Function at 0x1400014f0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1400390f8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov eax, 0x104
mov qword [rsp + 0x30], rdx
mov rdi, rdx
mov byte [rbp + 0x150], 1
mov rsi, rcx
mov qword [rbp + 0x158], rax
xor ebx, ebx
lea rcx, [rsp + 0x40]
mov r8d, eax
mov qword [rbp + 0x148], rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x150]
lea rcx, [rsp + 0x40]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, 0x104
call fcn.1400104d0
test eax, eax
js 0x140018b82
mov dword [rdi], 1
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x140001582
test edi, edi
je 0x140018b8c
lea eax, [rdi + 3]
mov rcx, rsi
cmp eax, 0x7fe7
ja 0x14000178e
lea rdx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140018b96
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov ecx, dword [rbp + 0x184]
mov eax, dword [rbp + 0x160]
test al, 0x10
je 0x14000178b
bt eax, 0xa
jb 0x140018bae
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140010630
lea eax, [rdi - 1]
movsxd rcx, eax
cmp word [rsi + rcx*2], 0x3a
je 0x140001616
cmp word [rsi + rcx*2], 0x5c
je 0x140001616
lea rdx, [0x1400304d0]
lea rcx, [rsp + 0x40]
call fcn.140010578
inc edi
lea rdx, [0x140030050]
lea rcx, [rsp + 0x40]
call fcn.140010578
cmp qword [rbp + 0x148], rbx
lea rcx, [rsp + 0x40]
lea rdx, [rbp + 0x160]
cmovne rcx, qword [rbp + 0x148]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x14000178b
movsxd r8, edi
mov qword [rsp + 0x28], r8
cmp dword [0x140039834], ebx
jne 0x140001778
lea rcx, [rbp + 0x394]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140001676
mov ecx, eax
test eax, eax
jne 0x140001699
lea rdx, [rbp + 0x18c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], bx
jne 0x140001690
test ecx, ecx
lea r9, [rbp + 0x394]
lea rdx, [rbp + 0x18c]
cmove r9, rdx
add eax, edi
cmp eax, 0x7fe7
jae 0x140018e1f
cmp qword [rbp + 0x148], rbx
lea rax, [rsp + 0x40]
mov rdx, qword [rbp + 0x158]
cmovne rax, qword [rbp + 0x148]
sub rdx, r8
lea rcx, [rax + r8*2]
mov r8, r9
call fcn.140011620
mov eax, dword [rbp + 0x160]
mov dword [rsp + 0x20], eax
test al, 0x10
je 0x140018c3f
movzx ecx, word [rbp + 0x18c]
movzx eax, word [0x1400303c0]
sub ecx, eax
jne 0x140001718
movzx ecx, word [rbp + 0x18e]
movzx eax, word [0x1400303c2]
sub ecx, eax
test ecx, ecx
je 0x140001758
movzx ecx, word [rbp + 0x18c]
movzx eax, word [0x1400303b8]
sub ecx, eax
jne 0x140001750
movzx ecx, word [rbp + 0x18e]
movzx eax, word [0x1400303ba]
sub ecx, eax
jne 0x140001750
movzx ecx, word [rbp + 0x190]
movzx eax, word [0x1400303bc]
sub ecx, eax
test ecx, ecx
jne 0x140018bbd
mov rcx, qword [rsp + 0x38]
lea rdx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x140001778
mov r8, qword [rsp + 0x28]
jmp 0x14000165f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
cmp dword [0x140039834], ebx
jne 0x140001795
mov rcx, rsi
call fcn.140001488
mov ebx, eax
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, ebx
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400173b0
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4c0
pop rdi
pop rsi
pop rbp
ret
mov ebx, 8
jmp 0x140001795
mov ebx, 0xa1
jmp 0x140001795
mov eax, 0x10
mov dword [rbp + 0x184], ebx
mov dword [rbp + 0x160], eax
mov ecx, ebx
jmp 0x1400015d0
bt ecx, 0x1d
jb 0x14000178b
jmp 0x1400015e2
cmp qword [rbp + 0x148], rbx
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x24]
cmovne rcx, qword [rbp + 0x148]
call fcn.1400014f0
cmp dword [0x140039834], ebx
jne 0x140001778
test eax, eax
je 0x140001758
mov rcx, qword [rsp + 0x30]
mov dword [rcx], ebx
cmp eax, 0x91
jne 0x140018c07
cmp dword [rsp + 0x24], ebx
je 0x140001758
cmp qword [rbp + 0x148], rbx
lea r8, [rsp + 0x40]
mov edx, 1
mov ecx, 0x4000271b
cmovne r8, qword [rbp + 0x148]
call fcn.140014d90
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
xor edx, edx
call fcn.140014d90
nop
jmp 0x140001758
test al, 1
je 0x140018c66
cmp qword [rbp + 0x148], rbx
lea rcx, [rsp + 0x40]
mov edx, eax
cmovne rcx, qword [rbp + 0x148]
and edx, 0xfffffffe
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
mov eax, dword [rsp + 0x20]
cmp qword [rbp + 0x148], rbx
lea rcx, [rsp + 0x40]
mov edx, eax
cmovne rcx, qword [rbp + 0x148]
call fcn.140001ae4
test eax, eax
je 0x140001758
cmp eax, 0x4d3
je 0x140001778
cmp eax, 3
jne 0x140018cfb
cmp qword [rbp + 0x148], rbx
lea rcx, [rsp + 0x40]
lea r8d, [rax + 1]
cmovne rcx, qword [rbp + 0x148]
lea rdx, str.__
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x140018cfb
cmp qword [rbp + 0x148], rbx
lea rcx, [rsp + 0x40]
cmovne rcx, qword [rbp + 0x148]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
movsxd rcx, eax
cmp rcx, 0x7fe7
jbe 0x140018cfb
mov ecx, 0x6f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
lea rcx, [rbp + 0x394]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140018d06
test rax, rax
je 0x140018d61
cmp qword [rbp + 0x148], rbx
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
lea rdx, [rbp + 0x18c]
cmovne rax, qword [rbp + 0x148]
mov word [rax + rcx*2], bx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], bx
jne 0x140018d3c
add rax, rcx
lea rcx, [rsp + 0x40]
cmp rax, 0x7fe7
jb 0x140018dbd
lea rdx, [rbp + 0x394]
call fcn.140010578
cmp qword [rbp + 0x148], rbx
lea r8, [rsp + 0x40]
mov edx, 1
mov ecx, 0x4000271b
cmovne r8, qword [rbp + 0x148]
call fcn.140014d90
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
xor edx, edx
call fcn.140014d90
cmp qword [rbp + 0x148], rbx
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x20]
cmovne rcx, qword [rbp + 0x148]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
mov rax, qword [rsp + 0x30]
mov dword [rax], ebx
jmp 0x140001758
lea rdx, [rbp + 0x18c]
call fcn.140010578
cmp qword [rbp + 0x148], rbx
lea r8, [rsp + 0x40]
mov edx, 1
mov ecx, 0x4000271b
cmovne r8, qword [rbp + 0x148]
call fcn.140014d90
cmp qword [rbp + 0x148], rbx
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
lea rdx, [rbp + 0x394]
cmovne rax, qword [rbp + 0x148]
mov word [rax + rcx*2], bx
lea rcx, [rsp + 0x40]
call fcn.140010578
jmp 0x140018d84
mov rax, qword [rsp + 0x30]
mov r8, rsi
mov edx, 2
mov ecx, 0x400023da
mov dword [rax], ebx
call fcn.140014d90
nop
jmp 0x140001778