Function at 0x140001500
Capabilities:
Create thread
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r9, qword [rcx + 8]
mov rdi, rcx
mov r8, qword [rcx + 0x10]
mov rdx, qword [rcx]
lea rcx, str.___write_mem__Trying_to_write_:_n_tdevicePath_:__ws_n_twhat_:_0x_llX_n_twhere_:_0x_llX_n
call fcn.140001230
mov rax, qword [rdi + 0x10]
movzx r14d, byte [rdi + 0x10]
mov rcx, rax
shr rcx, 0x20
mov r15, rax
mov qword [rsp + 0x40], rcx
mov r12, rax
mov rcx, rax
shr r15, 8
shr rcx, 0x28
mov r13, rax
mov qword [rsp + 0x48], rcx
mov rcx, rax
shr rcx, 0x30
shr rax, 0x38
mov qword [rsp + 0x50], rcx
shr r12, 0x10
shr r13, 0x18
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ebx, ebx
mov qword [rsp + 0x60], rax
mov rsi, rax
test rax, rax
jne 0x1400015cd
xor edx, edx
lea rcx, str.____write_mem___d__Could_not_allocate_the_HEAP._Testing_next_thread._n
call fcn.140001230
jmp 0x14000161a
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140001607
lea rcx, [0x140003388]
call fcn.1400010d0
mov qword [rsi], rbx
mov qword [rsi + 8], rbp
mov rax, qword [rdi + 8]
mov qword [rsi + 0x10], rax
mov byte [rsi + 0x18], r14b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x68], rax
mov rsi, rax
test rax, rax
jne 0x140001650
lea edx, [rax + 1]
lea rcx, str.____write_mem___d__Could_not_allocate_the_HEAP._Testing_next_thread._n
call fcn.140001230
jmp 0x1400016a4
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14000168a
lea rcx, [0x140003388]
call fcn.1400010d0
mov qword [rsi], 1
mov qword [rsi + 8], rbp
mov rax, qword [rdi + 8]
inc rax
mov qword [rsi + 0x10], rax
mov byte [rsi + 0x18], r15b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x70], rax
mov rsi, rax
test rax, rax
jne 0x1400016da
lea edx, [rax + 2]
lea rcx, str.____write_mem___d__Could_not_allocate_the_HEAP._Testing_next_thread._n
call fcn.140001230
jmp 0x14000172f
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140001714
lea rcx, [0x140003388]
call fcn.1400010d0
mov qword [rsi], 2
mov qword [rsi + 8], rbp
mov rax, qword [rdi + 8]
add rax, 2
mov qword [rsi + 0x10], rax
mov byte [rsi + 0x18], r12b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x78], rax
mov rsi, rax
test rax, rax
jne 0x140001765
lea edx, [rax + 3]
lea rcx, str.____write_mem___d__Could_not_allocate_the_HEAP._Testing_next_thread._n
call fcn.140001230
jmp 0x1400017ba
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14000179f
lea rcx, [0x140003388]
call fcn.1400010d0
mov qword [rsi], 3
mov qword [rsi + 8], rbp
mov rax, qword [rdi + 8]
add rax, 3
mov qword [rsi + 0x10], rax
mov byte [rsi + 0x18], r13b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x80], rax
mov rsi, rax
test rax, rax
jne 0x1400017f3
lea edx, [rax + 4]
lea rcx, str.____write_mem___d__Could_not_allocate_the_HEAP._Testing_next_thread._n
call fcn.140001230
jmp 0x14000184c
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14000182d
lea rcx, [0x140003388]
call fcn.1400010d0
mov qword [rsi], 4
mov qword [rsi + 8], rbp
mov rax, qword [rdi + 8]
add rax, 4
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x40]
mov byte [rsi + 0x18], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x88], rax
mov rsi, rax
test rax, rax
jne 0x140001885
lea edx, [rax + 5]
lea rcx, str.____write_mem___d__Could_not_allocate_the_HEAP._Testing_next_thread._n
call fcn.140001230
jmp 0x1400018de
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400018bf
lea rcx, [0x140003388]
call fcn.1400010d0
mov qword [rsi], 5
mov qword [rsi + 8], rbp
mov rax, qword [rdi + 8]
add rax, 5
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov byte [rsi + 0x18], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x90], rax
mov rsi, rax
test rax, rax
jne 0x140001917
lea edx, [rax + 6]
lea rcx, str.____write_mem___d__Could_not_allocate_the_HEAP._Testing_next_thread._n
call fcn.140001230
jmp 0x140001970
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140001951
lea rcx, [0x140003388]
call fcn.1400010d0
mov qword [rsi], 6
mov qword [rsi + 8], rbp
mov rax, qword [rdi + 8]
add rax, 6
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x50]
mov byte [rsi + 0x18], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x98], rax
mov rsi, rax
test rax, rax
jne 0x1400019a9
lea edx, [rax + 7]
lea rcx, str.____write_mem___d__Could_not_allocate_the_HEAP._Testing_next_thread._n
call fcn.140001230
jmp 0x140001a02
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400019e3
lea rcx, [0x140003388]
call fcn.1400010d0
mov qword [rsi], 7
mov qword [rsi + 8], rbp
mov rax, qword [rdi + 8]
add rax, 7
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x58]
mov byte [rsi + 0x18], al
mov edi, ebx
lea r14, [rsp + 0xe0]
mov rsi, rbx
nop
mov rbp, qword [rsp + rsi + 0x60]
lea r15, [rsp + 0xe0]
movsxd rax, edi
lea r8, [0x140001290]
mov r9, rbp
xor edx, edx
xor ecx, ecx
lea r15, [r15 + rax*4]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + rsi + 0xa0], rax
test rax, rax
je 0x140001af6
mov eax, dword [r14]
inc edi
add r14, 4
mov dword [rbp + 4], eax
add rsi, 8
cmp edi, 8
jl 0x140001a10
lea rdi, [rsp + 0xe0]
lea rsi, [rsp + 0xa0]
nop dword [rax + rax]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140001a9f
mov r8d, dword [rdi]
lea rcx, str.____write_mem___d____d___Error_resuming_thread_n
mov edx, ebx
call fcn.140001230
inc ebx
add rsi, 8
add rdi, 4
cmp ebx, 8
jl 0x140001a80
lea rcx, str.___write_mem__Wait_for_thread_to_complete_n
call fcn.140001230
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140001ed0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8d, dword [r15]
lea rcx, str.____write_mem___d____d__Error_while_creating_the_thread_n
mov edx, edi
call fcn.140001230
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_ExitProcess]