Function at 0x140012d10
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x20]
xor r13d, r13d
test rax, rax
je 0x140013032
cmp word [rax], r13w
je 0x140013032
mov r14d, r13d
lea rcx, [rbp - 0x51]
call fcn.140120d54
nop
xor r8d, r8d
lea rdx, [rbp - 0x51]
mov rcx, rbx
call fcn.140017028
mov r12, rax
xor edx, edx
lea r8d, [r13 + 0x64]
lea rcx, [rbp - 0x35]
call fcn.14013b230
mov dword [rbp - 0x39], 0x68
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x59], rax
or r9, 0xffffffffffffffff
test r12, r12
je 0x140012db3
mov rax, r9
inc rax
cmp word [r12 + rax*2], r13w
jne 0x140012da1
add rax, 0xac
jmp 0x140012db8
mov eax, 0xaa
mov rdx, qword [rdi + 0x30]
test rdx, rdx
je 0x140012dd0
mov rcx, r9
inc rcx
cmp word [rdx + rcx*2], r13w
jne 0x140012dc4
jmp 0x140012dd3
mov rcx, r13
lea r15, [rbx + 0xaf0]
mov rdx, r9
inc rdx
cmp word [r15 + rdx*2], r13w
jne 0x140012ddd
mov r8, qword [rdi + 0x20]
mov rsi, r9
inc rsi
cmp word [r8 + rsi*2], r13w
jne 0x140012dee
add rax, rdx
add rsi, rax
add rsi, rcx
lea rcx, [rsi + rsi]
call fcn.140120104
mov rbx, rax
test rax, rax
je 0x14001301f
mov dword [rax], 0x22
mov r8, r15
mov rdx, rsi
mov rcx, rax
call fcn.140001f38
lea r8, [0x14016b500]
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
test r12, r12
je 0x140012e61
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
lea r8, [0x140168a9c]
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
lea r8, [0x14016c950]
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
mov rax, qword [0x14021c740]
cmp byte [rax + 0x10fed], r13b
je 0x140012e95
lea r8, [0x14016c968]
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
mov r8, qword [rdi + 0x30]
test r8, r8
je 0x140012ea9
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
lea r8, [0x14016c980]
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
mov r8, qword [rdi + 0x20]
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
mov r14d, 2
cmp dword [rdi + 0x68], r14d
je 0x140012ef1
cmp dword [rdi + 0x70], r14d
je 0x140012ee8
cmp qword [rdi + 0x78], r13
je 0x140012f03
cmp dword [rdi + 0x70], r14d
jne 0x140012f03
lea r8, str.__new_console:r
jmp 0x140012ef8
lea r8, str.__new_console:a
mov rdx, rsi
mov rcx, rbx
call fcn.140001f38
cmp dword [rdi + 0x68], r14d
je 0x140012f74
cmp dword [rdi + 0x70], r14d
je 0x140012f74
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x140012f74
cmp word [rcx], r13w
je 0x140012f74
mov r9d, r13d
cmp dword [rdi + 0x74], r14d
sete r9b
inc r9d
lea r8, [rdi + 0x88]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x4000020
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x140012fb2
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r14d, eax
test eax, eax
jne 0x140012fdb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x20], r13
lea r9, str.Failed_to_start_new_ConEmu_window
lea r8d, [r14 + 0x10]
mov edx, eax
mov rcx, rbx
call fcn.14011f550
jmp 0x140013017
mov rcx, qword [rbp - 0x69]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140012ff9
mov qword [rbp - 0x69], r13
cmp rcx, 0xffffffffffffffff
je 0x140012ff9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x61]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140013017
mov qword [rbp - 0x61], r13
cmp rcx, 0xffffffffffffffff
je 0x140013017
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14012008c
test r14d, r14d
setne bl
lea rcx, [rbp - 0x51]
call fcn.140120ddc
mov al, bl
jmp 0x140013034
xor al, al
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret