Function at 0x401460
Capabilities:
Capture screenshot
Change the wallpaper
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x194
mov dword [esp], 0
call sym._GetDC_4
sub esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateCompatibleDC_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateCompatibleBitmap_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._SelectObject_8
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateSolidBrush_4
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._FillRect_12
sub esp, 0xc
lea edx, [ebp - 0x5c]
mov eax, 0
mov ecx, 0xb
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x5c], 0x28
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x54], 0xffffffff
mov word [ebp - 0x50], 1
mov word [ebp - 0x4e], 0x20
mov dword [ebp - 0x4c], 0
mov dword [esp], 4
call sym._malloc
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x18], 0
lea eax, [ebp - 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._GetDIBits_28
sub esp, 0x1c
lea eax, [ebp - 0x160]
mov dword [esp + 4], eax
mov dword [esp], 0x104
call sym._GetTempPathA_8
sub esp, 8
lea eax, [ebp - 0x160]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x160]
add eax, edx
mov dword [eax], 0x706d6574
mov dword [eax + 4], 0x706d622e
mov byte [eax + 8], 0
mov dword [esp + 4], 0x40b064
lea eax, [ebp - 0x160]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40164d
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._DeleteObject_4
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._DeleteDC_4
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._ReleaseDC_8
sub esp, 8
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._DeleteObject_4
sub esp, 4
jmp 0x40177e
mov dword [ebp - 0x16e], 0
mov dword [ebp - 0x16a], 0
mov dword [ebp - 0x166], 0
mov word [ebp - 0x162], 0
mov word [ebp - 0x16e], 0x4d42
mov dword [ebp - 0x164], 0x36
mov eax, dword [ebp - 0x164]
add eax, 4
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xe
lea eax, [ebp - 0x16e]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x28
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 0xc], 3
lea eax, [ebp - 0x160]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x14
call sym._SystemParametersInfoA_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._DeleteObject_4
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._DeleteDC_4
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._ReleaseDC_8
sub esp, 8
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._DeleteObject_4
sub esp, 4
mov edi, dword [ebp - 4]
leave
ret