Function at 0x18000f3b0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rbx, r8
mov ebp, edx
mov rsi, rcx
mov qword [rsp + 0x48], rbx
test rcx, rcx
je 0x18000f6a0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000f6a0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call fcn.18000a880
mov edi, dword [rsp + 0x40]
cmp edi, 0xffffffff
je 0x18000f441
test dil, 1
je 0x18000f441
and edi, 0xfffffffe
mov rcx, rsi
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r8, rbx
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test eax, eax
je 0x18000f69c
test dil, 0x10
je 0x18000f6a2
mov edx, 0x5c
mov rcx, rsi
call fcn.180044298
mov rdi, rax
test rax, rax
je 0x18000f56b
inc rdi
lea rdx, str.mails
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, str.MailsTemp
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, str.MailsLeave
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, str.files
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, str.WinPatch
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, str.tsdocbak
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, [0x1800d4ef0]
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, str.Temp
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, str.SCDT
mov rcx, rdi
call fcn.1800451e8
test eax, eax
je 0x18000f69c
lea rdx, str.Temp_Docerr_
mov r8d, SafeArrayCreate
mov rcx, rdi
call fcn.1800453d8
test eax, eax
je 0x18000f69c
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x190], 0
call fcn.180043ef0
lea r8, [0x1800d4ec8]
lea rcx, [rsp + 0x190]
mov r9, rsi
mov edx, 0x103
call fcn.180045c4c
test eax, eax
js 0x18000f6a0
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x50], 0
call fcn.180043ef0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000f69c
nop word [rax + rax]
lea rdx, [0x1800d4b0c]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000f679
lea rdx, [0x1800d4b08]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000f679
lea rcx, [rsp + 0x2a1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x2a0], 0
call fcn.180043ef0
lea r11, [rsp + 0x7c]
lea r8, [0x1800d1c4c]
lea rcx, [rsp + 0x2a0]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], r11
call fcn.180045c4c
test eax, eax
js 0x18000f679
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x2a0]
mov edx, ebp
call fcn.18000f3b0
mov ebx, eax
test ebx, ebx
je 0x18000f693
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18000f5f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x18000f6a2
xor eax, eax
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x3f8]
add rsp, 0x3c0
pop rdi
pop rsi
pop rbp
ret