Function at 0x40495b
Capabilities:
Capture screenshot
Change the wallpaper
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x6d2e59f6
push 9
push 0x412630
call fcn.00408397
push eax
mov eax, dword [ebp + 8]
call fcn.0040f6a0
mov esi, eax
add esp, 0x14
mov dword [ebp - 8], esi
cmp esi, ebx
je 0x404da7
push ebx
push 0x4f81fb8d
push 0x10
push 0x41263c
call fcn.00408397
push eax
mov eax, esi
call fcn.0040f6a0
add esp, 0x14
call fcn.0040f75c
or eax, edx
je 0x404da7
push ebx
push 0x76c138c2
push 4
push 0x412380
call fcn.00408397
add esp, 0x10
lea ecx, [ebp - 0x24]
push ecx
push ecx
push eax
mov eax, esi
call fcn.0040f6a0
pop ecx
mov edi, eax
call fcn.0040f7c3
pop ecx
push eax
call fcn.00403a0e
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x404da7
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, ebx
je 0x404da7
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov dword [ebp - 0x28], edi
cmp edi, ebx
je 0x404d9d
push 8
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0xa
push dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
call esi
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x404d96
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push 0x413b1dd5
push 4
push 0x412650
mov dword [ebp - 0x24], eax
call fcn.00408397
add esp, 0x10
push 0x48
push 0x5a
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
call esi
push eax
push dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0040f6a0
pop ecx
call fcn.0040f75c
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x6d33a81c
mov esi, eax
push 8
push 0x412658
neg esi
call fcn.00408770
add esp, 0xc
push eax
push ebx
push 4
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [ebp - 0x3c], eax
cmp eax, ebx
je 0x404d83
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push 0x74de91f4
push 0xa
push 0x412664
mov dword [ebp - 0x40], eax
call fcn.00408397
push eax
mov eax, dword [ebp - 8]
call fcn.0040f6a0
add esp, 0x14
call fcn.0040f75c
push eax
push edi
call dword [sym.imp.GDI32.dll_SetBkColor]
push ebx
push 0x99839038
push 5
push 0x412670
call fcn.00408397
push eax
mov eax, dword [ebp - 8]
call fcn.0040f6a0
add esp, 0x14
call fcn.0040f75c
push eax
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
push 2
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x10]
imul eax, esi
push 0xa
xor edx, edx
pop ecx
div ecx
cmp eax, ebx
jbe 0x404bc3
mov dword [ebp - 8], eax
mov esi, 0xff
mov eax, esi
call fcn.00408d42
movzx eax, al
shl eax, 8
mov dword [ebp - 0x1c], eax
mov eax, esi
call fcn.00408d42
movzx esi, al
or esi, dword [ebp - 0x1c]
mov eax, 0xff
shl esi, 8
call fcn.00408d42
movzx eax, al
or eax, esi
push eax
mov eax, dword [ebp - 0x2c]
call fcn.00408d42
push eax
mov eax, dword [ebp - 0x30]
call fcn.00408d42
push eax
push edi
call dword [sym.imp.GDI32.dll_SetPixel]
dec dword [ebp - 8]
jne 0x404b6d
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push 0x411
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x50]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x18]
mov dword [ebp - 0x48], esi
mov esi, dword [sym.imp.USER32.dll_DrawTextA]
push edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
call esi
mov eax, dword [ebp - 0x44]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x2c]
cdq
sub eax, edx
sar eax, 1
sar ecx, 1
sub eax, ecx
push 0x11
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x18]
push edi
call esi
lea eax, [ebp - 0xa0]
push eax
push 0x18
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_GetObjectW]
push 9
xor eax, eax
pop ecx
xor edx, edx
lea edi, [ebp - 0x84]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x98]
inc edx
mov dword [ebp - 0x84], eax
mov word [ebp - 0x7c], dx
push 0x20
shl eax, 5
pop edx
mov word [ebp - 0x7a], dx
add eax, 0x1f
cdq
and edx, 0x1f
lea esi, [edx + eax]
sar esi, 5
imul esi, ecx
shl esi, 2
push ebx
mov edi, esi
mov dword [ebp - 0x88], 0x28
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x78], ebx
call fcn.00405fb6
pop ecx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x404d6b
push ebx
lea ecx, [ebp - 0x88]
push ecx
push eax
push dword [ebp - 0x98]
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0x68c62922
push 4
push 0x412678
call fcn.00408770
add esp, 0xc
push eax
call fcn.00409d45
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x404d63
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x404d5b
xor eax, eax
lea edi, [ebp - 0x5e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esi + 0x36]
mov dword [ebp - 0x5e], eax
mov eax, 0x4d42
push ebx
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x10]
push eax
push 0xe
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x56], 0x36
mov dword [ebp - 0x10], ebx
call edi
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x28
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0xc]
call edi
push ebx
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 8]
mov esi, dword [ebp - 0xc]
push esi
call edi
push esi
call fcn.00403fa9
pop ecx
call fcn.004087bc
push 3
push dword [ebp - 0x18]
push ebx
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov esi, dword [ebp - 0x18]
call fcn.004060d7
mov esi, dword [ebp - 8]
call fcn.004060d7
push dword [ebp - 0x40]
push dword [ebp - 0x28]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x3c]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [ebp - 0x28]
push dword [ebp - 0x24]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
leave
ret