Function at 0x140009ae0
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
mov dword [rbp - 0x1c], 0
mov rax, qword [rbp + 0x18]
mov rcx, rax
call fcn.14002cd50
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x20], 0
mov dword [rbp - 0x34], 0
mov rax, qword [0x14003d880]
mov eax, dword [rax + 0xec]
test eax, eax
je 0x140009bb3
lea r9, str.Register_VEH_handler...
mov r8d, 0xee
lea rdx, str.CoffeeExecuteFunction
lea rcx, [0x14003c77c]
call fcn.140035970
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x1a8]
lea rdx, [0x1400349e0]
mov ecx, 1
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140009bb3
mov rax, qword [0x14003d880]
mov rax, qword [rax + 0x8b2]
mov eax, dword [rax + 0x68]
mov edx, eax
mov ecx, 1
call fcn.140025160
mov eax, 0
jmp 0x14000a0ff
mov word [rbp - 0x22], 0
jmp 0x140009d75
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
movzx edx, word [rbp - 0x22]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, 0x14
lea rdx, [rcx + rax]
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x10]
test eax, eax
je 0x140009d6a
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x24]
and eax, 0xe0000000
mov dword [rbp - 0x34], eax
cmp dword [rbp - 0x34], 0
jne 0x140009c1f
mov dword [rbp - 0x20], 1
jmp 0x140009cd1
cmp dword [rbp - 0x34], 0x20000000
jne 0x140009c34
mov dword [rbp - 0x20], 0x10
jmp 0x140009cd1
cmp dword [rbp - 0x34], 0x40000000
jne 0x140009c49
mov dword [rbp - 0x20], 2
jmp 0x140009cd1
cmp dword [rbp - 0x34], 0x60000000
jne 0x140009c5b
mov dword [rbp - 0x20], 0x20
jmp 0x140009cd1
cmp dword [rbp - 0x34], 0x80000000
jne 0x140009c6d
mov dword [rbp - 0x20], 8
jmp 0x140009cd1
cmp dword [rbp - 0x34], 0xa0000000
jne 0x140009c7f
mov dword [rbp - 0x20], pe_nt_image_headers64
jmp 0x140009cd1
cmp dword [rbp - 0x34], 0xc0000000
jne 0x140009c91
mov dword [rbp - 0x20], 4
jmp 0x140009cd1
cmp dword [rbp - 0x34], 0xe0000000
jne 0x140009ca3
mov dword [rbp - 0x20], 0x40
jmp 0x140009cd1
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x24]
mov r9d, eax
mov r8d, 0x111
lea rdx, str.CoffeeExecuteFunction
lea rcx, str._DEBUG::_s::_d__Unknown_protection:__x
call fcn.140035970
mov dword [rbp - 0x20], 0x40
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x24]
and eax, 0x4000000
test eax, eax
je 0x140009cec
or dword [rbp - 0x20], 0x200
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x3c]
movzx eax, word [rbp - 0x22]
shl rax, 4
add rax, rdx
mov rcx, qword [rax + 8]
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x3c]
movzx eax, word [rbp - 0x22]
shl rax, 4
add rax, rdx
mov rdx, qword [rax]
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x20], eax
mov r9, rcx
mov r8, rdx
mov rdx, 0xffffffffffffffff
mov ecx, 2
call fcn.140024080
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0
jne 0x140009d6a
lea r9, str.Failed_to_protect_memory
mov r8d, 0x11b
lea rdx, str.CoffeeExecuteFunction
lea rcx, [0x14003c77c]
call fcn.140035970
mov eax, 0
jmp 0x14000a0ff
movzx eax, word [rbp - 0x22]
add eax, 1
mov word [rbp - 0x22], ax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
movzx eax, word [rax + 2]
cmp word [rbp - 0x22], ax
jb 0x140009bbe
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x4c]
test rax, rax
je 0x140009dfa
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x4c]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x44]
mov dword [rsp + 0x20], 2
mov r9, rdx
mov r8, rax
mov rdx, 0xffffffffffffffff
mov ecx, 2
call fcn.140024080
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0
jne 0x140009dfa
lea r9, str.Failed_to_protect_memory
mov r8d, 0x127
lea rdx, str.CoffeeExecuteFunction
lea rcx, [0x14003c77c]
call fcn.140035970
mov eax, 0
jmp 0x14000a0ff
mov dword [rbp - 0x28], 0
jmp 0x140009f14
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x20]
mov edx, dword [rbp - 0x28]
mov rax, rdx
shl rax, 3
add rax, rdx
add rax, rax
add rax, rcx
mov eax, dword [rax]
test eax, eax
je 0x140009e48
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x20]
mov edx, dword [rbp - 0x28]
mov rax, rdx
shl rax, 3
add rax, rdx
add rax, rax
add rax, rcx
mov qword [rbp - 0x18], rax
jmp 0x140009e95
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x20]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov eax, dword [rax + 0xc]
mov ecx, eax
mov rax, rcx
shl rax, 3
add rax, rcx
add rax, rax
lea r8, [rdx + rax]
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x20]
mov edx, dword [rbp - 0x28]
mov rax, rdx
shl rax, 3
add rax, rdx
add rax, rax
add rax, rcx
mov eax, dword [rax + 4]
mov eax, eax
add rax, r8
mov qword [rbp - 0x18], rax
mov ecx, dword [rbp - 0x30]
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 0x18]
mov r8d, ecx
mov rcx, rax
call fcn.140023970
test eax, eax
jne 0x140009f10
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x3c]
mov rax, qword [rbp + 0x10]
mov r8, qword [rax + 0x20]
mov edx, dword [rbp - 0x28]
mov rax, rdx
shl rax, 3
add rax, rdx
add rax, rax
add rax, r8
movzx eax, word [rax + 0xc]
movzx eax, ax
shl rax, 4
sub rax, 0x10
add rax, rcx
mov rcx, qword [rax]
mov rax, qword [rbp + 0x10]
mov r8, qword [rax + 0x20]
mov edx, dword [rbp - 0x28]
mov rax, rdx
shl rax, 3
add rax, rdx
add rax, rax
add rax, r8
mov eax, dword [rax + 8]
mov eax, eax
add rax, rcx
mov qword [rbp - 8], rax
jmp 0x140009f28
add dword [rbp - 0x28], 1
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov eax, dword [rax + 0xc]
cmp dword [rbp - 0x28], eax
jb 0x140009e06
cmp qword [rbp - 8], 0
jne 0x140009f99
mov rax, qword [rbp + 0x18]
mov r9, rax
mov r8d, 0x144
lea rdx, str.CoffeeExecuteFunction
lea rcx, str._DEBUG::_s::_d______Couldnt_find_function____s_n
call fcn.140035970
mov eax, dword [rbp + 0x30]
mov edx, eax
mov ecx, 0x14
call fcn.140024b30
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov edx, 2
mov rcx, rax
call fcn.140024790
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 0x40]
mov rcx, rax
call fcn.140024980
mov rax, qword [rbp - 0x40]
mov rcx, rax
call fcn.140024cb0
mov eax, 0
jmp 0x14000a0ff
mov dword [rbp - 0x1c], 0
mov word [rbp - 0x2a], 0
jmp 0x14000a05f
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x3c]
movzx eax, word [rbp - 0x2a]
shl rax, 4
add rax, rdx
mov rax, qword [rax]
mov rdx, rax
mov rax, qword [rbp - 8]
cmp rdx, rax
ja 0x14000a054
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x3c]
movzx eax, word [rbp - 0x2a]
shl rax, 4
add rax, rdx
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x3c]
movzx eax, word [rbp - 0x2a]
shl rax, 4
add rax, rdx
mov rax, qword [rax + 8]
lea rdx, [rcx + rax]
mov rax, qword [rbp - 8]
cmp rdx, rax
jbe 0x14000a054
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
movzx edx, word [rbp - 0x2a]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, 0x14
lea rdx, [rcx + rax]
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x14000a077
mov dword [rbp - 0x1c], 1
jmp 0x14000a077
movzx eax, word [rbp - 0x2a]
add eax, 1
mov word [rbp - 0x2a], ax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
movzx eax, word [rax + 2]
cmp word [rbp - 0x2a], ax
jb 0x140009fab
jmp 0x14000a078
nop
cmp dword [rbp - 0x1c], 0
jne 0x14000a0a5
mov rax, qword [rbp - 8]
mov r9, rax
mov r8d, 0x15f
lea rdx, str.CoffeeExecuteFunction
lea rcx, str._DEBUG::_s::_d__The_entry_point___p__is_not_on_executable_memory_n
call fcn.140035970
mov eax, 0
jmp 0x14000a0ff
lea r9, str.___Execute_coffee_main_n
mov r8d, 0x163
lea rdx, str.CoffeeExecuteFunction
lea rcx, [0x14003c77c]
call fcn.140035970
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp - 8]
mov r8, rcx
mov rcx, rax
call fcn.14000a110
cmp qword [rbp - 0x10], 0
je 0x14000a0fa
mov rax, qword [0x14003d880]
mov rdx, qword [rax + 0x1b0]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov eax, 1
add rsp, 0x70
pop rbp
ret