Function at 0x6ca47520
Capabilities:
Change the wallpaper

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x2e8
mov dword [ebp - 0x2cc], edx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0
mov dword [esp], 0xb
call ebx
sub esp, 4
mov dword [ebp - 0x2b0], eax
mov dword [esp], 0xc
call ebx
sub esp, 4
cmp dword [edi + 0x10], 0xff9b
mov dword [ebp - 0x2b4], eax
jg 0x6ca47e20
mov eax, dword [ebp - 0x2b8]
mov eax, dword [eax]
cmp eax, 0x20
je 0x6ca47e60
cmp eax, 0x40
je 0x6ca47e00
xor edx, edx
cmp eax, 0x10
mov eax, 0x7f01
cmovne eax, edx
mov dword [ebp - 0x2bc], eax
mov eax, 0x7f01
cmovne eax, edx
mov word [ebp - 0x2ac], ax
mov dword [esp], 0
lea edi, [ebp - 0x268]
lea esi, [ebp - 0x74]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x20c], 0x1f4
sub esp, 4
mov ebx, eax
lea eax, [ebp - 0x20c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x268]
mov dword [esp], esi
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.GDI32.dll_SelectObject]
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
lea eax, [ebp - 0x20c]
sub esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x34
mov dword [esp + 4], str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
mov dword [esp], ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebp - 0x20c]
mov edx, 0x4ec4ec4f
mov edi, dword [ebp - 0x2b8]
sub esp, 0x10
mov eax, ecx
sar ecx, 0x1f
imul edx
sar edx, 3
sub edx, ecx
lea eax, [edx + 1]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [0x6cb1cc14], eax
mov eax, dword [ebp - 0x268]
mov dword [0x6cb1cc10], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call fcn.6c9d7ad0
mov dword [ebp - 0x2b8], edi
add eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0xc]
lea edi, [ebp - 0x298]
mov dword [esp + 4], 0x6ca96fa1
mov dword [esp + 8], eax
mov dword [esp], 0x6ca96fa7
call fcn.6c9cfa90
mov dword [esp], edi
mov dword [esp + 8], 0x10
mov esi, eax
mov dword [esp + 4], 0
call fcn.6c9d74f0
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 0x10], 0x2c00
mov dword [esp + 8], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp - 0x298]
sub esp, 0x14
add ecx, 0x10
mov dword [esp], ebx
mov dword [ebp - 0x2a8], ecx
mov ecx, dword [ebp - 0x294]
movss xmm0, dword [ebp - 0x2a8]
add ecx, 0x10
mov dword [ebp - 0x2c0], ecx
mov ecx, dword [ebp - 0x290]
movss xmm3, dword [ebp - 0x2c0]
add ecx, 0x12
mov dword [ebp - 0x2c4], ecx
mov ecx, dword [ebp - 0x28c]
unpcklps xmm0, xmm3
movss xmm1, dword [ebp - 0x2c4]
add ecx, 0x12
mov dword [ebp - 0x2c8], ecx
movss xmm2, dword [ebp - 0x2c8]
unpcklps xmm1, xmm2
movlhps xmm0, xmm1
movaps xmmword [ebp - 0x298], xmm0
call dword [sym.imp.GDI32.dll_DeleteDC]
sub esp, 4
mov dword [esp], esi
call fcn.6c9d3b40
mov edx, dword [ebp - 0x290]
mov ecx, dword [ebp - 0x298]
mov eax, edx
sub eax, ecx
lea esi, [eax + 0x20]
mov eax, dword [ebp - 0x28c]
sub eax, dword [ebp - 0x294]
cmp word [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], esi
lea edi, [eax + 0x20]
jne 0x6ca47d48
mov eax, dword [ebp - 0x2b8]
imul eax, dword [eax + 0x10], 0x64
lea edx, [eax + 0xb]
add eax, 0xc
cmp esi, edx
cmovg eax, esi
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2b8]
lea edx, [ebp - 0x284]
mov ebx, dword [eax + 8]
mov dword [esp], edx
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 0
call fcn.6c9d74f0
lea eax, [edi + 0x2a]
mov esi, dword [ebp - 0x2a8]
mov dword [ebp - 0x284], 0xffff0001
mov word [ebp - 0x26c], ax
mov eax, dword [0x6cb1cc14]
mov word [ebp - 0x26e], si
mov dword [esp + 8], eax
movsx eax, si
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x278], 0xc00848
mov dword [ebp - 0x272], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call esi
mov word [ebp - 0x26e], ax
mov eax, dword [0x6cb1cc10]
sub esp, 0xc
mov dword [esp + 4], 8
mov dword [esp + 8], eax
movsx eax, word [ebp - 0x26c]
mov dword [esp], eax
call esi
sub esp, 0xc
mov word [ebp - 0x26c], ax
mov dword [esp + 4], 0x14
mov dword [esp], 1
call fcn.6c9d3a70
mov esi, eax
test eax, eax
je 0x6ca47dbf
mov ecx, 0x1a
lea edx, [ebp - 0x284]
call fcn.6ca470e0
test eax, eax
je 0x6ca47dd8
xor eax, eax
mov ecx, 2
lea edx, [ebp - 0x2a2]
mov word [ebp - 0x2a2], ax
mov eax, esi
call fcn.6ca470e0
test eax, eax
je 0x6ca47dd8
mov ecx, 2
lea edx, [ebp - 0x2a2]
mov eax, esi
call fcn.6ca470e0
test eax, eax
je 0x6ca47dd8
test ebx, ebx
mov eax, 0x6ca96fa0
cmove ebx, eax
mov dword [esp], ebx
call fcn.6c9d7ad0
mov dword [esp + 8], ebx
add eax, 1
mov dword [esp + 4], 0x6ca96fa1
mov dword [esp + 0xc], eax
mov dword [esp], 0x6ca96fa7
call fcn.6c9cfa90
mov ebx, eax
test eax, eax
je 0x6ca47dd8
cmp word [eax], 0
je 0x6ca47fa3
xor eax, eax
lea esi, [esi]
mov edx, eax
add eax, 1
cmp word [ebx + eax*2], 0
jne 0x6ca47968
lea ecx, [edx + edx + 4]
mov edx, ebx
mov eax, esi
call fcn.6ca470e0
mov dword [esp], ebx
mov dword [ebp - 0x2c0], eax
call fcn.6c9d3b40
mov eax, dword [ebp - 0x2c0]
test eax, eax
je 0x6ca47dd8
lea eax, [ebp - 0x20c]
mov dword [esp + 0xc], 0
mov dword [ebp - 0x20c], 0x154
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
sub esp, 0x10
mov dword [esp], 0
call dword [sym.imp.USER32.dll_GetDC]
sub esp, 4
mov ebx, eax
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
sub esp, 8
mov ecx, eax
test eax, eax
mov eax, 0x48
cmove ecx, eax
imul eax, dword [ebp - 0xf4], 0xffffffb8
mov dword [esp + 4], ebx
mov dword [esp], 0
cdq
idiv ecx
mov word [ebp - 0x2a2], ax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 2
lea edx, [ebp - 0x2a2]
mov eax, esi
sub esp, 8
call fcn.6ca470e0
test eax, eax
je 0x6ca47e48
mov eax, dword [ebp - 0xe4]
mov ecx, 2
lea edx, [ebp - 0x2a2]
mov word [ebp - 0x2a2], ax
mov eax, esi
call fcn.6ca470e0
test eax, eax
je 0x6ca47e48
movzx eax, byte [ebp - 0xe0]
mov ecx, 1
lea edx, [ebp - 0x2a3]
mov byte [ebp - 0x2a3], al
mov eax, esi
call fcn.6ca470e0
test eax, eax
je 0x6ca47e48
movzx eax, byte [ebp - 0xdd]
mov ecx, 1
lea edx, [ebp - 0x2a3]
mov byte [ebp - 0x2a3], al
mov eax, esi
call fcn.6ca470e0
test eax, eax
je 0x6ca47e48
lea ebx, [ebp - 0xd8]
