Function at 0x40b6d0
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa80
mov eax, dword [0x56e6c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
mov dword [ebp - 0xa7c], esi
push eax
mov dword [ebp - 0xa78], 0
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0xa78]
push eax
push 0x530cc4
push 1
push 0
push 0x530cb4
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x73
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0xa80], 0x104
mov dword [ebp - 0xa7c], 1
call edi
test eax, eax
jne 0x40b790
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa7c]
push eax
push str.Wallpaper
push str.Control_PanelDesktop
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x40b7bb
mov ecx, dword [ebp - 0xa78]
test ecx, ecx
je 0x40b7d5
mov eax, dword [ecx]
lea edx, [ebp - 0x20c]
push 2
push 0x104
push edx
push ecx
call dword [eax + 0x10]
mov ecx, dword [ebp - 0xa78]
test ecx, ecx
je 0x40b7d5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0xa78], 0
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x40b93d
call fcn.0040bd10
test eax, eax
jne 0x40b7f9
push 0x5265e4
jmp 0x40b944
push ebx
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x526768
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.0049d980
push 0x250
lea eax, [ebp - 0xa74]
push 0
push eax
call fcn.0049d980
add esp, 0x18
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
nop word [eax + eax]
test byte [ebp - 0xa74], 0x10
jne 0x40b8af
cmp word [ebp - 0xa48], 0x2e
jne 0x40b8bf
mov ax, word [ebp - 0xa46]
test ax, ax
je 0x40b8af
cmp ax, 0x2e
jne 0x40b8bf
cmp word [ebp - 0xa44], 0
jne 0x40b8bf
lea eax, [ebp - 0xa74]
push eax
push edi
call ebx
test eax, eax
jne 0x40b880
jmp 0x40b915
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x824]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.MicrosoftWindowsThemesCachedFiles
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x61c]
mov ecx, esi
push eax
call fcn.00407fd0
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00483518
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00407fd0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00483518
mov esp, ebp
pop ebp
ret