joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010bb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f13f8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
push 4
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCFullScreenBubbleWin.0
mov dword [esi + 4], vtable.RC::RCFullScreenBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCFullScreenBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCFullScreenBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCFullScreenBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCFullScreenBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCFullScreenBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCFullScreenBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCFullScreenBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCFullScreenBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCFullScreenBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCFullScreenBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCFullScreenBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCFullScreenBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCFullScreenBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCFullScreenBubbleWin.15.0
mov dword [eax], vtable.RC::RCFullScreenBubbleWin.16.0
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], ecx
mov byte [esi + 0xa0], 1
mov dword [esi + 0x84], ecx
mov dword [esi + 0x90], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x10010cd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f13c8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x14]
mov dword [ecx], vtable.RC::RCFullScreenBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCFullScreenBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCFullScreenBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCFullScreenBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCFullScreenBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCFullScreenBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCFullScreenBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCFullScreenBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCFullScreenBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCFullScreenBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCFullScreenBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCFullScreenBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCFullScreenBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCFullScreenBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCFullScreenBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCFullScreenBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCFullScreenBubbleWin.16.0
mov dword [esp + 0xc], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x10011720
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f13f8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCLoginBubbleWin.0
mov dword [esi + 4], vtable.RC::RCLoginBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCLoginBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCLoginBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCLoginBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCLoginBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCLoginBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCLoginBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCLoginBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCLoginBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCLoginBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCLoginBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCLoginBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCLoginBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCLoginBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCLoginBubbleWin.15.0
mov dword [eax], vtable.RC::RCLoginBubbleWin.16.0
mov dword [esi + 0x90], eax
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8

Function at 0x10011830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f13c8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x14]
mov dword [ecx], vtable.RC::RCLoginBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCLoginBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCLoginBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCLoginBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCLoginBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCLoginBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCLoginBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCLoginBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCLoginBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCLoginBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCLoginBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCLoginBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCLoginBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCLoginBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCLoginBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCLoginBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCLoginBubbleWin.16.0
mov dword [esp + 0xc], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x10012760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f13f8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCStatusBubbleWin.0
mov dword [esi + 4], vtable.RC::RCStatusBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCStatusBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCStatusBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCStatusBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCStatusBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCStatusBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCStatusBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCStatusBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCStatusBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCStatusBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCStatusBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCStatusBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCStatusBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCStatusBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCStatusBubbleWin.15.0
mov dword [eax], vtable.RC::RCStatusBubbleWin.16.0
mov dword [esi + 0x98], ecx
mov dword [esi + 0x90], eax
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8

Function at 0x10012870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1228
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 4], ecx
mov dword [ecx], vtable.RC::RCStatusBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCStatusBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCStatusBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCStatusBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCStatusBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCStatusBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCStatusBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCStatusBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCStatusBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCStatusBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCStatusBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCStatusBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCStatusBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCStatusBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCStatusBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCStatusBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCStatusBubbleWin.16.0
mov dword [esp + 0x10], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x100136d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f13f8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.10001690
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea ecx, [esi + 0x94]
mov dword [esi], vtable.RC::RCAdsBlockTipBubbleWin.0
mov dword [esi + 4], vtable.RC::RCAdsBlockTipBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCAdsBlockTipBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCAdsBlockTipBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCAdsBlockTipBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCAdsBlockTipBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCAdsBlockTipBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCAdsBlockTipBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCAdsBlockTipBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCAdsBlockTipBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCAdsBlockTipBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCAdsBlockTipBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCAdsBlockTipBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCAdsBlockTipBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCAdsBlockTipBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCAdsBlockTipBubbleWin.15.0
mov dword [ecx], vtable.RC::RCAdsBlockTipBubbleWin.16.0
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x90], ecx
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xd8], eax
mov dword [esi + 0xdc], eax
mov byte [esi + 0xe0], al
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x10013830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f13c8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x14]
mov dword [ecx], vtable.RC::RCAdsBlockTipBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCAdsBlockTipBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCAdsBlockTipBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCAdsBlockTipBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCAdsBlockTipBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCAdsBlockTipBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCAdsBlockTipBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCAdsBlockTipBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCAdsBlockTipBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCAdsBlockTipBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCAdsBlockTipBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCAdsBlockTipBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCAdsBlockTipBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCAdsBlockTipBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCAdsBlockTipBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCAdsBlockTipBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCAdsBlockTipBubbleWin.16.0
mov dword [esp + 0xc], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x10016630
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1258
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push edi
push esi
call fcn.10001690
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea ecx, [esi + 0x94]
mov dword [esi], vtable.RC::RCFavSynBubbleWin.0
mov dword [esi + 4], vtable.RC::RCFavSynBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCFavSynBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCFavSynBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCFavSynBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCFavSynBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCFavSynBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCFavSynBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCFavSynBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCFavSynBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCFavSynBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCFavSynBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCFavSynBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCFavSynBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCFavSynBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCFavSynBubbleWin.15.0
mov dword [ecx], vtable.RC::RCFavSynBubbleWin.16.0
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x68], edi
mov dword [esi + 0x90], ecx
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10016760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f13c8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x14]
mov dword [ecx], vtable.RC::RCFavSynBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCFavSynBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCFavSynBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCFavSynBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCFavSynBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCFavSynBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCFavSynBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCFavSynBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCFavSynBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCFavSynBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCFavSynBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCFavSynBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCFavSynBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCFavSynBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCFavSynBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCFavSynBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCFavSynBubbleWin.16.0
mov dword [esp + 0xc], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4

Function at 0x10017320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1258
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x19
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCAddressBarBubbleWin.0
mov dword [esi + 4], vtable.RC::RCAddressBarBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCAddressBarBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCAddressBarBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCAddressBarBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCAddressBarBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCAddressBarBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCAddressBarBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCAddressBarBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCAddressBarBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCAddressBarBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCAddressBarBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCAddressBarBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCAddressBarBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCAddressBarBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCAddressBarBubbleWin.15.0
mov dword [eax], vtable.RC::RCAddressBarBubbleWin.16.0
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0x90], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10017430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1228
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 4], ecx
mov dword [ecx], vtable.RC::RCAddressBarBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCAddressBarBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCAddressBarBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCAddressBarBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCAddressBarBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCAddressBarBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCAddressBarBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCAddressBarBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCAddressBarBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCAddressBarBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCAddressBarBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCAddressBarBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCAddressBarBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCAddressBarBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCAddressBarBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCAddressBarBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCAddressBarBubbleWin.16.0
mov dword [esp + 0x10], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x10017c50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1258
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x1a
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCSelectUIRenderBubbleWin.0
mov dword [esi + 4], vtable.RC::RCSelectUIRenderBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCSelectUIRenderBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCSelectUIRenderBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCSelectUIRenderBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCSelectUIRenderBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCSelectUIRenderBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCSelectUIRenderBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCSelectUIRenderBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCSelectUIRenderBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCSelectUIRenderBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCSelectUIRenderBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCSelectUIRenderBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCSelectUIRenderBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCSelectUIRenderBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCSelectUIRenderBubbleWin.15.0
mov dword [eax], vtable.RC::RCSelectUIRenderBubbleWin.16.0
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], 3
mov dword [esi + 0x90], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10017d70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1228
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 4], ecx
mov dword [ecx], vtable.RC::RCSelectUIRenderBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCSelectUIRenderBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCSelectUIRenderBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCSelectUIRenderBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCSelectUIRenderBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCSelectUIRenderBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCSelectUIRenderBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCSelectUIRenderBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCSelectUIRenderBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCSelectUIRenderBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCSelectUIRenderBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCSelectUIRenderBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCSelectUIRenderBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCSelectUIRenderBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCSelectUIRenderBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCSelectUIRenderBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCSelectUIRenderBubbleWin.16.0
mov dword [esp + 0x10], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x10018710
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1258
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x1b
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCUIRenderModeAdvanceBubbleWin.0
mov dword [esi + 4], vtable.RC::RCUIRenderModeAdvanceBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCUIRenderModeAdvanceBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCUIRenderModeAdvanceBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCUIRenderModeAdvanceBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCUIRenderModeAdvanceBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCUIRenderModeAdvanceBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCUIRenderModeAdvanceBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCUIRenderModeAdvanceBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCUIRenderModeAdvanceBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCUIRenderModeAdvanceBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCUIRenderModeAdvanceBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCUIRenderModeAdvanceBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCUIRenderModeAdvanceBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCUIRenderModeAdvanceBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCUIRenderModeAdvanceBubbleWin.15.0
mov dword [eax], vtable.RC::RCUIRenderModeAdvanceBubbleWin.16.0
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0x90], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4