Function at 0x18000d2e0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rbx, r8
mov ebp, edx
mov rsi, rcx
mov qword [rsp + 0x48], rbx
test rcx, rcx
je 0x18000d5b0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000d5b0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call fcn.1800089d0
mov edi, dword [rsp + 0x40]
cmp edi, 0xffffffff
je 0x18000d371
test dil, 1
je 0x18000d371
and edi, 0xfffffffe
mov rcx, rsi
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r8, rbx
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test eax, eax
je 0x18000d5ac
test dil, 0x10
je 0x18000d5b2
mov edx, 0x5c
mov rcx, rsi
call fcn.180036d58
mov rdi, rax
test rax, rax
je 0x18000d484
inc rdi
lea rdx, str.mails
mov rcx, rdi
call fcn.180038078
test eax, eax
je 0x18000d5ac
lea rdx, str.MailsTemp
mov rcx, rdi
call fcn.180038078
test eax, eax
je 0x18000d5ac
lea rdx, str.MailsLeave
mov rcx, rdi
call fcn.180038078
test eax, eax
je 0x18000d5ac
lea rdx, str.files
mov rcx, rdi
call fcn.180038078
test eax, eax
je 0x18000d5ac
lea rdx, str.WinPatch
mov rcx, rdi
call fcn.180038078
test eax, eax
je 0x18000d5ac
lea rdx, str.tsdocbak
mov rcx, rdi
call fcn.180038078
test eax, eax
je 0x18000d5ac
lea rdx, [0x1800c4610]
mov rcx, rdi
call fcn.180038078
test eax, eax
je 0x18000d5ac
lea rdx, str.Temp
mov rcx, rdi
call fcn.180038078
test eax, eax
je 0x18000d5ac
lea rdx, str.Temp_Docerr_
mov r8d, SafeArrayCreate
mov rcx, rdi
call fcn.180038268
test eax, eax
je 0x18000d5ac
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x190], 0
call fcn.1800369b0
lea r8, [0x1800c45f0]
lea rcx, [rsp + 0x190]
mov r9, rsi
mov edx, 0x103
call fcn.180039080
test eax, eax
js 0x18000d5b0
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x50], 0
call fcn.1800369b0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000d5ac
nop
lea rdx, [0x1800c42cc]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000d589
lea rdx, [0x1800c42c8]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000d589
lea rcx, [rsp + 0x2a1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x2a0], 0
call fcn.1800369b0
lea r11, [rsp + 0x7c]
lea r8, [0x1800c1ec8]
lea rcx, [rsp + 0x2a0]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], r11
call fcn.180039080
test eax, eax
js 0x18000d589
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x2a0]
mov edx, ebp
call fcn.18000d2e0
mov ebx, eax
test ebx, ebx
je 0x18000d5a3
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18000d500
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x18000d5b2
xor eax, eax
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.180036980
mov rbx, qword [rsp + 0x3f8]
add rsp, 0x3c0
pop rdi
pop rsi
pop rbp
ret