Function at 0x419170
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa80
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
mov dword [ebp - 0xa7c], esi
push eax
mov dword [ebp - 0xa78], 0
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0xa78]
push eax
push 0x53d734
push 1
push 0
push 0x53d724
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x73
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0xa80], 0x104
mov dword [ebp - 0xa7c], 1
call edi
test eax, eax
jne 0x419230
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa7c]
push eax
push str.Wallpaper
push str.Control_PanelDesktop
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x41925b
mov ecx, dword [ebp - 0xa78]
test ecx, ecx
je 0x419275
mov eax, dword [ecx]
lea edx, [ebp - 0x20c]
push 2
push 0x104
push edx
push ecx
call dword [eax + 0x10]
mov ecx, dword [ebp - 0xa78]
test ecx, ecx
je 0x419275
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0xa78], 0
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x4193dd
call fcn.004197b0
test eax, eax
jne 0x419299
push 0x537e58
jmp 0x4193e4
push ebx
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x538110
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004ca680
push 0x250
lea eax, [ebp - 0xa74]
push 0
push eax
call fcn.004ca680
add esp, 0x18
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
nop word [eax + eax]
test byte [ebp - 0xa74], 0x10
jne 0x41934f
cmp word [ebp - 0xa48], 0x2e
jne 0x41935f
mov ax, word [ebp - 0xa46]
test ax, ax
je 0x41934f
cmp ax, 0x2e
jne 0x41935f
cmp word [ebp - 0xa44], 0
jne 0x41935f
lea eax, [ebp - 0xa74]
push eax
push edi
call ebx
test eax, eax
jne 0x419320
jmp 0x4193b5
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x824]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.MicrosoftWindowsThemesCachedFiles
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x61c]
mov ecx, esi
push eax
call fcn.00411080
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00411080
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004a7695
mov esp, ebp
pop ebp
ret