Function at 0x18016a1f5
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
ror bpl, 0x75
lahf
cmc
push rbx
setno bh
or bx, r8w
push rsi
or ax, r9w
push rdi
bt bx, 0xbf
setbe al
btr bx, 0x2b
push r12
or ax, r10w
push r13
push r14
clc
sub bh, cl
lea rbp, [rsp - 0x240]
bsf rbx, rsi
shr bh, cl
rol rax, cl
sub rsp, 0x340
shld r12w, bp, 0x93
cmovle ax, r14w
ror bx, cl
mov rax, qword [0x18009a010]
test ah, ah
btr rbx, r10
shr edi, 0xd7
xor rax, rsp
xchg dil, dil
clc
mov qword [rbp + 0x230], rax
inc r12w
mov r12, r8
jmp 0x18016a275
mov rdi, rcx
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x18016a28a
je 0x18016a2d5
mov al, byte [rdx]
jmp 0x18016a29b
sub al, 0x2f
clc
test r14b, r14b
cmp al, 0x2d
jmp 0x18016a2a8
ja 0x18016a2bc
movsx rax, al
bt rbx, rax
jb 0x18016a2d5
mov rcx, rdi
call fcn.1800a5158
mov rdx, rax
cmp rax, rdi
jmp 0x18016a2cf
jne 0x18016a290
mov r8b, byte [rdx]
clc
cmp r8b, 0x3a
jmp 0x18016a2e2
jne 0x18016a32e
lea rax, [rdi + 1]
cmp r15b, bl
jmp 0x18016a2f4
cmp rdx, rax
jmp 0x18016a2fc
je 0x18016a32e
mov r9, r12
xor r8d, r8d
test r11b, 0xad
xor cl, r12b
neg cl
sub edx, edx
cmovns ecx, r8d
movzx cx, r9b
mov rcx, rdi
jmp 0x18016a324
call fcn.180169ed2
jmp 0x18016a84f
sub r8b, 0x2f
clc
cmp r10b, r12b
cmp ebp, 0x47d637b9
sub r14d, r14d
cmp bx, 0x4979
cmc
cmp r8b, 0x2d
ja 0x18016a364
movsx rax, r8b
bt rbx, rax
mov al, 1
jmp 0x18016a35e
jb 0x18016a36d
mov al, r14b
shrd cx, r10w, 0x31
sub rdx, rdi
movsxd rcx, ebx
mov qword [rsp + 0x40], r14
inc rdx
mov qword [rsp + 0x48], r14
neg al
inc cx
mov qword [rsp + 0x50], r14
movsxd rcx, ebx
lea rcx, [rsp + 0x70]
jmp 0x18016a397
mov qword [rsp + 0x58], r14
jmp 0x18016a3a1
sbb r13, r13
clc
mov qword [rsp + 0x60], r14
jmp 0x18016a3af
and r13, rdx
jmp 0x18016a3c0
mov byte [rsp + 0x68], r14b
xor edx, edx
jmp 0x18016a3cc
mov qword [rsp + 0x38], r13
jmp 0x18016a3d6
call fcn.18016a8ab
mov rax, qword [rsp + 0x78]
movsx ecx, r13w
bsf rcx, r12
btc ecx, ebx
mov ecx, 0xfde9
cmp r11w, ax
cmp dword [rax + 0xc], ecx
jmp 0x18016a3fc
jne 0x18016a434
cmp byte [rbp - 0x78], r14b
jmp 0x18016a40b
je 0x18016a427
mov rax, qword [rsp + 0x70]
shrd r9d, r9d, 0x85
bts r9d, ebp
stc
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ecx
jmp 0x18016a42f
jmp 0x18016a49e
call fcn.18016ce43
test eax, eax
jmp 0x18016a440
jne 0x18016a475
cmp byte [rbp - 0x78], r14b
jmp 0x18016a44f
je 0x18016a465
mov rax, qword [rsp + 0x70]
sbb r9b, 0x6f
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x18016a470
jmp 0x18016a49e
cmp byte [rbp - 0x78], r14b
jmp 0x18016a47e
je 0x18016a49b
mov rax, qword [rsp + 0x70]
btr edx, esp
sar r8b, cl
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x18016a49b
mov r9d, r14d
lea r8, [rsp + 0x30]
movsxd rdx, r8d
movzx rcx, dx
mov ch, 0x24
mov rcx, rdi
cwd
not dh
lea rdx, [rsp + 0x40]
jmp 0x18016a4be
call fcn.18016940e
mov rcx, qword [rsp + 0x50]
cmp ah, al
lea r8, [rbp - 0x20]
test eax, eax
jmp 0x18016a4d5
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
jmp 0x18016a4e4
cmovne rcx, r14
jmp 0x18016a4f4
xor r9d, r9d
jmp 0x18016a4fc
sub edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jmp 0x18016a510
jne 0x18016a558
mov r9, r12
sub r8d, r8d
sub edx, edx
movzx rcx, cx
mov rcx, rdi
jmp 0x18016a52a
call fcn.180169ed2
mov ebx, eax
stc
cmp byte [rsp + 0x68], r14b
je 0x18016a54c
mov rcx, qword [rsp + 0x50]
jmp 0x18016a547
call fcn.180169386
mov eax, ebx
jmp 0x18016a553
jmp 0x18016a84f
mov rsi, qword [r12 + 8]
ror cx, cl
shrd rcx, r8, 0xa6
sub rsi, qword [r12]
cmc
bt ecx, 0x50
sar rsi, 3
clc
sub edx, edx
mov cl, r12b
mov qword [rbp - 0x50], r14
lea rcx, [rbp - 0x70]
jmp 0x18016a585
mov qword [rbp - 0x48], r14
jmp 0x18016a58e
mov qword [rbp - 0x40], r14
jmp 0x18016a597
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
jmp 0x18016a5a4
mov byte [rbp - 0x28], r14b
jmp 0x18016a5ad
call fcn.18016a8ab
mov rax, qword [rbp - 0x68]
rcl cx, 0x36
mov ecx, 0xfde9
jmp 0x18016a5c4
cmp dword [rax + 0xc], ecx
jmp 0x18016a5cc
jne 0x18016a60a
cmp byte [rbp - 0x58], r14b
jmp 0x18016a5db
je 0x18016a5fd
mov rax, qword [rbp - 0x70]
shrd r9w, sp, 0xe5
test rsp, 0x43ef6db5
and dword [rax + 0x3a8], 0xfffffffd
bswap r9w
mov r9d, ecx
jmp 0x18016a605
jmp 0x18016a670
call fcn.18016ce43
test eax, eax
jne 0x18016a647
cmp byte [rbp - 0x58], r14b
jmp 0x18016a620
je 0x18016a637
mov rax, qword [rbp - 0x70]
stc
and dword [rax + 0x3a8], 0xfffffffd
movzx r9w, r9b
mov r9d, 1
jmp 0x18016a642
jmp 0x18016a670
cmp byte [rbp - 0x58], r14b
jmp 0x18016a650
je 0x18016a66a
mov rax, qword [rbp - 0x70]
and dword [rax + 0x3a8], 0xfffffffd
bswap r8w
mov cl, 0x5f
movsx edx, bx
mov r9d, r14d
xchg rdx, rdx
lea r8, [rsp + 0x30]
mov rcx, rsi
cmovnp rdx, r15
not dh
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xc]
jmp 0x18016a68b
call fcn.180169711
mov r14, qword [rbp - 0x40]
stc
rcl ch, cl
xor edx, edx
sar rcx, 0x54
xor ecx, edx
test eax, eax
movsx ecx, di
movsx cx, dil
not ch
mov rcx, r14
cmovne rcx, rdx
cmc
stc
cmp r8w, 0x643a
cmp byte [rcx], 0x2e
jne 0x18016a704
mov al, byte [rcx + 1]
test al, al
jne 0x18016a6ee
cmp byte [rbp - 0x28], dl
jmp 0x18016a6d6
je 0x18016a759
mov rcx, r14
jmp 0x18016a6e4
call fcn.180169386
jmp 0x18016a759
cmp al, 0x2e
jne 0x18016a704
cmp byte [rcx + 2], dl
jmp 0x18016a6fe
je 0x18016a6ce
mov r9, r12
cmovno edx, ebp
movzx rdx, bx
mov r8, r13
cwd
mov rdx, rdi
jmp 0x18016a71b
call fcn.180169ed2
mov r13d, eax
cmp esp, r13d
test eax, eax
jmp 0x18016a72d
jne 0x18016a800
cmp byte [rbp - 0x28], al
je 0x18016a749
mov rcx, r14
jmp 0x18016a744
call fcn.180169386
mov r13, qword [rsp + 0x38]
mov dh, 0xe6
movsx edx, r15w
movsx rcx, bx
lea rdx, [rbp - 0x20]
movzx cx, dl
setns cl
mov rcx, rbx
jmp 0x18016a76c
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
sub r14d, r14d
test eax, eax
jmp 0x18016a77c
jne 0x18016a573
mov rax, qword [r12]
test si, 0x6666
adc dl, 0x73
bts edx, r13d
mov rdx, qword [r12 + 8]
jmp 0x18016a79c
sub rdx, rax
test r15w, 0x1f70
sar rdx, 3
test r9b, dl
cmp rsi, rdx
je 0x18016a7d1
sub rdx, rsi
lea rcx, [rax + rsi*8]
lea r9, [0x180079398]
lea r8d, [r14 + 8]
jmp 0x18016a7cc
call fcn.18016fc92
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], r14b
jmp 0x18016a7e4
je 0x18016a7f9
mov rcx, qword [rsp + 0x50]
jmp 0x18016a7f4
call fcn.180169386
xor eax, eax
jmp 0x18016a84f
cmp byte [rbp - 0x28], 0
jmp 0x18016a809
je 0x18016a81c
mov rcx, r14
jmp 0x18016a817
call fcn.180169386
mov rcx, rbx
jmp 0x18016a824
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], 0
jmp 0x18016a834
je 0x18016a849
mov rcx, qword [rsp + 0x50]
jmp 0x18016a844
call fcn.180169386
mov eax, r13d
rol cl, 0x26
mov rcx, qword [rbp + 0x230]
jmp 0x18016a85f
xor rcx, rsp
jmp 0x18016a867
call fcn.180159e82
add rsp, 0x340
jmp 0x18016a878
pop r14
mov r13b, r9b
pop r13
jmp 0x18016a88c
pop r12
bswap rbx
pop rdi
movzx ebx, r8w
movsx bx, r15b
pop rsi
cmovnp bp, bp
not rbx
pop rbx
pop rbp
jmp 0x18016a8aa
ret