Function at 0x180125e26
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
bt ebp, 0xe1
push rbx
neg eax
sar bh, 0x92
rcr ebx, cl
push rsi
bsr rax, r9
sar bpl, 0x8b
adc al, r14b
push rdi
push r12
movzx edi, r12w
btr bp, ax
push r13
jmp 0x180125e52
push r14
lea rbp, [rsp - 0x240]
btc edi, 0x6f
mov bl, dil
sub rsp, 0x340
mov rax, qword [0x180079010]
clc
btc ebx, 0x81
xor rax, rsp
bswap ebx
shld rdi, rdx, 0x73
movzx edi, r11w
mov qword [rbp + 0x230], rax
rol dil, cl
jmp 0x180125e93
mov r12, r8
mov rdi, rcx
sub rbx, rsp
rcl ebx, 0xa8
mov bl, sil
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x180125eb4
je 0x180125f04
mov al, byte [rdx]
cmp r11b, 7
sub al, 0x2f
stc
cmp al, 0x2d
jmp 0x180125eca
ja 0x180125ee3
movsx rax, al
bt rbx, rax
jmp 0x180125edd
jb 0x180125f04
mov rcx, rdi
jmp 0x180125eeb
call fcn.180089178
mov rdx, rax
test spl, dil
cmp rax, rdi
jmp 0x180125efe
jne 0x180125eba
mov r8b, byte [rdx]
cmp r8b, 0x3a
jne 0x180125f4e
lea rax, [rdi + 1]
cmp rdx, rax
jmp 0x180125f1d
je 0x180125f4e
mov r9, r12
rol ch, 0x65
and rcx, r14
xor r8d, r8d
movzx rcx, r13w
sub edx, edx
movsx ecx, di
movzx ecx, r14w
mov rcx, rdi
jmp 0x180125f44
call fcn.180125af0
jmp 0x180126463
sub r8b, 0x2f
clc
xor r14d, r14d
jmp 0x180125f5e
cmp r8b, 0x2d
ja 0x180125f82
movsx rax, r8b
stc
clc
bt rbx, rax
mov al, r14b
mov al, 1
jmp 0x180125f7c
jb 0x180125f85
mov al, r14b
sub rdx, rdi
movzx ecx, bp
mov qword [rsp + 0x40], r14
movsxd rcx, r8d
inc rdx
mov cl, 0x4b
mov qword [rsp + 0x48], r14
cmovg rcx, rsi
neg al
movsx ecx, sp
mov qword [rsp + 0x50], r14
bswap cx
lea rcx, [rsp + 0x70]
jmp 0x180125fb8
mov qword [rsp + 0x58], r14
jmp 0x180125fc2
sbb r13, r13
test r12, 0x3e6755eb
cmp r12w, 0x783a
mov qword [rsp + 0x60], r14
and r13, rdx
mov byte [rsp + 0x68], r14b
sub edx, edx
jmp 0x180125fe6
mov qword [rsp + 0x38], r13
jmp 0x180125ff0
call fcn.1801264ae
mov rax, qword [rsp + 0x78]
sub rcx, r8
mov ecx, 0xfde9
cmp r10d, ebx
stc
cmp dword [rax + 0xc], ecx
jmp 0x18012600e
jne 0x180126043
cmp byte [rbp - 0x78], r14b
jmp 0x18012601d
je 0x180126036
mov rax, qword [rsp + 0x70]
xor r9b, 0xe2
and dword [rax + 0x3a8], 0xfffffffd
xchg r9, r9
mov r9d, ecx
jmp 0x18012603e
jmp 0x1801260b1
call fcn.180128a88
test eax, eax
jmp 0x18012604f
jne 0x180126087
cmp byte [rbp - 0x78], r14b
jmp 0x18012605e
je 0x18012607c
mov rax, qword [rsp + 0x70]
clc
and dword [rax + 0x3a8], 0xfffffffd
movzx r9d, ax
mov r9w, r12w
xchg r9b, r9b
mov r9d, 1
jmp 0x1801260b1
cmp byte [rbp - 0x78], r14b
jmp 0x180126090
je 0x1801260a8
mov rax, qword [rsp + 0x70]
shld r8w, r15w, 0x38
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r14d
movzx rcx, dx
bswap edx
lea r8, [rsp + 0x30]
mov rcx, rdi
jmp 0x1801260be
lea rdx, [rsp + 0x40]
jmp 0x1801260c8
call fcn.18012502b
mov rcx, qword [rsp + 0x50]
mov r8b, r10b
lea r8, [rbp - 0x20]
jmp 0x1801260de
test eax, eax
mov dword [rsp + 0x28], r14d
jmp 0x1801260ea
mov qword [rsp + 0x20], r14
cmovne rcx, r14
cmp r12b, dl
xor r9d, r9d
jmp 0x180126102
sub edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
test r14b, r15b
cmp sp, 0x777c
cmp rax, 0xffffffffffffffff
jmp 0x18012611e
jne 0x180126166
mov r9, r12
mov ch, 0xac
sub r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.180125af0
mov ebx, eax
stc
clc
cmp byte [rsp + 0x68], r14b
jmp 0x180126145
je 0x18012615a
mov rcx, qword [rsp + 0x50]
jmp 0x180126155
call fcn.180124fb6
mov eax, ebx
jmp 0x180126161
jmp 0x180126463
mov rsi, qword [r12 + 8]
rcr cx, cl
movsx cx, r14b
sub rsi, qword [r12]
sar rsi, 3
mov rcx, r13
cmp r11d, 0x5a28610a
movsx rcx, bx
xor edx, edx
mov qword [rbp - 0x50], r14
movsx ecx, r15w
sets ch
movsxd rcx, r14d
lea rcx, [rbp - 0x70]
jmp 0x1801261a2
mov qword [rbp - 0x48], r14
jmp 0x1801261ab
mov qword [rbp - 0x40], r14
jmp 0x1801261b4
mov qword [rbp - 0x38], r14
jmp 0x1801261bd
mov qword [rbp - 0x30], r14
mov byte [rbp - 0x28], r14b
call fcn.1801264ae
mov rax, qword [rbp - 0x68]
stc
mov ecx, 0xfde9
cmp dword [rax + 0xc], ecx
jmp 0x1801261dc
jne 0x18012620c
cmp byte [rbp - 0x58], r14b
jmp 0x1801261eb
je 0x180126204
mov rax, qword [rbp - 0x70]
bts r9d, r12d
and dword [rax + 0x3a8], 0xfffffffd
movsx r9d, r8w
mov r9d, ecx
jmp 0x180126284
call fcn.180128a88
test eax, eax
jne 0x18012624f
cmp byte [rbp - 0x58], r14b
jmp 0x180126222
je 0x18012623f
mov rax, qword [rbp - 0x70]
and dword [rax + 0x3a8], 0xfffffffd
movsx r9d, bp
not r9w
movzx r9, r10w
mov r9d, 1
jmp 0x18012624a
jmp 0x180126284
cmp byte [rbp - 0x58], r14b
jmp 0x180126258
je 0x180126279
mov rax, qword [rbp - 0x70]
btr r9d, 0x2c
and dword [rax + 0x3a8], 0xfffffffd
movsx cx, dil
xchg edx, r8d
not r8b
mov r9d, r14d
bswap cx
movsx cx, r12b
lea r8, [rsp + 0x30]
jmp 0x180126295
lea rdx, [rbp - 0x50]
xchg cx, cx
lea rcx, [rbp + 0xc]
jmp 0x1801262a5
call fcn.180125315
mov r14, qword [rbp - 0x40]
sub edx, edx
mov cx, 0x7e84
test eax, eax
seta cl
jmp 0x1801262c1
mov rcx, r14
jmp 0x1801262c9
cmovne rcx, rdx
cmp byte [rcx], 0x2e
jmp 0x1801262d5
jne 0x18012631f
mov al, byte [rcx + 1]
test r15, r12
test al, al
jmp 0x1801262e8
jne 0x180126309
cmp byte [rbp - 0x28], dl
jmp 0x1801262f6
je 0x18012636a
mov rcx, r14
call fcn.180124fb6
jmp 0x18012636a
cmp al, 0x2e
jmp 0x180126310
jne 0x18012631f
cmp byte [rcx + 2], dl
je 0x1801262ee
mov r9, r12
cmovno edx, ebx
cwd
mov r8, r13
mov rdx, rdi
jmp 0x180126332
call fcn.180125af0
mov r13d, eax
cmp rbx, 0x7d804a9c
test eax, eax
jmp 0x180126348
jne 0x180126417
cmp byte [rbp - 0x28], al
je 0x18012635f
mov rcx, r14
call fcn.180124fb6
mov r13, qword [rsp + 0x38]
mov edx, 0x312d5fad
cdq
lea rdx, [rbp - 0x20]
xchg cl, cl
mov rcx, rbx
jmp 0x180126378
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r14d, r14d
test r10b, r8b
stc
cmc
test eax, eax
jne 0x180126189
mov rax, qword [r12]
mov rdx, qword [r12 + 8]
cmp bpl, 0x11
test r10b, spl
sub rdx, rax
test r10b, dil
sar rdx, 3
cmp rsi, rdx
jmp 0x1801263b0
je 0x1801263e3
sub rdx, rsi
movsx cx, r8b
cmovo r9, r12
lea rcx, [rax + rsi*8]
lea r9, [0x180063bd8]
movzx r8d, si
movsx r8, bp
lea r8d, [r14 + 8]
jmp 0x1801263de
call fcn.18012b928
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], r14b
jmp 0x1801263f6
je 0x18012640b
mov rcx, qword [rsp + 0x50]
jmp 0x180126406
call fcn.180124fb6
sub eax, eax
jmp 0x180126412
jmp 0x180126463
cmp byte [rbp - 0x28], 0
jmp 0x180126420
je 0x180126433
mov rcx, r14
jmp 0x18012642e
call fcn.180124fb6
mov rcx, rbx
jmp 0x18012643b
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], 0
jmp 0x18012644b
je 0x180126460
mov rcx, qword [rsp + 0x50]
jmp 0x18012645b
call fcn.180124fb6
mov eax, r13d
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
jmp 0x180126472
call fcn.1801157b3
add rsp, 0x340
pop r14
pop r13
xchg bl, bpl
movzx si, dil
pop r12
xchg rsi, rsi
movsx ebx, dx
pop rdi
movzx rsi, bx
not si
xchg sil, bl
pop rsi
jmp 0x1801264ab
pop rbx
pop rbp
ret