Function at 0x140011bd8
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x3d8]
sub rsp, 0x4d0
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov byte [rsp + 0x30], r8b
xor r8d, r8d
mov al, r9b
mov rdi, rcx
mov ebx, 0x80070057
mov sil, r8b
mov byte [rsp + 0x32], r8b
mov byte [rsp + 0x31], al
test rcx, rcx
je 0x140011d4e
mov edx, dword [rcx]
cmp edx, 0xffffffff
jne 0x140011c43
mov word [rbp + 0x1b0], r8w
mov ebx, r8d
jmp 0x140011c6b
lea rax, [rbp + 0x1b0]
bts edx, 0xf
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor r8d, r8d
mov ebx, eax
test eax, eax
js 0x140011d4a
mov r8, qword [rdi + 0x10]
test r8, r8
je 0x140011c82
lea rcx, [rbp + 0x1b0]
call fcn.1400114e0
mov ebx, eax
xor r8d, r8d
test ebx, ebx
js 0x140011d12
cmp dword [rdi], 6
jne 0x140011ce3
mov eax, dword [0x14002ec28]
test eax, eax
jne 0x140011cdb
lea r9d, [r8 + 1]
lea rdx, [rsp + 0x60]
lea r8d, [rax + 6]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r8d, r8d
test eax, eax
je 0x140011cd5
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
neg eax
sbb eax, eax
add eax, 2
xor r8d, r8d
mov dword [0x14002ec28], eax
jmp 0x140011cdb
mov eax, dword [0x14002ec28]
cmp eax, 1
jne 0x140011ce3
mov r8b, al
mov r9d, dword [rdi + 4]
mov dl, byte [rsp + 0x30]
lea rax, [rsp + 0x32]
mov qword [rsp + 0x28], rax
mov eax, dword [rdi + 8]
lea rcx, [rbp + 0x1b0]
mov dword [rsp + 0x20], eax
call fcn.140011b44
mov sil, byte [rsp + 0x32]
mov ebx, eax
xor r8d, r8d
mov edx, dword [rdi + 0x18]
cmp edx, 0xffffffff
je 0x140011d4a
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r8d, r8d
test eax, eax
je 0x140011d33
mov ebx, r8d
jmp 0x140011d4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov al, byte [rsp + 0x31]
cmp byte [rsp + 0x30], r8b
je 0x140011d62
test sil, sil
jne 0x140011d5e
test al, al
je 0x140011d62
mov al, 1
jmp 0x140011d65
mov al, r8b
mov byte [rsp + 0x30], al
test ebx, ebx
js 0x140011ed2
test al, al
je 0x140011ed2
cmp dword [rdi], 0xffffffff
mov esi, 0x104
jne 0x140011d90
mov word [rbp + 0x1b0], r8w
mov ebx, r8d
jmp 0x140011dcd
mov edx, dword [rdi]
lea rax, [rbp + 0x1b0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test eax, eax
js 0x140011ed2
lea r8, [0x1400029a4]
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov r8, qword [rdi + 0x10]
test r8, r8
je 0x140011de6
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
call qword [sym.imp.msvcrt.dll_wcscat_s]
lea r8, [0x140002990]
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
call qword [sym.imp.msvcrt.dll_wcscat_s]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
cmp rax, rsi
je 0x140011ed2
lea rcx, [rbp + 0x1b0]
xor eax, eax
inc rsi
cmp word [rcx + rsi*2], ax
jne 0x140011e2a
cmp word [rbp - 0x74], 0x2e
je 0x140011eab
cmp word [rbp - 0x72], 0x2e
je 0x140011eab
lea r8, [rbp - 0x74]
lea rcx, [rbp + 0x1b0]
mov edx, 0x104
mov word [rbp + rsi*2 + 0x1ae], ax
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov eax, dword [rdi + 4]
mov r8d, dword [rsp + 0x60]
mov r9b, byte [rsp + 0x30]
or ecx, 0xffffffff
mov dword [rsp + 0x44], eax
mov eax, dword [rdi + 8]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x58], ecx
shr r8d, 4
lea rax, [rbp + 0x1b0]
lea rcx, [rsp + 0x40]
xor edx, edx
and r8b, 1
mov qword [rsp + 0x50], rax
call fcn.140011bd8
test ebx, ebx
js 0x140011eab
test eax, eax
cmovs ebx, eax
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
test eax, eax
mov eax, ecx
jne 0x140011e33
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.14002ad70
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret