Function at 0x474b40
Capabilities:
Change the wallpaper
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4d3e6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6e0
mov eax, dword [0x4f0930]
mov cx, word [0x4f0934]
mov dl, byte [0x4f0936]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x138], eax
mov word [esp + 0x13c], cx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x13f]
mov byte [esp + 0x13e], dl
push 0x7f02
rep stosd dword es:[edi], eax
push 0
mov dword [esp + 0x20], 1
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edi, dword [esp + 0x700]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x704]
push 0
push 0
push eax
push edi
lea ecx, [esp + 0x60]
call fcn.00473c00
push 0x466
lea ecx, [esp + 0x54]
mov dword [esp + 0x6fc], 0
call fcn.00473e80
lea ecx, [esp + 0x50]
call fcn.00473f20
mov esi, dword [esp + 0x71c]
test esi, esi
je 0x474c13
push esi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x474c13
xor esi, esi
mov ebp, dword [esp + 0x70c]
mov ebx, dword [esp + 0x710]
test ebp, ebp
je 0x475363
push ebp
lea ecx, [esp + 0xc4]
call fcn.0049c790
lea ecx, [esp + 0x398]
push 0x122
push ecx
push 0x463
push edi
mov byte [esp + 0x708], 1
call dword [sym.imp.USER32.dll_LoadStringA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x398]
push edx
call edi
mov ecx, 0x122
lea edx, [esp + 0x398]
sub ecx, eax
push ecx
push edx
call edi
lea eax, [esp + eax + 0x39c]
push eax
push ebp
call sub.comdlg32.dll_GetFileTitleA
lea ecx, [esp + 0x398]
push ecx
lea ecx, [esp + 0x54]
call fcn.00473ec0
lea ecx, [esp + 0x50]
call fcn.00473f20
lea ecx, [esp + 0x90]
call fcn.0049c390
push 0
call fcn.004a6ff8
push 1
mov dword [esp + 0x94], eax
call fcn.004a6ff8
mov edi, ebx
mov dword [esp + 0x94], eax
and edi, 6
je 0x474ce5
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
mov ebp, dword [sym.imp.KERNEL32.dll_MulDiv]
test esi, esi
je 0x474d59
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
call fcn.0049ddf0
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
mov dword [esp + 0x14], eax
call fcn.0049de70
test edi, edi
mov dword [esp + 0x14], eax
je 0x474d21
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
jmp 0x474d25
mov eax, dword [esp + 0x10]
mov edx, dword [esi + 8]
mov edi, dword [esi]
sub edx, edi
inc edx
push edx
push eax
mov eax, dword [esp + 0x98]
push eax
call ebp
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
sub ecx, edx
mov edx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x90], eax
push ecx
push edx
push eax
call ebp
mov dword [esp + 0x94], eax
call fcn.00470ad0
mov dword [esp + 0x98], eax
sub eax, 8
neg eax
sbb eax, eax
mov ecx, dword [esp + 0x718]
and al, 0xfe
mov dword [esp + 0xa4], ecx
add eax, 3
lea edx, [esp + 0x50]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x714]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0xc4]
mov dword [esp + 0xb8], 1
mov dword [esp + 0xbc], 0x4740a0
mov dword [esp + 0xc0], edx
call fcn.0049ce00
test eax, eax
jne 0x474e4b
lea ecx, [esp + 0x50]
call fcn.00473fa0
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x474e1c
mov esi, dword [esp + 0x700]
lea ecx, [esp + 0x348]
push 0x50
push ecx
push esi
lea ecx, [esp + 0xcc]
call fcn.0049e7a0
mov eax, dword [esp + 0x704]
push 0
lea edx, [esp + 0x34c]
push 0x466
push edx
push eax
push esi
call fcn.004714c0
add esp, 0x14
lea ecx, [esp + 0xc0]
mov byte [esp + 0x6f8], 0
call fcn.0049cb20
lea ecx, [esp + 0x50]
mov dword [esp + 0x6f8], 0xffffffff
call fcn.00473c60
xor eax, eax
jmp 0x4754d6
test bl, 8
je 0x474e57
push 0xb4
jmp 0x474e67
test bl, 2
je 0x474e60
push 0xffffffffffffffa6
jmp 0x474e67
test bl, 4
je 0x474e73
push 0x5a
lea ecx, [esp + 0xc4]
call fcn.0049ead0
push 0x14
call fcn.004bd49b
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
test edi, edi
mov byte [esp + 0x6f8], 2
je 0x474ea7
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
call fcn.0049e1e0
push eax
mov ecx, edi
call fcn.004819d0
jmp 0x474ea9
xor eax, eax
push 0
lea ecx, [esp + 0xc4]
mov dword [esp + 0x18], eax
mov byte [esp + 0x6fc], 1
mov edi, eax
call fcn.0049e550
test esi, esi
je 0x474f99
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
call fcn.0049dfa0
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0xc8]
call fcn.0049ddf0
mov ecx, dword [esi]
push eax
push ecx
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
mov dword [esi], eax
call fcn.0049e050
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0xc8]
call fcn.0049de70
mov edx, dword [esi + 4]
push eax
push edx
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
mov dword [esi + 4], eax
call fcn.0049dfa0
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0xc8]
call fcn.0049ddf0
push eax
mov eax, dword [esi + 8]
push eax
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
mov dword [esi + 8], eax
call fcn.0049e050
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0xc8]
call fcn.0049de70
mov ecx, dword [esi + 0xc]
push eax
push ecx
call ebp
lea edx, [esp + 0x50]
mov ebp, edi
push edx
push 0x4740a0
push esi
push ebp
mov dword [esi + 0xc], eax
call fcn.00482f50
mov esi, eax
add esp, 0x10
test esi, esi
je 0x474f99
test ebp, ebp
je 0x474f97
mov ecx, ebp
call fcn.00481dd0
push ebp
call fcn.004bd4c4
add esp, 4
mov edi, esi
test bl, 0x10
je 0x475100
push 0x46e
lea ecx, [esp + 0x54]
call fcn.00473ee0
lea ecx, [esp + 0x50]
call fcn.00473f20
push 0x4e
call fcn.004a6ff8
mov esi, eax
push 0x4f
mov dword [esp + 0x1c], esi
call fcn.004a6ff8
mov ebp, eax
test esi, esi
mov dword [esp + 0x1c], ebp
jne 0x474ff0
push esi
call fcn.004a6ff8
mov esi, eax
push 1
mov dword [esp + 0x1c], esi
call fcn.004a6ff8
mov ebp, eax
mov dword [esp + 0x1c], ebp
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
call fcn.0049ddf0
cmp esi, eax
je 0x475100
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
call fcn.0049de70
cmp ebp, eax
je 0x475100
fild dword [esp + 0x18]
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
fstp dword [esp + 0x14]
call fcn.0049ddf0
mov dword [esp + 0x14], eax
push 0xffffffffffffffff
fild dword [esp + 0x18]
lea ecx, [esp + 0xc4]
fdivr dword [esp + 0x14]
fstp dword [esp + 0x18]
fild dword [esp + 0x20]
fstp dword [esp + 0x1c]
call fcn.0049de70
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fdivr dword [esp + 0x18]
fld dword [esp + 0x14]
fcomp st(1)
fnstsw ax
test ah, 1
je 0x47507d
mov eax, dword [esp + 0x14]
fstp st(0)
mov dword [esp + 0x10], eax
jmp 0x475081
fstp dword [esp + 0x10]
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
call fcn.0049ddf0
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul dword [esp + 0x10]
fadd dword [0x4d6900]
call fcn.004a7d38
push 0xffffffffffffffff
lea ecx, [esp + 0xc4]
mov esi, eax
call fcn.0049de70
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul dword [esp + 0x10]
fadd dword [0x4d6900]
call fcn.004a7d38
lea ecx, [esp + 0x50]
push ecx
push 0x4740a0
push 5
push eax
push esi
push edi
call fcn.004828d0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x475100
test edi, edi
je 0x4750fe
mov ecx, edi
call fcn.00481dd0
push edi
call fcn.004bd4c4
add esp, 4
mov edi, esi
lea edx, [esp + 0x4bc]
push 0x105
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4f092c
lea eax, [esp + 0x244]
push str._s_Wallpaper.bmp
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x4c8]
push ecx
lea eax, [esp + 0x148]
push edx
push eax
call fcn.00471100
add esp, 0x18
lea ecx, [esp + 0x50]
push 0x467
call fcn.00473ee0
push 1
push 0
lea ecx, [esp + 0x58]
call fcn.00474000
lea ecx, [esp + 0x50]
lea edx, [esp + 0x138]
push ecx
push 0x4740a0
push edx
push 0
push 0x504d42
push edi
call fcn.004a5f30
add esp, 0x18
xor ecx, ecx
test eax, eax
sete cl
test edi, edi
mov esi, ecx
je 0x4751a5
mov ecx, edi
call fcn.00481dd0
push edi
call fcn.004bd4c4
add esp, 4
lea ecx, [esp + 0xc0]
mov byte [esp + 0x6f8], 0
call fcn.0049cb20
test esi, esi
je 0x475467
mov ebp, dword [esp + 0x70c]
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0
lea ecx, [esp + 0x54]
call fcn.00474190
push 0x468
lea ecx, [esp + 0x54]
call fcn.00473ee0
push 1
push 0
lea ecx, [esp + 0x58]
call fcn.00474000
lea ecx, [esp + 0x50]
call fcn.00473f20
push str.Control_Paneldesktop
push DrawStatusTextA
lea ecx, [esp + 0x2c]
call fcn.0046fdd0
mov ax, word [0x4f08fc]
xor edx, edx
mov dword [esp + 0x19], edx
xor ecx, ecx
mov dword [esp + 0x1d], edx
mov dword [esp + 0x82], ecx
mov byte [esp + 0x21], dl
mov dl, byte [0x4f55a8]
mov word [esp + 0x80], ax
mov dword [esp + 0x86], ecx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x241]
mov byte [esp + 0x240], dl
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x45], eax
mov dword [esp + 0x39], ecx
and bl, 1
mov dword [esp + 0x49], eax
mov dword [esp + 0x3d], ecx
or bl, 0x30
mov byte [esp + 0x6f8], 3
test ebp, ebp
mov byte [esp + 0x44], dl
mov byte [esp + 0x4d], al
mov byte [esp + 0x38], dl
mov byte [esp + 0x41], cl
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], cl
je 0x47536c
lea edx, [esp + 0x10]
lea eax, [esp + 0x240]
push edx
push eax
push str.Wallpaper
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0x105
call fcn.004701a0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x44]
push ecx
mov edi, 0xa
push edx
push str.TileWallpaper
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], edi
call fcn.004701a0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
push str.WallpaperStyle
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], edi
call fcn.004701a0
lea edx, [esp + 0x138]
lea eax, [esp + 0x240]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4753cf
lea ecx, [esp + 0x240]
push ecx
push str.PrevWallpaper
lea ecx, [esp + 0x2c]
call fcn.00470360
lea edx, [esp + 0x44]
lea ecx, [esp + 0x24]
push edx
push str.PrevTileWallpaper
call fcn.00470360
lea eax, [esp + 0x38]
lea ecx, [esp + 0x24]
push eax
push str.PrevWallpaperStyle
call fcn.00470360
jmp 0x4753cf
mov esi, dword [esp + 0x18]
jmp 0x4751c8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x138]
push ecx
push edx
push str.PrevWallpaper
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0x105
call fcn.004701a0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov edi, 0xa
push ecx
push str.PrevTileWallpaper
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], edi
call fcn.004701a0
lea edx, [esp + 0x10]
lea eax, [esp + 0x80]
push edx
push eax
push str.PrevWallpaperStyle
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], edi
call fcn.004701a0
lea ecx, [esp + 0x138]
push ecx
push str.Wallpaper
lea ecx, [esp + 0x2c]
call fcn.00470360
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
push edx
push str.TileWallpaper
call fcn.00470360
lea eax, [esp + 0x80]
lea ecx, [esp + 0x24]
push eax
push str.WallpaperStyle
call fcn.00470360
lea ecx, [esp + 0x138]
push 3
push ecx
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 1
push 1
lea ecx, [esp + 0x58]
call fcn.00474000
lea ecx, [esp + 0x50]
call fcn.00473f20
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [esp + 0x24]
mov byte [esp + 0x6f8], 0
call fcn.0046ffb0
jmp 0x4754b2
lea ecx, [esp + 0x50]
call fcn.00473fa0
mov edi, dword [esp + 0x700]
lea edx, [esp + 0x138]
push edx
push 0x3fd
lea eax, [esp + 0x5cc]
push edi
push eax
call fcn.00472a10
mov edx, dword [esp + 0x714]
push 0
lea ecx, [esp + 0x5d8]
push 0x466
push ecx
push edx
push edi
call fcn.004714c0
add esp, 0x24
mov eax, dword [esp + 0x8c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [esp + 0x50]
mov dword [esp + 0x6f8], 0xffffffff
call fcn.00473c60
mov eax, esi
mov ecx, dword [esp + 0x6f0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6ec
ret