rbp + 0x30]
mov edx, esi
mov rcx, rbx
call qword [rax + 0x50]
jmp 0x140022708
cmp r12d, 0xb7
jne 0x140022536
xor edi, edi
mov dword [r14], 0x90
lea rdx, str.Mutex_already_exists
lea rcx, [rbp + 0x30]
call fcn.140003ab0
jmp 0x1400224fe
mov ecx, esi
call fcn.140119e1c
mov r12d, eax
cmp eax, 0x20
je 0x14002256d
cmp eax, 0x40
je 0x140022564
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r12d
lea rdx, str.Unsupported_process_bitness___i_
mov edi, 0xfffffffe
jmp 0x1400224f5
lea r12, str.ConEmuC64.exe
jmp 0x140022574
lea r12, str.ConEmuC.exe
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov r9, qword [rsp + 0x68]
lea rdx, str.__LOG
test al, al
mov dword [rsp + 0x30], esi
lea rcx, [0x1401759d0]
cmovne rcx, rdx
lea r8, str.__s_s__s__DEFTRM_u
mov qword [rsp + 0x28], rcx
mov edx, 0x208
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x20], r12
call fcn.1401140d0
cmp byte [rbx + 0x70], 0
jne 0x140022708
lea rax, [rbp - 0x10]
mov dword [rbp - 0x44], 1
mov qword [rbp - 0x68], rax
lea r8, [rbp + 0x1a0]
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax + 0x50]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1a0]
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140022651
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13], eax
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [r13]
lea rdx, str.Fails_to_start_service_process__code_u
mov edi, 0xfffffffd
jmp 0x1400224f5
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x60]
lea rdx, str.Service_process_PID_u_started
lea rcx, [rbp + 0x30]
call fcn.140003ab0
mov rax, qword [rbx]
lea r8, [rbp + 0x30]
mov edx, esi
mov rcx, rbx
call qword [rax + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
jmp 0x1400226b3
mov rcx, qword [rsp + 0x50]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400226b9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp byte [rbx + 8], 0
jne 0x1400226b3
cmp eax, 0x7530
jae 0x1400226b9
cmp byte [rbx + 0x70], 0
je 0x14002268a
mov rcx, qword [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400226d4
or r9d, 0xffffffff
mov dword [r14], r9d
jmp 0x1400226d7
mov r9d, dword [r14]
mov r8d, dword [rsp + 0x60]
lea rdx, str.Service_process_PID_u_finished_with_code_u
lea rcx, [rbp + 0x30]
call fcn.140003ab0
mov rax, qword [rbx]
lea r8, [rbp + 0x30]
mov edx, esi
mov rcx, rbx
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140022718
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.14012bda0
add rsp, 0x6c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret