Function at 0x18000f9f0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rbx, r8
mov ebp, edx
mov rsi, rcx
mov qword [rsp + 0x48], rbx
test rcx, rcx
je 0x18000fce0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000fce0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call fcn.18000af10
mov edi, dword [rsp + 0x40]
cmp edi, 0xffffffff
je 0x18000fa81
test dil, 1
je 0x18000fa81
and edi, 0xfffffffe
mov rcx, rsi
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r8, rbx
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test eax, eax
je 0x18000fcdc
test dil, 0x10
je 0x18000fce2
mov edx, 0x5c
mov rcx, rsi
call fcn.180070880
mov rdi, rax
test rax, rax
je 0x18000fbab
inc rdi
lea rdx, str.mails
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, str.MailsTemp
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, str.MailsLeave
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, str.files
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, str.WinPatch
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, str.tsdocbak
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, [0x1800e49c8]
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, str.Temp
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, str.SCDT
mov rcx, rdi
call fcn.180070300
test eax, eax
je 0x18000fcdc
lea rdx, str.Temp_Docerr_
mov r8d, SafeArrayCreate
mov rcx, rdi
call fcn.18006f8e0
test eax, eax
je 0x18000fcdc
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x190], 0
call fcn.18006f140
lea r8, [0x1800e49a0]
lea rcx, [rsp + 0x190]
mov r9, rsi
mov edx, 0x103
call fcn.180071398
test eax, eax
js 0x18000fce0
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x50], 0
call fcn.18006f140
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000fcdc
nop word [rax + rax]
lea rdx, [0x1800e45ec]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000fcb9
lea rdx, [0x1800e45e8]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000fcb9
lea rcx, [rsp + 0x2a1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x2a0], 0
call fcn.18006f140
lea r11, [rsp + 0x7c]
lea r8, [0x1800e3014]
lea rcx, [rsp + 0x2a0]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], r11
call fcn.180071398
test eax, eax
js 0x18000fcb9
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x2a0]
mov edx, ebp
call fcn.18000f9f0
mov ebx, eax
test ebx, ebx
je 0x18000fcd3
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18000fc30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x18000fce2
xor eax, eax
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.18006f110
mov rbx, qword [rsp + 0x3f8]
add rsp, 0x3c0
pop rdi
pop rsi
pop rbp
ret