mov dword [esp], ebx
call fcn.6c9d7ad0
mov dword [esp + 8], ebx
add eax, 1
mov dword [esp + 4], 0x6ca96fa1
mov dword [esp + 0xc], eax
mov dword [esp], 0x6ca96fa7
call fcn.6c9cfa90
mov ebx, eax
test eax, eax
je 0x6ca47e48
cmp word [eax], 0
je 0x6ca47fc0
xor eax, eax
lea esi, [esi]
mov edx, eax
add eax, 1
cmp word [ebx + eax*2], 0
jne 0x6ca47b00
lea ecx, [edx + edx + 4]
mov edx, ebx
mov eax, esi
call fcn.6ca470e0
mov dword [esp], ebx
mov dword [ebp - 0x2c0], eax
call fcn.6c9d3b40
mov eax, dword [ebp - 0x2c0]
test eax, eax
je 0x6ca47e48
cmp word [ebp - 0x2ac], 0
je 0x6ca47b95
mov eax, dword [ebp - 0x2bc]
mov dword [esp + 0x14], 0
mov ecx, 0x50020003
mov edx, 0x82
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x2b4]
mov dword [esp + 4], 0x14
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2b0]
mov dword [esp], 0x14
mov dword [esp + 8], eax
mov eax, esi
call fcn.6ca471e0
test eax, eax
je 0x6ca47dd8
mov eax, dword [ebp - 0x2b8]
mov dword [esp + 0x18], 0
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 4], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x28c]
mov dword [esp], edx
sub eax, ecx
mov ecx, 0x50022080
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x290]
sub eax, edx
mov edx, 0x82
mov dword [esp + 8], eax
mov eax, esi
call fcn.6ca471e0
test eax, eax
je 0x6ca47dd8
mov eax, dword [ebp - 0x2b8]
add edi, 4
xor ecx, ecx
mov dword [ebp - 0x2bc], edi
xor edi, edi
mov eax, dword [eax + 0x10]
mov word [ebp - 0x2b4], cx
imul edx, eax, 0xffffff9c
add edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x2b0], edx
test eax, eax
jle 0x6ca47e86
mov dword [ebp - 0x2ac], esi
mov esi, dword [ebp - 0x2b8]
jmp 0x6ca47d26
lea eax, [edi + edi*2]
lea ebx, [edx + eax*4]
mov eax, dword [ebx]
and eax, 1
mov dword [ebp - 0x2a8], eax
je 0x6ca47c72
add word [ebp - 0x2b4], 1
movzx eax, word [ebp - 0x2b4]
cmp ax, 1
sete al
movzx eax, al
mov dword [ebp - 0x2a8], eax
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x6ca47d98
lea edx, [ebp - 0x29c]
lea eax, [ebp - 0x2a0]
call fcn.6ca46fd0
test eax, eax
je 0x6ca47d98
sub ebx, dword [esi + 0x14]
mov ecx, dword [ebp - 0x2a8]
sar ebx, 2
mov edx, dword [ebp - 0x2ac]
imul ebx, ebx, 0xaaaaaaab
add ecx, 0x50010000
add ebx, 0x64
cmp word [edx + 0x10], 0
jne 0x6ca47cc4
or ecx, 0x20000
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2bc]
mov edx, pe_nt_image_headers32
mov dword [esp + 0x10], ebx
mov ebx, dword [ebp - 0x2b0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2ac]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0x1a
mov dword [esp + 8], 0x58
mov dword [esp], ebx
call fcn.6ca471e0
test eax, eax
je 0x6ca47d98
mov eax, dword [esi + 0x10]
add ebx, 0x64
add edi, 1
mov dword [ebp - 0x2b0], ebx
cmp eax, edi
jle 0x6ca47e80
mov edx, dword [esi + 0x14]
test byte [esi], 0x80
jne 0x6ca47c40
sub eax, 1
sub eax, edi
lea eax, [eax + eax*2]
lea ebx, [edx + eax*4]
jmp 0x6ca47c46
mov ebx, dword [ebp - 0x2b0]
lea eax, [ebx + 0x14]
add edx, eax
add esi, eax
add ecx, eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x290], edx
imul eax, dword [eax + 0x10], 0x64
mov dword [ebp - 0x298], ecx
lea edx, [eax + 0xb]
add eax, 0xc
cmp esi, edx
cmovg eax, esi
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2b4]
lea edx, [eax + 0x27]
add eax, 0x28
cmp edi, edx
cmovle edi, eax
jmp 0x6ca477fb
mov esi, dword [ebp - 0x2ac]
mov eax, dword [esi + 4]
mov dword [esp], eax
call fcn.6c9d3b40
mov dword [esp], esi
call fcn.6c9d3b40
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call fcn.6c9d3b40
lea esp, [ebp - 0xc]
mov ebx, 0xffffffff
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov eax, dword [esi + 4]
mov ebx, 0xffffffff
mov dword [esp], eax
call fcn.6c9d3b40
mov dword [esp], esi
call fcn.6c9d3b40
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [ebp - 0x2bc], 0x7f04
mov eax, 0x7f04
mov word [ebp - 0x2ac], ax
jmp 0x6ca475cc
mov dword [esp + 4], 0xff9b
mov dword [esp], str.Number_of_butons_exceeds_limit_of__d
call fcn.6c942590
lea esp, [ebp - 0xc]
mov ebx, eax
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov eax, dword [esi + 4]
mov dword [esp], eax
call fcn.6c9d3b40
mov dword [esp], esi
call fcn.6c9d3b40
jmp 0x6ca47dbf
mov dword [ebp - 0x2bc], 0x7f03
mov eax, 0x7f03
mov word [ebp - 0x2ac], ax
jmp 0x6ca475cc
mov esi, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call fcn.6c9d3b40
mov eax, dword [ebp - 0x2b8]
mov eax, dword [eax + 4]
test eax, eax
je 0x6ca47eaa
mov eax, dword [eax + 0xa4]
mov eax, dword [eax + 4]
mov edi, dword [ebp - 0x2b8]
mov dword [esp + 0xc], 0x6ca46d40
mov dword [esp + 8], eax
mov dword [esp + 0x10], edi
mov eax, dword [esi]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
sub esp, 0x14
mov ebx, eax
cmp eax, 0x63
jle 0x6ca47f20
lea eax, [eax - 0x63]
cmp eax, dword [edi + 0x10]
jg 0x6ca47f4d
mov edx, dword [edi + 0x14]
lea eax, [ebx + ebx*2]
mov edi, dword [ebp - 0x2cc]
xor ebx, ebx
lea eax, [edx + eax*4]
mov eax, dword [eax - 0x4ac]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [esp], eax
call fcn.6c9d3b40
mov dword [esp], esi
call fcn.6c9d3b40
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
cmp eax, 0x14
je 0x6ca47fad
jle 0x6ca47f60
cmp eax, 0x34
jle 0x6ca47f48
cmp eax, 0x35
jne 0x6ca47f4d
mov dword [esp], str.Couldnt_find_dialog_control_of_the_default_enter_key_button
mov ebx, 0xffffffff
call fcn.6c942590
jmp 0x6ca47efe
cmp eax, 0x31
jg 0x6ca47f8d
mov dword [esp], str.An_unknown_error_occured
mov ebx, 0xffffffff
call fcn.6c942590
jmp 0x6ca47efe
cmp eax, 0xffffffff
je 0x6ca47f7c
test eax, eax
jne 0x6ca47f4d
mov dword [esp], str.Invalid_parent_window_handle
mov ebx, 0xffffffff
call fcn.6c942590
jmp 0x6ca47efe
mov dword [esp], str.The_message_box_encountered_an_error.
call fcn.6c942590
jmp 0x6ca47efe
mov dword [esp], str.Invalid_message_box_pointer_in_dialog_procedure
mov ebx, 0xffffffff
call fcn.6c942590
jmp 0x6ca47efe
mov ecx, 2
jmp 0x6ca47978
mov eax, dword [ebp - 0x2cc]
xor ebx, ebx
mov dword [eax], 0xffffffff
jmp 0x6ca47efe
mov ecx, 2
jmp 0x6ca47b10