joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d6b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0x114
call fcn.004d1df0
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47d71a
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x47d703
cmp eax, 4
jne 0x47d71a
cmp dword [esp + 8], 0x5a
jb 0x47d71a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c8f08
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.004c8f08
add esp, 0x118
ret

Function at 0x47da90
Capabilities:
Copy file
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4ed370
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, 7
xor ebp, ebp
xor ecx, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], cx
push 0xffffffffffffffff
mov dword [esp + 0x6c], ebp
push ebp
mov dword [esp + 0x44], eax
xor edx, edx
push ebx
lea eax, [esp + 0x30]
mov dword [esp + 0x44], ebp
mov word [esp + 0x34], dx
call fcn.00401850
mov byte [esp + 0x68], 1
cmp dword [esp + 0x3c], 8
mov eax, dword [esp + 0x28]
jae 0x47db18
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [esp + 0x18], 0x50ae54
mov dword [esp + 0x1c], 0x50ae78
mov dword [esp + 0x20], str.Config.json
xor edi, edi
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push ebp
push eax
lea eax, [esp + 0x4c]
call fcn.00401850
push 0xffffffffffffffff
push ebp
push ebx
lea eax, [esp + 0x30]
call fcn.00401850
mov esi, dword [esp + edi*4 + 0x18]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x47db61
sub eax, edx
sar eax, 1
push eax
push esi
lea eax, [esp + 0x48]
call fcn.004088a0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x47db80
sub eax, edx
sar eax, 1
push eax
push esi
lea eax, [esp + 0x2c]
call fcn.004088a0
mov ecx, dword [esp + 0x28]
mov eax, 8
cmp dword [esp + 0x3c], eax
jae 0x47dbad
lea ecx, [esp + 0x28]
cmp dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
jae 0x47dbbb
lea eax, [esp + 0x44]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
inc edi
cmp edi, 3
jb 0x47db3a
mov esi, 8
cmp dword [esp + 0x3c], esi
jb 0x47dbe7
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004c8f17
add esp, 4
xor edx, edx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], dx
cmp dword [esp + 0x58], esi
jb 0x47dc0d
mov eax, dword [esp + 0x44]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004c8f08
add esp, 0x58
ret
Function at 0x47e070
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4ee1eb
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x458]
mov dword fs:[0], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREDTLSoftWallPaper
push Ordinal_4
xor bl, bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x47e146
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x256]
push edx
mov word [esp + 0x258], cx
call fcn.004d1df0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x250]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.Apppath
push eax
mov dword [esp + 0x30], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x24c]
push ecx
call edi
test eax, eax
jle 0x47e137
mov bl, 1
mov edx, dword [esp + 0x14]
push edx
call ebp
test bl, bl
jne 0x47e27c
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWAREDTLSoftWallPaper
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x47e178
mov edx, dword [esp + 0x1c]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
push 0x20006
push 0
push str.SOFTWAREDTLSoftWallPaper
push Ordinal_4
call esi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x4e]
push edx
mov esi, eax
mov word [esp + 0x50], cx
call fcn.004d1df0
add esp, 0xc
push 0x104
lea eax, [esp + 0x48]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test esi, esi
jne 0x47e212
lea edx, [esp + 0x44]
push edx
call edi
mov edx, dword [esp + 0x14]
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x48]
push ecx
push 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.Apppath
push edx
call esi
mov ecx, dword [esp + 0x14]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.unionid
push ecx
mov dword [esp + 0x30], 0x457
call esi
mov edi, str.CreateLink.dll
lea ecx, [esp + 0x28]
call fcn.00460ea0
mov dword [esp + 0x460], 0
mov eax, dword [esp + 0x2c]
mov edi, 8
cmp dword [esp + 0x40], edi
jae 0x47e23e
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x47e269
push str.CreateWallPaperLink
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47e262
push 0x5048c8
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x40], edi
jb 0x47e27c
mov edx, dword [esp + 0x2c]
push edx
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x458]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.004c8f08
add esp, 0x450
ret
Function at 0x47e2b0
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4ef288
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
lea esi, [esp + 0x30]
call fcn.0047fd80
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x47e2ef
mov eax, dword [eax + 4]
jmp 0x47e2f2
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
cmp dword [esp + 0x48], ebp
jb 0x47e311
mov eax, dword [esp + 0x34]
push eax
call fcn.004c8f17
add esp, 4
test bl, bl
je 0x47e38c
lea esi, [esp + 0x4c]
call fcn.0047fd80
mov edi, eax
xor ebx, ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x70], ebx
call fcn.0047fed0
cmp dword [edi + 0x18], ebp
jb 0x47e339
mov edi, dword [edi + 4]
jmp 0x47e33c
add edi, 4
cmp dword [eax + 0x18], ebp
jb 0x47e346
mov eax, dword [eax + 4]
jmp 0x47e349
add eax, 4
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x2c], ebp
jb 0x47e366
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004c8f17
add esp, 4
xor edx, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
cmp dword [esp + 0x64], ebp
jb 0x47e38c
mov eax, dword [esp + 0x50]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret

Function at 0x47e3a0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ed332
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x220], eax
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
push 0x104
lea eax, [esp + 0x28]
xor edi, edi
push eax
mov dword [esp + 0x240], edi
mov esi, ecx
push edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
call fcn.00480950
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push ecx
lea edx, [esp + 0x40]
push 0x50aff8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov word [esi + 4], ax
lea eax, [esp + 0x24]
mov dword [esp + 0x238], edi
mov dword [esp + 0x1c], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x47e476
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00401760
mov eax, esi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004c8f08
add esp, 0x230
ret
Function at 0x47e4c0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4ed2e2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
xor ebp, ebp
mov esi, ecx
mov dword [esp + 0x14], ebp
mov eax, 7
lea ebx, [edi + 4]
xor ecx, ecx
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], esi
mov word [ebx], cx
mov ecx, 1
mov dword [esp + 0x230], ebp
mov dword [esp + 0x14], ecx
test byte [0x534b74], cl
jne 0x47e55c
or dword [0x534b74], ecx
xor edx, edx
push 0x4f9f10
mov dword [0x534b70], eax
mov dword [0x534b6c], ebp
mov word [0x534b5c], dx
call fcn.004c9e97
add esp, 4
cmp dword [0x534b6c], ebp
jne 0x47e5c1
push ebp
push 0x1a
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x47e580
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x20]
push ecx
mov esi, 0x534b58
call fcn.00401760
push 0xd
push str.DtlWallPaper
mov eax, esi
call fcn.004088a0
cmp dword [edi + 0x18], 8
jb 0x47e5b5
mov ebx, dword [ebx]
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [esp + 0x10]
push 0xffffffffffffffff
push ebp
push 0x534b58
mov eax, edi
call fcn.00401850
cmp word [esi], 0x5c
je 0x47e5e4
push 1
push 0x4fea60
mov eax, edi
call fcn.004088a0
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x47e5f0
sub eax, edx
sar eax, 1
push eax
push esi
mov eax, edi
call fcn.004088a0
mov eax, edi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004c8f08
add esp, 0x224
ret

Function at 0x47e930
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47e948
mov eax, dword [eax + 4]
jmp 0x47e94b
add eax, 4
push eax
push 1
push str.startrun
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47e974
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47e980
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47e998
mov eax, dword [eax + 4]
jmp 0x47e99b
add eax, 4
push eax
push 0
push str.AdminstratorUser
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47e9c4
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret
Function at 0x47eb40
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x814]
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004d1df0
push ebx
mov dword [esp + 0x18], 0
call fcn.0047e9d0
xor edx, edx
test bl, bl
setne dl
mov edi, str.startrun
push edx
call fcn.0047f9a0
add esp, 0x14
call fcn.0047eca0
cmp bl, al
je 0x47ec87
push esi
push 0x50938c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x400
lea ecx, [esp + 0x1a]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.___start
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push Ordinal_4
call esi
test bl, bl
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x47ec2e
test eax, eax
jne 0x47ec7b
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0xc]
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x18]
push eax
push 1
push 0
push 0x504080
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x47ec7b
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x47ec44
mov edx, dword [esp + 0xc]
push 0x504080
push edx
call edi
lea eax, [esp + 0x10]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push Ordinal_4
mov dword [esp + 0x24], 0
call esi
test eax, eax
jne 0x47ec7b
mov ecx, dword [esp + 0xc]
push 0x504080
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x47ec87
push eax
call ebx
mov ecx, dword [esp + 0x810]
pop edi
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x80c
ret

Function at 0x47eca0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push Ordinal_4
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47ed53
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1a]
push edx
mov dword [esp + 0x18], 1
mov word [esp + 0x1c], cx
call fcn.004d1df0
add esp, 0xc
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x504080
push eax
mov dword [esp + 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
setg al
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004c8f08
add esp, 0x218
ret
mov ecx, dword [esp + 0x218]
mov al, bl
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x218
ret
Function at 0x47ee20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47ee38
mov eax, dword [eax + 4]
jmp 0x47ee3b
add eax, 4
push eax
push 1
push str.autoupdate
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47ee64
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47ee70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47ee88
mov eax, dword [eax + 4]
jmp 0x47ee8b
add eax, 4
push eax
push 1
push str.enableanimation
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47eeb4
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47eec0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47eed8
mov eax, dword [eax + 4]
jmp 0x47eedb
add eax, 4
push eax
push 1
push str.addmenuinterface
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47ef04
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47ef10
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47ef28
mov eax, dword [eax + 4]
jmp 0x47ef2b
add eax, 4
push eax
push 0
push str.autoswitch_set
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47ef54
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47ef60
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47ef78
mov eax, dword [eax + 4]
jmp 0x47ef7b
add eax, 4
push eax
push 0
push str.autoswitch_shou
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47efa4
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47efb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47efc8
mov eax, dword [eax + 4]
jmp 0x47efcb
add eax, 4
push eax
push 0
push str.autoswitch_local
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47eff4
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret
Function at 0x47f000
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f018
mov eax, dword [eax + 4]
jmp 0x47f01b
add eax, 4
push eax
push 0
push str.autoswitch_switch
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f044
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47f050
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x228
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.004d1df0
mov edx, dword [esp + 0x23c]
push edx
push str.autoswitch_color_d
lea eax, [esp + 0x34]
push 0x104
push eax
call fcn.004ca693
add esp, 0x1c
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f0af
mov eax, dword [eax + 4]
jmp 0x47f0b2
add eax, 4
push eax
push 0
lea ecx, [esp + 0x28]
push ecx
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f0db
mov edx, dword [esp + 8]
push edx
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x228]
xor eax, eax
test esi, esi
setne al
pop esi
xor ecx, esp
call fcn.004c8f08
add esp, 0x228
ret

Function at 0x47f180
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f198
mov eax, dword [eax + 4]
jmp 0x47f19b
add eax, 4
push eax
push 0
push str.HasShowTutorial
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f1c4
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47f1d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f1e8
mov eax, dword [eax + 4]
jmp 0x47f1eb
add eax, 4
push eax
push 0
push str.HasShowRiliSwitchSkinTutorial
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f214
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47f220
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f238
mov eax, dword [eax + 4]
jmp 0x47f23b
add eax, 4
push eax
push 1
push str.ShowTopSide
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f264
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret
Function at 0x47f2c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f2d8
mov eax, dword [eax + 4]
jmp 0x47f2db
add eax, 4
push eax
push 1
push str.ShowRightSide
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f304
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47f370
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f388
mov eax, dword [eax + 4]
jmp 0x47f38b
add eax, 4
push eax
push 1
push str.desktoppaperinterface
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f3b4
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47f3c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f3d8
mov eax, dword [eax + 4]
jmp 0x47f3db
add eax, 4
push eax
push 1
push str.autohiderightside
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f404
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47f480
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f498
mov eax, dword [eax + 4]
jmp 0x47f49b
add eax, 4
push eax
push 1
push str.ShowRightSide_main
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f4c4
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47f510
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f528
mov eax, dword [eax + 4]
jmp 0x47f52b
add eax, 4
push eax
push 1
push str.ShowRightSide_next
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f554
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x47f5a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push esi
lea esi, [esp + 4]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x47f5b8
mov eax, dword [eax + 4]
jmp 0x47f5bb
add eax, 4
push eax
push 1
push str.ShowRightSide_collect
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x1c], 8
mov esi, eax
jb 0x47f5e4
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x1c
ret