Function at 0x10000e970
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x2f8
mov rax, qword [0x100029100]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, rcx
mov qword [rsp + 0x60], rcx
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x70], rcx
xor eax, eax
xor ebx, ebx
repne scasw ax, word [rdi]
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x50], r8d
not rcx
mov rsi, rdx
mov qword [rsp + 0x68], rdx
lea rbp, [rcx - 1]
lea rdi, [rcx + rcx + 0x20a]
mov dword [rsp + 0x54], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
lea edi, [rbx + 8]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x48], rax
cmp rax, rbx
jne 0x10000e9f3
mov esi, ebx
jmp 0x10000f03b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx - 1]
lea rdi, [rcx + rcx + 0x20a]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edi, 8
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
xor eax, eax
cmp rbx, rax
jne 0x10000ea38
mov esi, eax
jmp 0x10000eff4
mov r9, qword [rsp + 0x60]
lea rdx, [rbp + 0x106]
mov rbp, qword [rsp + 0x48]
lea r8, [0x100004270]
mov rcx, rbp
call fcn.10000dd9c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
lea r8, [0x100004270]
lea rdx, [rsi + 0x106]
repne scasw ax, word [rdi]
not rcx
lea rax, [rbp + rcx*2 - 2]
mov rbp, qword [rsp + 0x68]
mov rcx, rbx
mov r9, rbp
mov qword [rsp + 0x58], rax
call fcn.10000dd9c
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov edx, 0x105
repne scasw ax, word [rdi]
lea rdi, [0x100004278]
not rcx
lea rax, [rbx + rcx*2 - 2]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
sub rdi, rax
xor esi, esi
mov rcx, rax
lea rax, [rdx + 0x7ffffef9]
cmp rax, rsi
je 0x10000eae3
movzx eax, word [rdi + rcx]
cmp ax, si
je 0x10000eae3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10000eac1
xor edi, edi
cmp rdx, rdi
jne 0x10000eaee
sub rcx, 2
mov word [rcx], di
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x10000eb41
mov rcx, rbp
call fcn.100011a18
mov esi, eax
cmp eax, edi
jne 0x10000eb41
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100004280]
mov r8, rbx
mov r9d, eax
mov ecx, 4
mov edi, eax
call fcn.100010054
jmp 0x10000eff4
cmp dword [rsp + 0x340], edi
je 0x10000eb6e
lea r8, [fcn.100004040]
xor edx, edx
mov rcx, rbp
call fcn.10000faf4
mov esi, eax
cmp eax, edi
jne 0x10000eb6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10000eff4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10000ebc6
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x10000eb95
cmp eax, 0x20
je 0x10000eb95
cmp eax, 0x21
jne 0x10000eb9d
mov rcx, rbp
call fcn.10000ae6c
mov r8, rbp
cmp edi, 2
je 0x10000ebb3
lea rdx, [0x100004610]
mov ecx, 3
jmp 0x10000ec19
lea rdx, [fcn.100004670]
mov ecx, 2
call fcn.100010054
jmp 0x10000ec21
and eax, 0x3120
bts eax, 7
cmp eax, 0x80
je 0x10000ebda
btr eax, 7
mov edx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
cmp eax, edi
jne 0x10000ec2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x10000ec02
cmp eax, 0x20
je 0x10000ec02
cmp eax, 0x21
jne 0x10000ec0a
mov rcx, rbp
call fcn.10000ae6c
mov r8, rbp
lea rdx, [0x1000046d0]
mov ecx, 4
mov r9d, edi
call fcn.100010054
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
cmp esi, edi
je 0x10000eb61
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
lea rdi, [rsp + 0xbc]
sub rdi, r8
lea rsi, [rsp + 0xbc]
sub rsi, r9
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], rsi
jmp 0x10000ec67
mov rsi, qword [rsp + 0x78]
xor r10d, r10d
mov edx, 0x105
mov rcx, r8
lea r11d, [r10 + 2]
lea rax, [rdx + 0x7ffffef9]
cmp rax, r10
je 0x10000ec98
movzx eax, word [rdi + rcx]
cmp ax, r10w
je 0x10000ec98
mov word [rcx], ax
add rcx, r11
sub rdx, 1
jne 0x10000ec76
xor edi, edi
cmp rdx, rdi
jne 0x10000eca2
sub rcx, r11
mov word [rcx], di
mov edx, 0x105
mov rcx, r9
lea rax, [rdx + 0x7ffffef9]
cmp rax, rdi
je 0x10000ecce
movzx eax, word [rsi + rcx]
cmp ax, di
je 0x10000ecce
mov word [rcx], ax
add rcx, r11
sub rdx, 1
jne 0x10000ecad
cmp rdx, rdi
jne 0x10000ecd6
sub rcx, r11
mov word [rcx], di
test byte [rsp + 0x90], 0x10
je 0x10000ed80
lea rsi, [rsp + 0xbc]
lea rdi, [0x1000042d4]
mov rcx, r11
repe cmpsw word [rsi], word [rdi]
je 0x10000ef80
lea rsi, [rsp + 0xbc]
lea rdi, [0x1000042d8]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x10000ef80
mov rdi, qword [rsp + 0x48]
lea rdx, [0x1000042e0]
mov r9, rbx
mov r8, rdi
mov ecx, r11d
call fcn.100010054
mov eax, dword [rsp + 0x350]
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x348]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x340]
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.10000e970
xor edi, edi
mov esi, eax
cmp eax, edi
je 0x10000efb7
jmp 0x10000ef82
cmp dword [rsp + 0x348], edi
je 0x10000eddb
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 4
jb 0x10000edc1
mov eax, ecx
lea rdx, [0x100004588]
lea rcx, [r8 + rax*2 - 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor edi, edi
cmp eax, edi
je 0x10000eddb
mov r8, qword [rsp + 0x58]
jmp 0x10000edc3
xor edi, edi
lea rdx, [0x100004598]
mov rcx, r8
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, edi
jne 0x10000ef82
cmp dword [rsp + 0x40], edi
je 0x10000ee07
lea r8, [0x100003bc0]
xor edx, edx
mov rcx, rbx
call fcn.10000faf4
mov esi, eax
cmp eax, edi
jne 0x10000ee07
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10000efb3
cmp dword [rsp + 0x350], edi
jne 0x10000ee26
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call fcn.10000f214
cmp eax, edi
je 0x10000ee85
xor eax, eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9d, 4
lea r8, [rsp + 0x68]
lea edx, [r9 + 0x14]
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov edi, 5
test eax, eax
mov ecx, 1
cmovns edi, dword [rsp + 0x68]
call fcn.10000b1cc
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call fcn.10000f068
mov ecx, edi
mov esi, eax
call fcn.10000b1cc
xor edi, edi
cmp esi, edi
je 0x10000efb7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
je 0x10000ef82
test al, 0x50
jne 0x10000ef82
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
jne 0x10000eef8
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x10000eec7
cmp eax, 0x20
je 0x10000eec7
cmp eax, 0x21
jne 0x10000eecf
mov rcx, rbx
call fcn.10000ae6c
mov r8, rbx
cmp edi, 2
je 0x10000eee5
lea rdx, [0x100004610]
mov ecx, 3
jmp 0x10000ef4b
lea rdx, [fcn.100004670]
mov ecx, 2
call fcn.100010054
jmp 0x10000ef53
and eax, 0x3120
bts eax, 7
cmp eax, 0x80
je 0x10000ef0c
btr eax, 7
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
cmp eax, edi
jne 0x10000ef5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x10000ef34
cmp eax, 0x20
je 0x10000ef34
cmp eax, 0x21
jne 0x10000ef3c
mov rcx, rbx
call fcn.10000ae6c
mov r8, rbx
lea rdx, [0x1000046d0]
mov ecx, 4
mov r9d, edi
call fcn.100010054
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
cmp esi, edi
je 0x10000efb7
cmp dword [rsp + 0x40], edi
je 0x10000ef82
lea r8, [0x100003bc0]
mov edx, 1
mov rcx, rbx
call fcn.10000faf4
jmp 0x10000ed71
xor edi, edi
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
cmp eax, edi
mov rdi, qword [rsp + 0x80]
mov esi, eax
jne 0x10000ec62
xor edi, edi
cmp esi, edi
jne 0x10000efc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10000eb61
lea esi, [rax - 0x11]
cmp dword [rsp + 0x340], edi
je 0x10000eff0
lea r8, [fcn.100004040]
mov edx, 1
mov rcx, rbp
call fcn.10000faf4
mov esi, eax
cmp eax, edi
je 0x10000eb61
mov edi, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x10000f023
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x70]
cmp rax, 0xffffffffffffffff
je 0x10000f037
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x10000f043
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.100020910
add rsp, 0x2f8
pop rdi
pop rsi
pop rbp
pop rbx
ret