Function at 0x14005e270
Capabilities:
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0x390], rax
xor ebx, ebx
mov edi, r9d
mov r13d, r8d
mov r12d, edx
mov rsi, rcx
mov r14d, ebx
test rcx, rcx
jne 0x14005e2bf
xor eax, eax
jmp 0x14005e97f
mov qword [rsp + 0x4d8], r15
call fcn.1400ec530
mov ecx, 1
cmp eax, 6
lea edx, [rcx + 0x19]
mov r15d, ebx
cmovge r15d, ecx
lea rcx, [0x140209da0]
call fcn.140094e80
lea r10, [0x140209da0]
lea rcx, [r10 - 2]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x14005e2f5
lea r8, [0x140209d60]
xor edx, edx
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x14005e310
lea rcx, [r10 - 2]
nop word [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x14005e330
mov eax, dword [0x140181e84]
mov dword [rcx], eax
mov rcx, r10
call fcn.1400e8b30
lea rcx, [0x140209da0]
lea rax, [rcx - 2]
cmp word [rax + 2], bx
lea rax, [rax + 2]
jne 0x14005e355
movups xmm0, xmmword [str.IrfanView_Wallpaper]
movups xmm1, xmmword [0x1401881e8]
sub rcx, 2
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1401881f8]
movups xmmword [rax + 0x10], xmm1
movsd qword [rax + 0x20], xmm0
test r15d, r15d
je 0x14005e3b0
nop word [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x14005e390
movsd xmm0, qword [str..png]
movzx eax, word [0x140188208]
jmp 0x14005e3c9
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x14005e3b0
movsd xmm0, qword [0x140188210]
movzx eax, word [0x140188218]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
test edi, edi
je 0x14005e462
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x54]
xor r9d, r9d
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.1400eb570
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x54]
mov rcx, rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x20], rax
call fcn.1400ea750
mov eax, dword [0x1401fbc40]
mov r9d, dword [0x1401f7150]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x54]
mov edi, 1
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
mov eax, dword [0x1401f7154]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.1400ae670
mov r12d, ebx
mov r14, rax
mov r13d, ebx
jmp 0x14005e467
mov edi, 1
cmp dword [rbp + 0x3f0], ebx
je 0x14005e5b3
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.1400eb570
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rsp + 0x60]
mov r9d, dword [rsp + 0x64]
movd xmm2, dword [rsp + 0x40]
movd xmm0, dword [rsp + 0x44]
movsd xmm3, qword [0x140183398]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
sub edx, dword [rsp + 0x58]
sub r9d, dword [rsp + 0x5c]
divss xmm2, xmm0
mov ecx, edx
mov dword [rsp + 0x40], edx
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm0, xmm2
cvtps2pd xmm1, xmm0
addsd xmm1, xmm3
cvttsd2si r8d, xmm1
mov dword [rsp + 0x44], r8d
cmp r8d, r9d
jge 0x14005e520
mov r8d, r9d
mov dword [rsp + 0x44], r9d
movd xmm0, r8d
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
cvtps2pd xmm1, xmm0
addsd xmm1, xmm3
cvttsd2si ecx, xmm1
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x60], edx
mov eax, ecx
mov dword [rsp + 0x38], edi
sub eax, edx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x64], r9d
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x58], eax
mov eax, r8d
sub eax, r9d
mov r9d, dword [0x1401f7150]
cdq
sub eax, edx
mov edx, ecx
mov rcx, rsi
sar eax, 1
mov dword [rsp + 0x5c], eax
mov eax, dword [0x1401fbc40]
mov dword [rsp + 0x28], eax
mov eax, dword [0x1401f7154]
mov dword [rsp + 0x20], eax
call fcn.1400ae670
mov ecx, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x58]
mov dword [rsp + 0x20], ecx
mov rcx, rax
mov rdi, rax
call fcn.1400403f0
mov r14, rax
test rdi, rdi
je 0x14005e5ad
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r12d, ebx
mov r13d, ebx
lea rdi, [0x140209da0]
mov edx, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
