joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a945
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042f88a
and dword [ebp - 4], 0
cmp dword [0x454778], 0
mov ebx, eax
jne 0x43a9f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43aaa7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x447118
push edi
call esi
test eax, eax
je 0x43aaa7
push eax
call fcn.0042f818
mov dword [esp], 0x447108
push edi
mov dword [0x454778], eax
call esi
push eax
call fcn.0042f818
mov dword [esp], 0x4470f4
push edi
mov dword [0x45477c], eax
call esi
push eax
call fcn.0042f818
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x454780], eax
call esi
push eax
call fcn.0042f818
pop ecx
mov dword [0x454788], eax
test eax, eax
je 0x43a9f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042f818
pop ecx
mov dword [0x454784], eax
mov eax, dword [0x454784]
cmp eax, ebx
je 0x43aa4e
cmp dword [0x454788], ebx
je 0x43aa4e
push eax
call fcn.0042f893
push dword [0x454788]
mov esi, eax
call fcn.0042f893
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43aa4e
test edi, edi
je 0x43aa4e
call esi
test eax, eax
je 0x43aa45
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43aa45
test byte [ebp - 0xc], 1
jne 0x43aa4e
or dword [ebp + 0x10], 0x200000
jmp 0x43aa87
mov eax, dword [0x45477c]
cmp eax, ebx
je 0x43aa87
push eax
call fcn.0042f893
pop ecx
test eax, eax
je 0x43aa87
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43aa87
mov eax, dword [0x454780]
cmp eax, ebx
je 0x43aa87
push eax
call fcn.0042f893
pop ecx
test eax, eax
je 0x43aa87
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x454778]
call fcn.0042f893
pop ecx
test eax, eax
je 0x43aaa7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43aaa9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x70de41df
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x722f7bcd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431ffd
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10001690
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101e6448
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
push esi
call fcn.10001e00
xor edi, edi
mov dword [esp + 0x18], edi
lea ebx, [esi + 0x3c]
push ebx
call fcn.1002c1f0
mov byte [esp + 0x18], 1
mov dword [esi + 0x60], vtable.IEventBase.0
mov byte [esp + 0x18], 2
mov dword [esi + 0x64], vtable.RC::RCTimerEvent.0
mov byte [esp + 0x18], 3
lea eax, [esi + 0x74]
push eax
mov dword [esi], vtable.RC::RCBubbleCommon.0
mov dword [esi + 4], vtable.RC::RCBubbleCommon.1.0
mov dword [esi + 8], vtable.RC::RCBubbleCommon.2.0
mov dword [esi + 0xc], vtable.RC::RCBubbleCommon.3.0
mov dword [esi + 0x10], vtable.RC::RCBubbleCommon.4.0
mov dword [esi + 0x14], vtable.RC::RCBubbleCommon.5.0
mov dword [esi + 0x18], vtable.RC::RCBubbleCommon.6.0
mov dword [esi + 0x1c], vtable.RC::RCBubbleCommon.7.0
mov dword [esi + 0x20], vtable.RC::RCBubbleCommon.8.0
mov dword [esi + 0x24], vtable.RC::RCBubbleCommon.9.0
mov dword [esi + 0x28], vtable.RC::RCBubbleCommon.10.0
mov dword [esi + 0x2c], vtable.RC::RCBubbleCommon.11.0
mov dword [esi + 0x30], vtable.RC::RCBubbleCommon.12.0
mov dword [ebx], vtable.RC::RCBubbleCommon.13.0
mov dword [esi + 0x60], vtable.RC::RCBubbleCommon.14.0
mov dword [esi + 0x64], vtable.RC::RCBubbleCommon.15.0
call fcn.101c4ba0
mov byte [esp + 0x18], 4
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x68], ecx
mov dword [esi + 0x90], edi
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x100017d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101e63eb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 0x3c]
mov dword [esi], vtable.RC::RCBubbleCommon.0
mov dword [esi + 4], vtable.RC::RCBubbleCommon.1.0
mov dword [esi + 8], vtable.RC::RCBubbleCommon.2.0
mov dword [esi + 0xc], vtable.RC::RCBubbleCommon.3.0
mov dword [esi + 0x10], vtable.RC::RCBubbleCommon.4.0
mov dword [esi + 0x14], vtable.RC::RCBubbleCommon.5.0
mov dword [esi + 0x18], vtable.RC::RCBubbleCommon.6.0
mov dword [esi + 0x1c], vtable.RC::RCBubbleCommon.7.0
mov dword [esi + 0x20], vtable.RC::RCBubbleCommon.8.0
mov dword [esi + 0x24], vtable.RC::RCBubbleCommon.9.0
mov dword [esi + 0x28], vtable.RC::RCBubbleCommon.10.0
mov dword [esi + 0x2c], vtable.RC::RCBubbleCommon.11.0
mov dword [esi + 0x30], vtable.RC::RCBubbleCommon.12.0
mov dword [edi], vtable.RC::RCBubbleCommon.13.0
mov dword [esi + 0x60], vtable.RC::RCBubbleCommon.14.0
mov dword [esi + 0x64], vtable.RC::RCBubbleCommon.15.0
mov dword [esp + 0x24], 3
lea eax, [esi + 0x74]
push eax
call fcn.101c4c00
mov byte [esp + 0x24], 2
mov dword [esi + 0x64], vtable.RC::RCTimerEvent.0
mov byte [esp + 0x24], 1
xor al, al
mov dword [esi + 0x60], vtable.IEventBase.0
mov byte [esp + 0x24], al
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], al
add edi, 8
push edi
call fcn.100010c0
mov dword [esp + 0x24], 0xffffffff
mov ecx, esi
call fcn.10001ee0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x10001e00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101d5e75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.100020f0
mov dword [esp + 0x14], 0
push 4
mov dword [esi], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.1.0
mov dword [esi + 4], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.2.0
mov dword [esi + 8], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.3.0
mov dword [esi + 0xc], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.4.0
mov dword [esi + 0x10], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.5.0
mov dword [esi + 0x14], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.6.0
mov dword [esi + 0x18], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.7.0
mov dword [esi + 0x1c], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.8.0
mov dword [esi + 0x20], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.9.0
mov dword [esi + 0x24], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.10.0
mov dword [esi + 0x28], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.11.0
mov dword [esi + 0x2c], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.12.0
mov dword [esi + 0x30], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.0
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 8], eax
mov byte [esp + 0x14], 1
test eax, eax
je 0x10001ead
mov dword [eax], 0
jmp 0x10001eaf
xor eax, eax
mov byte [esp + 0x14], 0
mov dword [esi + 0x38], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10001ee0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101d5e3a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.1.0
mov dword [esi + 4], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.2.0
mov dword [esi + 8], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.3.0
mov dword [esi + 0xc], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.4.0
mov dword [esi + 0x10], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.5.0
mov dword [esi + 0x14], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.6.0
mov dword [esi + 0x18], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.7.0
mov dword [esi + 0x1c], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.8.0
mov dword [esi + 0x20], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.9.0
mov dword [esi + 0x24], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.10.0
mov dword [esi + 0x28], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.11.0
mov dword [esi + 0x2c], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.12.0
mov dword [esi + 0x30], vtable.RC::RCDirectUIWindow_class_RC::RCRefCountImpl1_class_RC::IBubbleWin__.0
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0x38]
test eax, eax
je 0x10001f81
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x38], 0
mov dword [esp + 0x14], 0xffffffff
push esi
call fcn.100021b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x100020f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101d5e15
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
push esi
call fcn.10002230
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], vtable.RC::RCRefCounted.0
mov dword [esi + 0x34], eax
mov byte [esp + 0x10], 1
mov dword [esi], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.1.0
mov dword [esi + 4], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.2.0
mov dword [esi + 8], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.3.0
mov dword [esi + 0xc], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.4.0
mov dword [esi + 0x10], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.5.0
mov dword [esi + 0x14], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.6.0
mov dword [esi + 0x18], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.7.0
mov dword [esi + 0x1c], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.8.0
mov dword [esi + 0x20], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.9.0
mov dword [esi + 0x24], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.10.0
mov dword [esi + 0x28], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.11.0
mov dword [esi + 0x2c], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.12.0
mov dword [esi + 0x30], vtable.RC::RCRefCountImpl1_class_RC::IBubbleWin_.0
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x10004600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101f175b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x1000465c
push 0xc4
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x1000464f
push eax
call fcn.1000fd60
jmp 0x10004651
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x4c], eax
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10004699
mov edx, dword [esp + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax]
push edx
mov edx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
add esi, 4
push esi
push edx
mov edx, dword [esp + 0x30]
push edx
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14

Function at 0x10004750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101f175b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x100047ae
push 0xc4
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x100047a1
push 1
push eax
call fcn.1000e290
jmp 0x100047a3
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x50]
test eax, eax
je 0x100047ee
mov edx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
add esi, 8
push esi
push edx
mov edx, dword [esp + 0x30]
lea ecx, [eax + 8]
mov eax, dword [ecx]
mov eax, dword [eax]
push edx
mov edx, dword [esp + 0x30]
push edx
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14
Function at 0x10004810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101f175b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x54], 0
jne 0x1000486e
push 0xc4
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x10004861
push 2
push eax
call fcn.1000e290
jmp 0x10004863
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x54]
test eax, eax
je 0x100048ae
mov edx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
add esi, 8
push esi
push edx
mov edx, dword [esp + 0x30]
lea ecx, [eax + 8]
mov eax, dword [ecx]
mov eax, dword [eax]
push edx
mov edx, dword [esp + 0x30]
push edx
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14

Function at 0x10008450
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x101f1696
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.10008590
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.RC::RCCloudServiceController.0
mov dword [esi + 4], vtable.RC::RCCloudServiceController.1.0
mov dword [esi + 8], vtable.RC::RCCloudServiceController.2.0
mov dword [esi + 0xc], vtable.RC::RCCloudServiceController.3.0
mov dword [esi + 0x14], edi
mov byte [esp + 0x14], 1
mov dword [esi + 0x18], edi
mov byte [esp + 0x14], 2
mov dword [esi + 0x1c], edi
mov byte [esp + 0x14], 3
mov dword [esi + 0x20], edi
mov byte [esp + 0x14], 4
mov dword [esi + 0x24], edi
mov byte [esp + 0x14], 5
mov dword [esi + 0x2c], edi
mov byte [esp + 0x14], 6
push 0x18
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
push eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esp + 0x14], 7
lea eax, [esi + 0x38]
push eax
call fcn.1017b520
mov byte [esp + 0x14], 8
push 0x10008780
push 0x10008730
push 4
push 0x28
lea ecx, [esi + 0x44]
push ecx
call fcn.101d1bb6
mov byte [esp + 0x14], 9
lea edx, [esi + 0xe4]
push edx
call fcn.1000bd80
mov byte [esp + 0x14], 0xa
call fcn.1000c9f0
mov dword [esi + 0xfc], eax
mov dword [esi + 0x100], edi
mov byte [esp + 0x14], 0xb
mov eax, esi
mov byte [esi + 0x28], 1
call fcn.1000a830
mov dword [esi + 0x30], edi
mov dword [esi + 0xf4], 2
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x1000e290
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1476
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCDownLoadBubbleWin.0
mov dword [esi + 4], vtable.RC::RCDownLoadBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCDownLoadBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCDownLoadBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCDownLoadBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCDownLoadBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCDownLoadBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCDownLoadBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCDownLoadBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCDownLoadBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCDownLoadBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCDownLoadBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCDownLoadBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCDownLoadBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCDownLoadBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCDownLoadBubbleWin.15.0
mov dword [eax], vtable.RC::RCDownLoadBubbleWin.16.0
mov dword [esi + 0xb8], 7
mov dword [esi + 0xb4], ecx
mov word [esi + 0xa4], cx
mov byte [esp + 0x10], 1
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], ecx
mov dword [esi + 0x90], eax
mov dword [esi + 0xbc], ecx
mov dword [esi + 0xc0], ecx
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x1000e3d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1476
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov dword [esi], vtable.RC::RCDownLoadBubbleWin.0
mov dword [esi + 4], vtable.RC::RCDownLoadBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCDownLoadBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCDownLoadBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCDownLoadBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCDownLoadBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCDownLoadBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCDownLoadBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCDownLoadBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCDownLoadBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCDownLoadBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCDownLoadBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCDownLoadBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCDownLoadBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCDownLoadBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCDownLoadBubbleWin.15.0
mov dword [esi + 0x94], vtable.RC::RCDownLoadBubbleWin.16.0
mov dword [esp + 0x10], 0
cmp dword [esi + 0xb8], 8
jb 0x1000e48e
mov eax, dword [esi + 0xa4]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0xb8], 7
mov dword [esi + 0xb4], 0
mov word [esi + 0xa4], 0
mov dword [esp + 0x10], 0xffffffff
mov ecx, esi
call fcn.100017d0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x1000fd60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1436
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
push edi
push esi
call fcn.10001690
mov dword [esp + 0x14], edi
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCAdsBlockBubbleWin.0
mov dword [esi + 4], vtable.RC::RCAdsBlockBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCAdsBlockBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCAdsBlockBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCAdsBlockBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCAdsBlockBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCAdsBlockBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCAdsBlockBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCAdsBlockBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCAdsBlockBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCAdsBlockBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCAdsBlockBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCAdsBlockBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCAdsBlockBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCAdsBlockBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCAdsBlockBubbleWin.15.0
mov dword [eax], vtable.RC::RCAdsBlockBubbleWin.16.0
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xb8], 7
mov dword [esi + 0xb4], edi
mov word [esi + 0xa4], di
mov byte [esp + 0x14], 1
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x90], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x1000fea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1476
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov dword [esi], vtable.RC::RCAdsBlockBubbleWin.0
mov dword [esi + 4], vtable.RC::RCAdsBlockBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCAdsBlockBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCAdsBlockBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCAdsBlockBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCAdsBlockBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCAdsBlockBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCAdsBlockBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCAdsBlockBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCAdsBlockBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCAdsBlockBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCAdsBlockBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCAdsBlockBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCAdsBlockBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCAdsBlockBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCAdsBlockBubbleWin.15.0
mov dword [esi + 0x94], vtable.RC::RCAdsBlockBubbleWin.16.0
mov dword [esp + 0x10], 0
cmp dword [esi + 0xb8], 8
jb 0x1000ff5e
mov eax, dword [esi + 0xa4]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0xb8], 7
mov dword [esi + 0xb4], 0
mov word [esi + 0xa4], 0
mov dword [esp + 0x10], 0xffffffff
mov ecx, esi
call fcn.100017d0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x100103a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x40]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret