joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018820
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1228
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 4], ecx
mov dword [ecx], vtable.RC::RCUIRenderModeAdvanceBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCUIRenderModeAdvanceBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCUIRenderModeAdvanceBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCUIRenderModeAdvanceBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCUIRenderModeAdvanceBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCUIRenderModeAdvanceBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCUIRenderModeAdvanceBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCUIRenderModeAdvanceBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCUIRenderModeAdvanceBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCUIRenderModeAdvanceBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCUIRenderModeAdvanceBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCUIRenderModeAdvanceBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCUIRenderModeAdvanceBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCUIRenderModeAdvanceBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCUIRenderModeAdvanceBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCUIRenderModeAdvanceBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCUIRenderModeAdvanceBubbleWin.16.0
mov dword [esp + 0x10], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x10018c80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1258
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x1c
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCUIRenderModeNormalBubbleWin.0
mov dword [esi + 4], vtable.RC::RCUIRenderModeNormalBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCUIRenderModeNormalBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCUIRenderModeNormalBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCUIRenderModeNormalBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCUIRenderModeNormalBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCUIRenderModeNormalBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCUIRenderModeNormalBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCUIRenderModeNormalBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCUIRenderModeNormalBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCUIRenderModeNormalBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCUIRenderModeNormalBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCUIRenderModeNormalBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCUIRenderModeNormalBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCUIRenderModeNormalBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCUIRenderModeNormalBubbleWin.15.0
mov dword [eax], vtable.RC::RCUIRenderModeNormalBubbleWin.16.0
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0x90], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10018d90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1228
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 4], ecx
mov dword [ecx], vtable.RC::RCUIRenderModeNormalBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCUIRenderModeNormalBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCUIRenderModeNormalBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCUIRenderModeNormalBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCUIRenderModeNormalBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCUIRenderModeNormalBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCUIRenderModeNormalBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCUIRenderModeNormalBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCUIRenderModeNormalBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCUIRenderModeNormalBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCUIRenderModeNormalBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCUIRenderModeNormalBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCUIRenderModeNormalBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCUIRenderModeNormalBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCUIRenderModeNormalBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCUIRenderModeNormalBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCUIRenderModeNormalBubbleWin.16.0
mov dword [esp + 0x10], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x100190e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1258
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x1d
push esi
call fcn.10001690
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea eax, [esi + 0x94]
mov dword [esi], vtable.RC::RCUIRenderModeUnknownBubbleWin.0
mov dword [esi + 4], vtable.RC::RCUIRenderModeUnknownBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCUIRenderModeUnknownBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCUIRenderModeUnknownBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCUIRenderModeUnknownBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCUIRenderModeUnknownBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCUIRenderModeUnknownBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCUIRenderModeUnknownBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCUIRenderModeUnknownBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCUIRenderModeUnknownBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCUIRenderModeUnknownBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCUIRenderModeUnknownBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCUIRenderModeUnknownBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCUIRenderModeUnknownBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCUIRenderModeUnknownBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCUIRenderModeUnknownBubbleWin.15.0
mov dword [eax], vtable.RC::RCUIRenderModeUnknownBubbleWin.16.0
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0x90], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x100191f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1228
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 4], ecx
mov dword [ecx], vtable.RC::RCUIRenderModeUnknownBubbleWin.0
mov dword [ecx + 4], vtable.RC::RCUIRenderModeUnknownBubbleWin.1.0
mov dword [ecx + 8], vtable.RC::RCUIRenderModeUnknownBubbleWin.2.0
mov dword [ecx + 0xc], vtable.RC::RCUIRenderModeUnknownBubbleWin.3.0
mov dword [ecx + 0x10], vtable.RC::RCUIRenderModeUnknownBubbleWin.4.0
mov dword [ecx + 0x14], vtable.RC::RCUIRenderModeUnknownBubbleWin.5.0
mov dword [ecx + 0x18], vtable.RC::RCUIRenderModeUnknownBubbleWin.6.0
mov dword [ecx + 0x1c], vtable.RC::RCUIRenderModeUnknownBubbleWin.7.0
mov dword [ecx + 0x20], vtable.RC::RCUIRenderModeUnknownBubbleWin.8.0
mov dword [ecx + 0x24], vtable.RC::RCUIRenderModeUnknownBubbleWin.9.0
mov dword [ecx + 0x28], vtable.RC::RCUIRenderModeUnknownBubbleWin.10.0
mov dword [ecx + 0x2c], vtable.RC::RCUIRenderModeUnknownBubbleWin.11.0
mov dword [ecx + 0x30], vtable.RC::RCUIRenderModeUnknownBubbleWin.12.0
mov dword [ecx + 0x3c], vtable.RC::RCUIRenderModeUnknownBubbleWin.13.0
mov dword [ecx + 0x60], vtable.RC::RCUIRenderModeUnknownBubbleWin.14.0
mov dword [ecx + 0x64], vtable.RC::RCUIRenderModeUnknownBubbleWin.15.0
mov dword [ecx + 0x94], vtable.RC::RCUIRenderModeUnknownBubbleWin.16.0
mov dword [esp + 0x10], 0xffffffff
call fcn.100017d0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x10019640
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101fac67
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x1e
push esi
call fcn.10001690
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea edi, [esi + 0x94]
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
lea eax, [esi + 0xa4]
push eax
mov dword [esi], vtable.RC::RCWebsiteSecurityHarmBubbleWin.0
mov dword [esi + 4], vtable.RC::RCWebsiteSecurityHarmBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCWebsiteSecurityHarmBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCWebsiteSecurityHarmBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCWebsiteSecurityHarmBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCWebsiteSecurityHarmBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCWebsiteSecurityHarmBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCWebsiteSecurityHarmBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCWebsiteSecurityHarmBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCWebsiteSecurityHarmBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCWebsiteSecurityHarmBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCWebsiteSecurityHarmBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCWebsiteSecurityHarmBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCWebsiteSecurityHarmBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCWebsiteSecurityHarmBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCWebsiteSecurityHarmBubbleWin.15.0
mov dword [edi], vtable.RC::RCWebsiteSecurityHarmBubbleWin.16.0
call fcn.100195b0
mov byte [esp + 0x14], 1
mov dword [esi + 0x90], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x10019810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f11f7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.RC::RCWebsiteSecurityHarmBubbleWin.0
mov dword [esi + 4], vtable.RC::RCWebsiteSecurityHarmBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCWebsiteSecurityHarmBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCWebsiteSecurityHarmBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCWebsiteSecurityHarmBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCWebsiteSecurityHarmBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCWebsiteSecurityHarmBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCWebsiteSecurityHarmBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCWebsiteSecurityHarmBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCWebsiteSecurityHarmBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCWebsiteSecurityHarmBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCWebsiteSecurityHarmBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCWebsiteSecurityHarmBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCWebsiteSecurityHarmBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCWebsiteSecurityHarmBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCWebsiteSecurityHarmBubbleWin.15.0
mov dword [esi + 0x94], vtable.RC::RCWebsiteSecurityHarmBubbleWin.16.0
mov dword [esp + 0x14], 0
lea eax, [esi + 0xa4]
push eax
call fcn.10019760
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.100017d0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x10019e40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101fac27
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x1f
push esi
call fcn.10001690
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
lea edi, [esi + 0x94]
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
lea eax, [esi + 0xa8]
push eax
mov dword [esi], vtable.RC::RCWebsiteSecuritySafeBubbleWin.0
mov dword [esi + 4], vtable.RC::RCWebsiteSecuritySafeBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCWebsiteSecuritySafeBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCWebsiteSecuritySafeBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCWebsiteSecuritySafeBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCWebsiteSecuritySafeBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCWebsiteSecuritySafeBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCWebsiteSecuritySafeBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCWebsiteSecuritySafeBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCWebsiteSecuritySafeBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCWebsiteSecuritySafeBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCWebsiteSecuritySafeBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCWebsiteSecuritySafeBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCWebsiteSecuritySafeBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCWebsiteSecuritySafeBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCWebsiteSecuritySafeBubbleWin.15.0
mov dword [edi], vtable.RC::RCWebsiteSecuritySafeBubbleWin.16.0
call fcn.100195b0
mov byte [esp + 0x14], 1
mov dword [esi + 0x90], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x10019f60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f11b7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.RC::RCWebsiteSecuritySafeBubbleWin.0
mov dword [esi + 4], vtable.RC::RCWebsiteSecuritySafeBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCWebsiteSecuritySafeBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCWebsiteSecuritySafeBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCWebsiteSecuritySafeBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCWebsiteSecuritySafeBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCWebsiteSecuritySafeBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCWebsiteSecuritySafeBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCWebsiteSecuritySafeBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCWebsiteSecuritySafeBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCWebsiteSecuritySafeBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCWebsiteSecuritySafeBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCWebsiteSecuritySafeBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCWebsiteSecuritySafeBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCWebsiteSecuritySafeBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCWebsiteSecuritySafeBubbleWin.15.0
mov dword [esi + 0x94], vtable.RC::RCWebsiteSecuritySafeBubbleWin.16.0
mov dword [esp + 0x14], 0
lea eax, [esi + 0xa8]
push eax
call fcn.10019760
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.100017d0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x1001af70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f1182
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor edi, edi
mov dword [esp + 0x20], edi
push 0x20
push esi
call fcn.10001690
mov byte [esp + 0x20], 1
mov dword [esi + 0x94], vtable.RC::IBubbleCommonCallback.0
mov dword [esi + 0x98], vtable.RC::ICloudServiceControllerEvent.0
lea ebp, [esi + 0x94]
mov dword [esi], vtable.RC::RCUserCenterBubbleWin.0
mov dword [esi + 4], vtable.RC::RCUserCenterBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCUserCenterBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCUserCenterBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCUserCenterBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCUserCenterBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCUserCenterBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCUserCenterBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCUserCenterBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCUserCenterBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCUserCenterBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCUserCenterBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCUserCenterBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCUserCenterBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCUserCenterBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCUserCenterBubbleWin.15.0
mov dword [ebp], vtable.RC::RCUserCenterBubbleWin.16.0
mov dword [esi + 0x98], vtable.RC::RCUserCenterBubbleWin.17.0
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov byte [esp + 0x20], 2
mov dword [esi + 0x11c], edi
mov eax, 7
mov dword [esi + 0x148], eax
mov dword [esi + 0x144], edi
mov word [esi + 0x134], di
mov byte [esp + 0x20], 3
mov dword [esi + 0x164], eax
mov dword [esi + 0x160], edi
mov word [esi + 0x150], di
mov byte [esp + 0x20], 4
mov dword [esi + 0x180], eax
mov dword [esi + 0x17c], edi
mov word [esi + 0x16c], di
mov byte [esp + 0x20], 5
mov dword [esi + 0x184], edi
mov byte [esp + 0x20], 6
mov ebx, dword [esp + 0x2c]
cmp ebx, edi
mov dword [esi + 0x188], ebx
je 0x1001b0ef
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
mov byte [esp + 0x20], 7
mov eax, 0x20
mov dword [esi + 0x90], ebp
mov dword [esi + 0x120], eax
mov dword [esi + 0x124], eax
mov dword [esi + 0x128], eax
mov dword [esi + 0x12c], 1
mov dword [esp + 0x20], 0xffffffff
cmp ebx, edi
je 0x1001b130
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x1001b170
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101f10fa
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.RC::RCUserCenterBubbleWin.0
mov dword [esi + 4], vtable.RC::RCUserCenterBubbleWin.1.0
mov dword [esi + 8], vtable.RC::RCUserCenterBubbleWin.2.0
mov dword [esi + 0xc], vtable.RC::RCUserCenterBubbleWin.3.0
mov dword [esi + 0x10], vtable.RC::RCUserCenterBubbleWin.4.0
mov dword [esi + 0x14], vtable.RC::RCUserCenterBubbleWin.5.0
mov dword [esi + 0x18], vtable.RC::RCUserCenterBubbleWin.6.0
mov dword [esi + 0x1c], vtable.RC::RCUserCenterBubbleWin.7.0
mov dword [esi + 0x20], vtable.RC::RCUserCenterBubbleWin.8.0
mov dword [esi + 0x24], vtable.RC::RCUserCenterBubbleWin.9.0
mov dword [esi + 0x28], vtable.RC::RCUserCenterBubbleWin.10.0
mov dword [esi + 0x2c], vtable.RC::RCUserCenterBubbleWin.11.0
mov dword [esi + 0x30], vtable.RC::RCUserCenterBubbleWin.12.0
mov dword [esi + 0x3c], vtable.RC::RCUserCenterBubbleWin.13.0
mov dword [esi + 0x60], vtable.RC::RCUserCenterBubbleWin.14.0
mov dword [esi + 0x64], vtable.RC::RCUserCenterBubbleWin.15.0
mov dword [esi + 0x94], vtable.RC::RCUserCenterBubbleWin.16.0
mov dword [esi + 0x98], vtable.RC::RCUserCenterBubbleWin.17.0
mov dword [esp + 0x18], 6
mov ecx, dword [esi + 0x184]
xor ebx, ebx
cmp ecx, ebx
je 0x1001b23d
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [esi + 0x184], ebx
mov byte [esp + 0x18], 5
mov ecx, dword [esi + 0x188]
cmp ecx, ebx
je 0x1001b253
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov byte [esp + 0x18], 4
mov ecx, dword [esi + 0x184]
cmp ecx, ebx
je 0x1001b269
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov byte [esp + 0x18], 3
cmp dword [esi + 0x180], 8
jb 0x1001b286
mov eax, dword [esi + 0x16c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x180], 7
mov dword [esi + 0x17c], ebx
mov word [esi + 0x16c], bx
mov byte [esp + 0x18], 2
cmp dword [esi + 0x164], 8
jb 0x1001b2ba
mov eax, dword [esi + 0x150]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x164], 7
mov dword [esi + 0x160], ebx
mov word [esi + 0x150], bx
mov byte [esp + 0x18], 1
cmp dword [esi + 0x148], 8
jb 0x1001b2ee
mov eax, dword [esi + 0x134]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x148], 7
mov dword [esi + 0x144], ebx
mov word [esi + 0x134], bx
mov byte [esp + 0x18], bl
mov eax, dword [esi + 0x10c]
cmp eax, ebx
je 0x1001b31c
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], ebx
mov dword [esp + 0x18], 0xffffffff
mov ecx, esi
call fcn.100017d0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x1001f1a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push edi
mov edi, eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1001f1d8
mov edi, dword [edi + 4]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x1001f248
push edi
call dword [sym.imp.USER32.dll_GetParent]
pop edi
add esp, 4
mov dword [esp + 4], eax
jmp dword [sym.imp.USER32.dll_SetFocus]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
push 0x11
shr eax, 7
and al, 1
mov byte [esp + 0x13], al
call esi
movzx ebx, ax
shr ebx, 7
push 0x12
and bl, 1
call esi
pop esi
shr eax, 7
and al, 1
test bl, bl
pop ebx
je 0x1001f23e
cmp byte [esp + 7], 0
jne 0x1001f23e
test al, al
jne 0x1001f23e
cmp word [esp + 0xc], 0x41
jne 0x1001f23e
mov ecx, dword [edi + 4]
push 0xffffffffffffffff
push 0
push 0xb1
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [edi + 0x18]
mov dword [edx + 0x20], 1
pop edi
pop ecx
ret 4
mov eax, dword [edi + 0x18]
mov dword [eax + 0x20], 0
pop edi
pop ecx
ret 4