Function at 0x100bf300
Capabilities:
Enumerate files on windows
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xacc
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10158ae0]
push ebx
push esi
mov esi, dword [0x10158adc]
mov ebx, ecx
push edi
cmp esi, eax
je 0x100bf4cf
mov edx, 0x10
lea edi, [edx - 0xf]
cmp dword [esi + 0x18], 0
je 0x100bf4c4
mov cl, byte [ebx + 0x54]
xor eax, eax
test cl, cl
mov dword [ebp - 0x864], 0x28
xorps xmm0, xmm0
setne al
movq qword [ebp - 0x840], xmm0
movups xmmword [ebp - 0x860], xmm0
test cl, cl
mov dword [ebp - 0x858], 0x200001
push 0
lea eax, [eax*8 + 0x18]
mov dword [ebp - 0x860], eax
mov eax, 0xb
cmovne eax, edx
movups xmmword [ebp - 0x850], xmm0
mov dword [ebp - 0x85c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
push 0
push 0
mov edi, eax
lea eax, [ebp - 0x864]
push 0
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push eax
push edi
mov dword [ebp - 0xacc], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
mov dword [ebp - 0xac4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0x18]
mov dword [ebp - 0xabc], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xff00ff
push edi
mov dword [ebp - 0xac8], eax
call dword [sym.imp.GDI32.dll_SetDCBrushColor]
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x830], ecx
mov ecx, dword [ebp - 0x85c]
push 0x12
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x82c], ecx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [ebp - 0x838]
push eax
push edi
call dword [sym.imp.USER32.dll_FillRect]
cmp byte [ebx + 0x54], 0
push 0xcc0020
je 0x100bf450
push 0xb
push 0
push dword [ebp - 0xabc]
push 0x10
push 0x16
push 0
push 3
jmp 0x100bf462
push 0
push 0
push dword [ebp - 0xabc]
push 0xb
push 0x10
push 0
push 2
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0xac8]
push dword [ebp - 0xabc]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0xabc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0xac4]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [ebp - 0xacc]
mov ecx, ebx
movzx eax, word [esi + 0x16]
push edi
push eax
push dword [esi]
call fcn.100bef90
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x10158ae0]
mov edx, 0x10
lea edi, [edx - 0xf]
add esi, 0x1c
cmp esi, eax
jne 0x100bf333
xor ecx, ecx
mov esi, 0x3ff
mov dword [ebp - 0xac8], ecx
nop dword [eax]
lea eax, [ebp - 0x210]
test ecx, ecx
jne 0x100bf510
push 0x104
push eax
push dword [0x1014be3c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
mov word [eax], cx
jmp 0x100bf53b
push 0x64
push str._ALLUSERSPROFILE_360WallPaperOpenShellLanguages
push eax
call fcn.100d7080
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1ac], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea eax, [ebp - 0x210]
push eax
push 0x10122688
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.100a4830
add esp, 0x10
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0xabc], edi
cmp edi, 0xffffffff
je 0x100bf739
test byte [ebp - 0xab8], 0x10
jne 0x100bf717
lea eax, [ebp - 0xa8c]
push 0x2d
push eax
call fcn.100d61ed
add esp, 8
test eax, eax
je 0x100bf717
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x210]
push eax
push str._s_s
lea eax, [ebp - 0x828]
push 0x104
push eax
call fcn.100a4830
lea eax, [ebp - 0xa8c]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100bf5d6
sub eax, edx
sar eax, 1
cmp eax, 0x103
jle 0x100bf5f3
mov eax, 0x103
jmp 0x100bf5f7
test eax, eax
jle 0x100bf60a
mov ecx, 0x2400
add cx, word [ebp + eax*2 - 0xa8c]
cmp cx, si
ja 0x100bf60a
dec eax
lea esi, [eax + eax]
push esi
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.100d7080
xor eax, eax
add esp, 0xc
mov word [ebp + esi - 0x418], ax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov esi, dword [ebx + 0x58]
xor al, al
mov byte [ebp - 0xabd], al
cmp esi, dword [ebx + 0x5c]
je 0x100bf677
nop dword [eax + eax]
lea eax, [ebp - 0x418]
push eax
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x100bf675
add esi, 0xc
cmp esi, dword [ebx + 0x5c]
jne 0x100bf650
mov al, byte [ebp - 0xabd]
jmp 0x100bf677
mov al, 1
mov dword [ebp - 0xac4], 0
test al, al
jne 0x100bf712
push 4
lea eax, [ebp - 0xac4]
push eax
push 0x20000001
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x100bf712
push 0x22
push 0
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100bf70c
cmp byte [ebx + 0x54], 0
push 0x2000
je 0x100bf6d4
push 0x10
push 0x20
push 0
push 1
jmp 0x100bf6dc
push 0xb
push 0x18
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
test esi, esi
je 0x100bf705
push esi
push dword [ebp - 0xac4]
lea eax, [ebp - 0x418]
mov ecx, ebx
push eax
call fcn.100bef90
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0xabc]
mov esi, 0x3ff
lea eax, [ebp - 0xab8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100bf580
push dword [ebp - 0xabc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xac8]
inc ecx
mov dword [ebp - 0xac8], ecx
cmp ecx, 2
jl 0x100bf4e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d4906
mov esp, ebp
pop ebp
ret