Function at 0x40c310
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa80
mov eax, dword [0x5746cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
mov dword [ebp - 0xa7c], esi
push eax
mov dword [ebp - 0xa78], 0
call fcn.004a3360
add esp, 0xc
lea eax, [ebp - 0xa78]
push eax
push 0x535cc4
push 1
push 0
push 0x535cb4
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x73
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0xa80], 0x104
mov dword [ebp - 0xa7c], 1
call edi
test eax, eax
jne 0x40c3d0
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa7c]
push eax
push str.Wallpaper
push str.Control_PanelDesktop
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x40c3fb
mov ecx, dword [ebp - 0xa78]
test ecx, ecx
je 0x40c415
mov eax, dword [ecx]
lea edx, [ebp - 0x20c]
push 2
push 0x104
push edx
push ecx
call dword [eax + 0x10]
mov ecx, dword [ebp - 0xa78]
test ecx, ecx
je 0x40c415
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0xa78], 0
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x40c57d
call fcn.0040c950
test eax, eax
jne 0x40c439
push 0x52b5e4
jmp 0x40c584
push ebx
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004a3360
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x52b768
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004a3360
push 0x250
lea eax, [ebp - 0xa74]
push 0
push eax
call fcn.004a3360
add esp, 0x18
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
nop word [eax + eax]
test byte [ebp - 0xa74], 0x10
jne 0x40c4ef
cmp word [ebp - 0xa48], 0x2e
jne 0x40c4ff
mov ax, word [ebp - 0xa46]
test ax, ax
je 0x40c4ef
cmp ax, 0x2e
jne 0x40c4ff
cmp word [ebp - 0xa44], 0
jne 0x40c4ff
lea eax, [ebp - 0xa74]
push eax
push edi
call ebx
test eax, eax
jne 0x40c4c0
jmp 0x40c555
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004a3360
add esp, 0xc
lea eax, [ebp - 0x824]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.MicrosoftWindowsThemesCachedFiles
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x61c]
mov ecx, esi
push eax
call fcn.00408c10
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004864b8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00408c10
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004864b8
mov esp, ebp
pop ebp
ret