Function at 0x140009260
Capabilities:
Inspect section memory permissions
Print debug messages

Disassembly:
push r15
push r14
push r13
mov r13, rdx
push r12
xor r12d, r12d
push rbp
push rdi
mov rdi, rcx
mov rcx, rdx
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0xa8], r9
call sym.StringLengthA
mov rbx, qword [0x14002d650]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
cmp dword [rax + 0xf4], 0
je 0x140009302
lea r9, str.Register_VEH_handler...
mov r8d, 0x10a
lea rdx, str.CoffeeExecuteFunction
lea rcx, [0x14002701f]
call sym.printf.constprop.0_4
mov rax, qword [rbx]
mov ecx, 1
lea rdx, [sym.VehDebugger]
call qword [rax + 0x1b0]
mov r12, rax
test rax, rax
jne 0x140009302
mov rax, qword [rbx]
mov ecx, 1
mov rax, qword [rax + 0x8c2]
mov edx, dword [rax + 0x68]
call sym.PackageTransmitError
jmp 0x140009511
xor esi, esi
lea rbp, str.CoffeeExecuteFunction
lea r15, str._DEBUG::_s::_d__Unknown_protection:__x
mov rax, qword [rdi + 8]
cmp word [rax + 2], si
jbe 0x140009411
movzx r14d, si
mov rdx, qword [rdi]
imul rax, r14, 0x28
lea rax, [rdx + rax + 0x14]
cmp dword [rax + 0x10], 0
mov qword [rdi + 0x10], rax
je 0x14000940a
mov r9d, dword [rax + 0x24]
mov eax, 1
mov edx, r9d
and edx, 0xe0000000
je 0x1400093c3
mov eax, 0x10
cmp edx, 0x20000000
je 0x1400093c3
mov eax, 2
cmp edx, 0x40000000
je 0x1400093c3
mov eax, 0x20
cmp edx, 0x60000000
je 0x1400093c3
mov eax, 8
cmp edx, 0x80000000
je 0x1400093c3
mov eax, pe_nt_image_headers64
cmp edx, 0xa0000000
je 0x1400093c3
mov eax, 4
cmp edx, 0xc0000000
je 0x1400093c3
mov eax, 0x40
cmp edx, 0xe0000000
je 0x1400093c3
mov r8d, 0x12d
mov rdx, rbp
mov rcx, r15
call sym.DbgPrint
mov eax, 0x40
mov rdx, qword [rdi + 0x10]
test byte [rdx + 0x27], 4
je 0x1400093d0
or ah, 2
mov r10, r14
or rdx, 0xffffffffffffffff
mov ecx, 2
shl r10, 4
add r10, qword [rdi + 0x3c]
mov r9, qword [r10 + 8]
mov dword [rsp + 0x20], eax
mov r8, qword [r10]
call sym.MmVirtualProtect
mov r14d, eax
test eax, eax
jne 0x14000940a
lea r9, str.Failed_to_protect_memory
mov r8d, 0x137
jmp 0x14000944c
inc esi
jmp 0x140009312
mov r9, qword [rdi + 0x4c]
test r9, r9
jne 0x14000941e
xor ebp, ebp
jmp 0x140009466
mov dword [rsp + 0x20], 2
mov r8, qword [rdi + 0x44]
or rdx, 0xffffffffffffffff
mov ecx, 2
call sym.MmVirtualProtect
mov r14d, eax
test eax, eax
jne 0x14000941a
lea r9, str.Failed_to_protect_memory
mov r8d, 0x143
lea rdx, str.CoffeeExecuteFunction
lea rcx, [0x14002701f]
call sym.printf.constprop.0_4
jmp 0x1400095c9
inc ebp
mov rax, qword [rdi + 8]
mov eax, dword [rax + 0xc]
cmp eax, ebp
jbe 0x1400094c1
mov esi, ebp
mov rdx, qword [rdi + 0x20]
imul rsi, rsi, 0x12
lea rcx, [rdx + rsi]
cmp dword [rcx], 0
jne 0x140009492
imul rax, rax, 0x12
mov ecx, dword [rcx + 4]
add rax, rcx
lea rcx, [rdx + rax]
mov r8d, dword [rsp + 0x38]
mov rdx, r13
call sym.MemCompare
mov r14d, eax
test eax, eax
jne 0x140009464
add rsi, qword [rdi + 0x20]
mov rax, qword [rdi + 0x3c]
movzx edx, word [rsi + 0xc]
mov r15d, dword [rsi + 8]
shl rdx, 4
add r15, qword [rax + rdx - 0x10]
jne 0x140009519
mov r9, r13
mov r8d, 0x160
lea rdx, str.CoffeeExecuteFunction
lea rcx, str._DEBUG::_s::_d______Couldnt_find_function____s_n
call sym.DbgPrint
mov edx, dword [rsp + 0xb0]
mov ecx, 0x14
call sym.PackageCreateWithRequestID
mov edx, 2
mov r12, rax
mov rcx, rax
call sym.PackageAddInt32
mov rcx, r12
mov rdx, r13
call sym.PackageAddString
mov rcx, r12
call sym.PackageTransmit
xor r14d, r14d
jmp 0x1400095c9
mov rdx, qword [rdi + 8]
mov r8w, word [rdx + 2]
xor edx, edx
jmp 0x140009535
mov rcx, qword [rax]
cmp rcx, r15
jbe 0x14000953d
inc rdx
add rax, 0x10
cmp r8w, dx
ja 0x140009526
jmp 0x14000955c
add rcx, qword [rax + 8]
cmp r15, rcx
jae 0x14000952e
imul rdx, rdx, 0x28
mov rax, qword [rdi]
lea rax, [rax + rdx + 0x14]
mov qword [rdi + 0x10], rax
test byte [rax + 0x27], 0x20
jne 0x14000957a
mov r9, r15
mov r8d, 0x17b
lea rdx, str.CoffeeExecuteFunction
lea rcx, str._DEBUG::_s::_d__The_entry_point___p__is_not_on_executable_memory_n
call sym.DbgPrint
jmp 0x1400095c9
mov r8d, 0x17f
lea rdx, str.CoffeeExecuteFunction
lea rcx, [0x14002701f]
lea r9, str.___Execute_coffee_main_n
call sym.printf.constprop.0_4
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rcx, r15
call sym.CoffeeFunction
test r12, r12
je 0x1400095c3
mov rax, qword [rbx]
mov rcx, r12
call qword [rax + 0x1b8]
mov r14d, 1
add rsp, 0x48
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret