Function at 0x1400193f0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x330
mov rax, qword [0x14009f100]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rdi, rdx
mov r12, rcx
xor r13d, r13d
mov rbx, qword [0x1400a67f8]
mov rsi, qword [0x1400a6800]
cmp rbx, rsi
je 0x14001948e
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140019445
mov rdx, qword [rbx]
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140019452
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140019488
cmp qword [rbx + 0x18], 7
jbe 0x140019467
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 7
jbe 0x140019471
mov rdi, qword [rdi]
mov r8, rbx
mov rdx, rdi
lea rcx, str.____Skipping_path:__ls__found:__ls_n
call fcn.140001430
jmp 0x1400199af
add rbx, 0x20
jmp 0x140019433
mov rcx, qword [rdi + 0x10]
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rcx
cmp rax, 2
jb 0x140019b8b
mov r9, rdi
cmp qword [rdi + 0x18], 7
jbe 0x1400194b9
mov r9, qword [rdi]
mov qword [rsp + 0x30], 2
lea rax, [0x14008f09c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x68]
call fcn.14001d3b0
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 7
cmova rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x140019547
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019542
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019b90
call fcn.140036bb4
movdqa xmm0, xmmword [0x140093280]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r13w
cmp r15, 0xffffffffffffffff
jne 0x1400195d8
lea rcx, [rsp + 0x48]
call fcn.140024930
cmp qword [rax + 0x18], 7
jbe 0x140019575
mov rax, qword [rax]
cmp qword [rdi + 0x18], 7
jbe 0x14001957f
mov rdi, qword [rdi]
mov r8, rax
mov rdx, rdi
lea rcx, str.____Failed_to_scan_directory:__ls._Error:__ls_n
call fcn.140001430
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400195d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400195ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019b96
call fcn.140036bb4
jmp 0x1400199af
mov rcx, rdi
call fcn.140018650
lea rdx, [0x14008eea4]
nop word [rax + rax]
movzx ecx, word [rsp + 0xfc]
movzx eax, word [rsp + 0xfe]
cmp cx, 0x2e
jne 0x140019629
cmp ax, cx
jne 0x14001961a
cmp word [rsp + 0x100], 0
je 0x140019985
cmp cx, 0x2e
jne 0x140019629
test ax, ax
je 0x140019985
mov rcx, qword [rdi + 0x10]
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x140019b9c
mov r9, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14001964a
mov r9, qword [rdi]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.14001d3b0
nop
lea rax, [rsp + 0xfc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140019680
lea rdx, [rsp + 0xfc]
lea rcx, [rsp + 0x48]
call fcn.14001c1e0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140019721
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001971c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019ba2
call fcn.140036bb4
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
test byte [rsp + 0xd0], 0x10
je 0x1400197bb
mov rsi, qword [0x1400a6800]
mov rbx, qword [0x1400a67f8]
cmp rbx, rsi
je 0x1400197a6
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14001975f
mov rdx, qword [rbx]
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14001976c
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x14001979d
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140019784
mov r8, qword [rbx]
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140019791
mov rdx, qword [rdi]
lea rcx, str.____Skipping_path:__ls__found:__ls_n
call fcn.140001430
add rbx, 0x20
cmp rbx, rsi
jne 0x140019752
lea rdx, [rsp + 0xb0]
mov rcx, r12
call fcn.1400193f0
jmp 0x140019b3a
lea rcx, [rsp + 0xb0]
mov r9, qword [rsp + 0xb0]
mov r10, qword [rsp + 0xc8]
cmp r10, 7
cmova rcx, r9
lea r8, [0x14009fdf8]
cmp qword [0x14009fe10], 7
cmova r8, qword [0x14009fdf8]
mov rdx, qword [0x14009fe08]
mov r11, qword [rsp + 0xc0]
cmp rdx, r11
jne 0x140019868
test rdx, rdx
je 0x140019824
sub r8, rcx
nop
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140019868
add rcx, 2
sub rdx, 1
jne 0x140019810
cmp r10, 7
jbe 0x140019985
lea rdx, [r10*2 + 2]
cmp rdx, 0x1000
mov rax, r9
jb 0x14001985b
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019b85
mov rcx, r9
call fcn.140036bb4
jmp 0x140019985
lea rcx, [rsp + 0xb0]
cmp r10, 7
cmova rcx, r9
lea r8, [0x14009fdb8]
cmp qword [0x14009fdd0], 7
cmova r8, qword [0x14009fdb8]
mov rdx, qword [0x14009fdc8]
cmp rdx, r11
jne 0x1400198bc
test rdx, rdx
je 0x140019824
sub r8, rcx
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400198bc
add rcx, 2
sub rdx, 1
jne 0x1400198a3
jmp 0x140019824
lea rcx, [rsp + 0xfc]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov r14, rax
mov rbx, qword [0x1400a6810]
mov rsi, qword [0x1400a6818]
cmp rbx, rsi
je 0x140019907
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400198ed
mov rdx, qword [rbx]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400199dc
add rbx, 0x20
cmp rbx, rsi
jne 0x1400198e0
mov edx, dword [rsp + 0xf0]
mov dword [rsp + 0x40], edx
mov eax, dword [rsp + 0xec]
mov dword [rsp + 0x44], eax
mov ecx, eax
shl rcx, 0x20
or rcx, rdx
cmp rcx, 0x3e8
jge 0x140019a0a
mov rdx, qword [rsp + 0xc8]
cmp rdx, 7
jbe 0x14001997b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140019976
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019b85
call fcn.140036bb4
movabs rbx, 0x7ffffffffffffffe
lea rdx, [rsp + 0xd0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
lea rdx, [0x14008eea4]
jne 0x1400195f0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140036840
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 7
cmova rdx, qword [rsp + 0xb0]
mov r8, r14
lea rcx, str.____Skipping_file:__ls__found:__ls_n
call fcn.140001430
jmp 0x140019b3a
lea rdx, str..crypt
cmp qword [0x14009fdb0], 7
cmova rdx, qword [str..crypt]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140019933
lea rdx, [0x1400a67d8]
cmp qword [0x1400a67f0], 7
cmova rdx, qword [0x1400a67d8]
lea rcx, [rsp + 0xfc]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140019933
mov edx, dword [rsp + 0xd0]
test dl, 1
je 0x140019b24
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 7
cmova rcx, qword [rsp + 0xb0]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140019b24
lea rcx, [rsp + 0x90]
call fcn.140024930
cmp qword [rax + 0x18], 7
jbe 0x140019ab1
mov rax, qword [rax]
lea rdx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 7
cmova rdx, qword [rsp + 0xb0]
mov r8, rax
lea rcx, str.____Skipping_file:__ls__because_read_only._Error:__ls_n
call fcn.140001430
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x140019b3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019b1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019ba8
call fcn.140036bb4
jmp 0x140019b3a
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0xb0]
mov rcx, r12
call fcn.140019140
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, 7
jbe 0x14001997b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019976
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019976
call fcn.140046420
int3
call fcn.140001720
call fcn.140046420
int3
call fcn.140046420
int3
call fcn.140001720
nop
call fcn.140046420
int3
call fcn.140046420
int3