lea rdx, [0x140209060]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + rdi]
lea rcx, [rcx + 2]
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x14005e5e0
or rdi, 0xffffffffffffffff
test r14, r14
je 0x14005e64c
lea rcx, [0x140209da0]
test r15d, r15d
je 0x14005e624
mov dword [rsp + 0x30], ebx
lea r8d, [rdi + 7]
mov r9d, edi
mov rdx, r14
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call fcn.140080940
jmp 0x14005e62f
mov r8, rdx
mov rdx, r14
call fcn.14001ae20
mov rcx, r14
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea r14, [0x140209da0]
jmp 0x14005e687
lea r14, [0x140209da0]
mov rcx, r14
test r15d, r15d
je 0x14005e67a
mov dword [rsp + 0x30], ebx
mov r9d, edi
mov r8d, 6
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call fcn.140080940
jmp 0x14005e685
mov r8, rdx
mov rdx, rsi
call fcn.14001ae20
mov esi, eax
test esi, esi
jne 0x14005e6c2
cmp dword [rbp + 0x3f8], ebx
jne 0x14005e6bb
mov rcx, qword [0x1401fbba0]
lea r9, [0x140209060]
lea r8, str._s_n_s
mov edx, 0x4d0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call fcn.1400f11b0
xor eax, eax
jmp 0x14005e977
lea rax, [rsp + 0x48]
lea rdx, str.Control_PanelDesktop
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005e966
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, str.Wallpaper
xor r8d, r8d
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
lea r9, [rsp + 0x44]
lea rdx, str.TileWallpaper
xor r8d, r8d
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.1400f92fc
test eax, eax
je 0x14005e80c
lea rcx, [rsp + 0x70]
mov rax, rdi
nop dword [rax]
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x14005e780
mov rcx, qword [rsp + 0x48]
lea eax, [rax*2 + 2]
mov r15d, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
lea rdx, str.PrevWallpaper
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rbp + 0x180]
mov rax, rdi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x14005e7d0
mov rcx, qword [rsp + 0x48]
lea eax, [rax*2 + 2]
lea rdx, str.PrevTileWallpaper
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x180]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14005e812
mov r15d, 1
mov rax, rdi
nop word [rax + rax]
cmp word [r14 + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x14005e820
mov rcx, qword [rsp + 0x48]
lea eax, [rax*2 + 2]
lea rdx, str.Wallpaper
mov dword [rsp + 0x28], eax
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
lea rsi, [0x140000000]
nop
movzx eax, word [rcx + rsi + 0x18263c]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x56], ax
test ax, ax
jne 0x14005e860
test r12d, r12d
je 0x14005e896
mov rcx, rbx
nop
movzx eax, word [rcx + rsi + 0x185e18]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x56], ax
test ax, ax
jne 0x14005e880
lea rcx, [rsp + 0x58]
mov rax, rdi
nop
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x14005e8a0
mov rcx, qword [rsp + 0x48]
lea eax, [rax*2 + 2]
lea rdx, str.TileWallpaper
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x58]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
nop dword [rax + rax]
movzx eax, word [rcx + rsi + 0x18263c]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x56], ax
test ax, ax
jne 0x14005e8e0
test r13d, r13d
je 0x14005e916
nop dword [rax + rax]
movzx eax, word [rbx + rsi + 0x1882dc]
lea rbx, [rbx + 2]
mov word [rsp + rbx + 0x56], ax
test ax, ax
jne 0x14005e900
lea rax, [rsp + 0x58]
nop dword [rax + rax]
cmp word [rax + rdi*2 + 2], 0
lea rdi, [rdi + 1]
jne 0x14005e920
mov rcx, qword [rsp + 0x48]
lea edx, [rdi*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rdx
lea rdx, [0x1401882e0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14005e96c
mov r15d, 1
mov rcx, r14
call fcn.14005f920
mov eax, r15d
mov r15, qword [rsp + 0x4d8]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret