Function at 0x14010ff40
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14029ba50]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r12, r9
mov qword [rbp - 0x78], r8
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x70], rcx
mov qword [rsp + 0x68], rcx
mov qword [rbp + 0x60], r9
mov rdi, qword [rbp + 0x230]
mov qword [rsp + 0x58], rdi
mov qword [rbp + 0x68], rdi
mov rsi, qword [rbp + 0x238]
mov qword [rsp + 0x68], rsi
mov qword [rbp + 0x70], rsi
mov r13, qword [rbp + 0x240]
mov qword [rbp + 0x78], r13
mov byte [rsp + 0x50], 0
xor r14d, r14d
cmp byte [rbp + 0x250], r14b
jne 0x1401101e9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x124], xmm0
movups xmmword [rbp + 0x134], xmm0
movups xmmword [rbp + 0x144], xmm0
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rbp + 0x164], xmm0
movups xmmword [rbp + 0x174], xmm0
mov dword [rbp + 0x184], eax
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
movups xmmword [rbp + 0x48], xmm0
movsd xmm0, qword [rbp]
movsd qword [rbp + 0x58], xmm0
mov dword [rbp + 0x120], WSASetLastError
lea rdx, [rbp + 0x190]
lea rcx, str..decompiler.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1401101c6
mov edi, r14d
movabs r15, 0x7ffffffffa0a1eff
nop word [rax + rax]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str..decompiler.exe
lea rcx, str..decompiler.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne byte [rsp + 0x50]
test eax, eax
jne 0x14011013c
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401100c3
imul rax, rax, 0x64
jmp 0x1401100de
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jge 0x1401100eb
add rax, 0x5f5e100
jmp 0x1401100f5
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.140117ad0
inc edi
cmp edi, 0xa
jl 0x140110050
lea rdx, str.WARNING:_failed_to_open_decompiler_after_10_attempts._Decompilation_disabled.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400fdca0
lea rdx, [0x1400fde90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, qword [rsp + 0x58]
jmp 0x1401101e9
mov ecx, 1
call fcn.1401a788c
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140118b80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1401101b5
cmp dword [rsp + 0x78], 0
jne 0x14011018d
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1401101ae
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rdi, qword [rsp + 0x58]
jmp 0x1401101e9
mov dword [rsp + 0x78], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, str.WARNING:_decompiler.exe_was_not_found._Decompilation_disabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400fdca0
lea rdx, [0x1400fde90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x10088
call fcn.1401a788c
mov r15, rax
mov qword [rbp + 0x90], rax
xor edx, edx
mov r8d, 0x10088
mov rcx, rax
call fcn.1401a88dc
mov qword [r15], r14
mov qword [r15 + 8], r14
mov qword [r15 + 0x20], r14
mov dword [r15 + 0x28], r14d
mov qword [r15 + 0x30], r14
mov qword [r15 + 0x40], r14
lea rdx, [r15 + 0x10078]
mov qword [rdx], r14
mov qword [r15 + 0x10080], r14
lea rcx, [r15 + 0x78]
mov qword [r15 + 0x60], rcx
mov rax, rcx
neg rax
and eax, 7
add rax, rcx
mov qword [r15 + 0x68], rax
mov qword [r15 + 0x70], rdx
mov qword [rbp + 0x90], r15
mov edx, 0x60
lea rcx, [r15 + 0x60]
call fcn.140112260
mov r14, rax
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x20], rax
mov dword [r14 + 0x28], 1
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x40], rax
lea rcx, str.roblox
mov rax, rcx
inc rax
cmp byte [rax], 0
jne 0x140110290
mov qword [r14], rcx
sub rax, rcx
mov qword [r14 + 0x10], rax
mov edx, gethostname
lea rcx, [r15 + 0x60]
call fcn.140112260
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x20], r8
lea rax, str.xmlns:xmime
mov rcx, rax
nop dword [rax + rax]
inc rcx
cmp byte [rcx], r8b
jne 0x1401102d0
mov qword [rdx], rax
sub rcx, rax
mov qword [rdx + 0x10], rcx
lea rcx, str.http:__www.w3.org_2005_05_xmlmime
mov rax, rcx
nop dword [rax]
inc rax
cmp byte [rax], r8b
jne 0x1401102f0
mov qword [rdx + 8], rcx
sub rax, rcx
mov qword [rdx + 0x18], rax
cmp qword [r14 + 0x40], r8
je 0x14011031b
mov rax, qword [r14 + 0x48]
mov qword [rdx + 0x28], rax
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x30], rdx
jmp 0x140110323
mov qword [rdx + 0x28], r8
mov qword [r14 + 0x40], rdx
mov qword [r14 + 0x48], rdx
mov qword [rdx + 0x20], r14
mov qword [rdx + 0x30], r8
mov edx, gethostname
lea rcx, [r15 + 0x60]
call fcn.140112260
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x20], r8
lea rax, str.xmlns:xsi
mov rcx, rax
inc rcx
cmp byte [rcx], r8b
jne 0x140110358
mov qword [rdx], rax
sub rcx, rax
mov qword [rdx + 0x10], rcx
lea rcx, str.http:__www.w3.org_2001_XMLSchema_instance
mov rax, rcx
inc rax
cmp byte [rax], r8b
jne 0x140110374
mov qword [rdx + 8], rcx
sub rax, rcx
mov qword [rdx + 0x18], rax
cmp qword [r14 + 0x40], r8
je 0x14011039f
mov rax, qword [r14 + 0x48]
mov qword [rdx + 0x28], rax
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x30], rdx
jmp 0x1401103a7
mov qword [rdx + 0x28], r8
mov qword [r14 + 0x40], rdx
mov qword [r14 + 0x48], rdx
mov qword [rdx + 0x20], r14
mov qword [rdx + 0x30], r8
mov edx, gethostname
lea rcx, [r15 + 0x60]
call fcn.140112260
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x20], r8
lea rax, str.xsi:noNamespaceSchemaLocation
mov rcx, rax
nop dword [rax]
inc rcx
cmp byte [rcx], r8b
jne 0x1401103e0
mov qword [rdx], rax
sub rcx, rax
mov qword [rdx + 0x10], rcx
lea rcx, str.http:__www.roblox.com_roblox.xsd
mov rax, rcx
nop dword [rax]
inc rax
cmp byte [rax], r8b
jne 0x140110400
mov qword [rdx + 8], rcx
sub rax, rcx
mov qword [rdx + 0x18], rax
cmp qword [r14 + 0x40], r8
je 0x14011042b
mov rax, qword [r14 + 0x48]
mov qword [rdx + 0x28], rax
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x30], rdx
jmp 0x140110433
mov qword [rdx + 0x28], r8
mov qword [r14 + 0x40], rdx
mov qword [r14 + 0x48], rdx
mov qword [rdx + 0x20], r14
mov qword [rdx + 0x30], r8
mov edx, gethostname
lea rcx, [r15 + 0x60]
call fcn.140112260
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x20], r8
lea rax, str.version
mov rcx, rax
inc rcx
cmp byte [rcx], r8b
jne 0x140110468
mov qword [rdx], rax
sub rcx, rax
mov qword [rdx + 0x10], rcx
lea rcx, [0x140242fb8]
mov rax, rcx
inc rax
cmp byte [rax], r8b
jne 0x140110484
mov qword [rdx + 8], rcx
sub rax, rcx
mov qword [rdx + 0x18], rax
cmp qword [r14 + 0x40], r8
je 0x1401104af
mov rax, qword [r14 + 0x48]
mov qword [rdx + 0x28], rax
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x30], rdx
jmp 0x1401104b7
mov qword [rdx + 0x28], r8
mov qword [r14 + 0x40], rdx
mov qword [r14 + 0x48], rdx
mov qword [rdx + 0x20], r14
mov qword [rdx + 0x30], r8
cmp qword [r15 + 0x30], r8
je 0x1401104db
mov rax, qword [r15 + 0x38]
mov qword [r14 + 0x50], rax
mov rax, qword [r15 + 0x38]
mov qword [rax + 0x58], r14
jmp 0x1401104e3
mov qword [r14 + 0x50], r8
mov qword [r15 + 0x30], r14
mov qword [r15 + 0x38], r14
mov qword [r14 + 0x20], r15
mov qword [r14 + 0x58], r8
mov rax, qword [0x14029d9e8]
sub rax, qword [0x14029d9e0]
sar rax, 5
test rax, rax
je 0x140110632
mov edx, 0x60
lea rcx, [r15 + 0x60]
call fcn.140112260
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x20], r8
mov dword [rax + 0x28], 1
mov qword [rax + 0x30], r8
mov qword [rax + 0x40], r8
lea rax, str.External
mov rcx, rax
inc rcx
cmp byte [rcx], r8b
jne 0x140110542
mov qword [rdx], rax
sub rcx, rax
mov qword [rdx + 0x10], rcx
lea rcx, str.null
mov rax, rcx
nop
inc rax
cmp byte [rax], r8b
jne 0x140110560
mov qword [rdx + 8], rcx
sub rax, rcx
mov qword [rdx + 0x18], rax
cmp qword [r14 + 0x30], r8
je 0x14011058b
mov rax, qword [r14 + 0x38]
mov qword [rdx + 0x50], rax
mov rax, qword [r14 + 0x38]
mov qword [rax + 0x58], rdx
jmp 0x140110593
mov qword [rdx + 0x50], r8
mov qword [r14 + 0x30], rdx
mov qword [r14 + 0x38], rdx
mov qword [rdx + 0x20], r14
mov qword [rdx + 0x58], r8
mov edx, 0x60
lea rcx, [r15 + 0x60]
call fcn.140112260
mov rcx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x20], r8
mov dword [rax + 0x28], 1
mov qword [rax + 0x30], r8
mov qword [rax + 0x40], r8
lea rdx, str.External
mov rax, rdx
inc rax
cmp byte [rax], r8b
jne 0x1401105d7
mov qword [rcx], rdx
sub rax, rdx
mov qword [rcx + 0x10], rax
lea rdx, [0x140242fd4]
mov rax, rdx
inc rax
cmp byte [rax], r8b
jne 0x1401105f3
mov qword [rcx + 8], rdx
sub rax, rdx
mov qword [rcx + 0x18], rax
cmp qword [r14 + 0x30], r8
je 0x14011061e
mov rax, qword [r14 + 0x38]
mov qword [rcx + 0x50], rax
mov rax, qword [r14 + 0x38]
mov qword [rax + 0x58], rcx
jmp 0x140110626
mov qword [rcx + 0x50], r8
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], rcx
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x58], r8
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x80], r8
mov qword [rbp + 0x88], r8
mov ecx, 0x48
call fcn.1401a788c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
lea rax, [rbp + 8]
mov qword [rbp - 0x68], rax
mov rdx, rsi
lea rcx, [rbp + 8]
call fcn.1400fce60
mov rsi, rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x60], rax
mov rdx, rdi
lea rcx, [rbp + 0x28]
call fcn.1400fce60
mov rdi, rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x58], rax
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.1400fc9b0
mov rbx, rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x20]
call fcn.140112140
nop
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov r8, r15
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp + 0xa0]
call fcn.140102b00
nop
movzx eax, byte [rbp + 0x248]
mov byte [rbp + 0x118], al
movzx ebx, byte [rsp + 0x50]
mov byte [rbp + 0x119], bl
mov rdx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x14011074b
mov rdx, qword [r13]
cmp qword [r13 + 0x10], 4
jne 0x140110797
xor ecx, ecx
lea r8, str.save
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140110778
cmp rcx, 4
jne 0x140110760
xor eax, eax
jmp 0x14011077d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140110797
mov r9, qword [rbp - 0x78]
mov r8, r14
mov rdx, r15
lea rcx, [rbp + 0xa0]
call fcn.14010f930
test bl, bl
je 0x1401107af
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
mov eax, r14d
xchg byte [0x14029c760], al
mov rsi, qword [rbp - 0x70]
mov qword [rsi], r15
lea rcx, [rbp + 0xa0]
call fcn.14010ef40
nop
mov r8, qword [rbp + 0x80]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x80]
call fcn.140118010
lea edx, [r14 + 0x48]
mov rcx, qword [rbp + 0x80]
call fcn.1401a78c8
nop
mov rax, qword [r12]
mov rdi, qword [rax + 8]
cmp byte [rdi + 0x19], r14b
jne 0x140110841
nop dword [rax]
mov r8, qword [rdi + 0x10]
mov rdx, r12
mov rcx, r12
call fcn.1400ff040
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.1400ff470
mov edx, 0x50
mov rcx, rbx
call fcn.1401a78c8
cmp byte [rdi + 0x19], 0
je 0x140110810
mov edx, 0x50
mov rcx, qword [r12]
call fcn.1401a78c8
nop
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14011088f
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14011088a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140110961
mov rcx, r8
call fcn.1401a78c8
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1401108dd
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1401108d8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140110968
mov rcx, r8
call fcn.1401a78c8
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x140110923
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14011091e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14011096f
mov rcx, r8
call fcn.1401a78c8
mov qword [r13 + 0x10], r14
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rax, rsi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1401a75d0
mov rbx, qword [rsp + 0x318]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3