Function at 0x180159ab4
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
shr rax, 0x62
push rbx
sbb rax, 0x561673c7
xor eax, r13d
push rsi
bts rbp, rsp
or bx, r10w
push rdi
or bpl, dl
push r12
add bh, dh
push r13
sar bx, cl
btc r12, 0xa8
push r14
mov di, cx
lea rbp, [rsp - 0x240]
cmovns eax, ecx
cmp dl, 0x48
sub rsp, 0x340
rcr r12b, 0x91
sbb r12b, dl
or bl, r15b
mov rax, qword [0x180094010]
shl bx, cl
xor rax, rsp
mov qword [rbp + 0x230], rax
add r12b, 0x38
bsr r12w, r10w
sub dil, bpl
mov r12, r8
mov rdi, rcx
sub ebx, 0x72364fb3
cmovne bx, r13w
movsx ebx, di
movabs rbx, 0x200000000801
jmp 0x180159b48
cmp rdx, rcx
jmp 0x180159b50
je 0x180159ba9
mov al, byte [rdx]
stc
test rbx, 0x242f0129
sub al, 0x2f
clc
stc
cmp al, 0x2d
jmp 0x180159b6b
ja 0x180159b8a
movsx rax, al
clc
jmp 0x180159b7b
bt rbx, rax
jmp 0x180159b84
jb 0x180159ba9
mov rcx, rdi
jmp 0x180159b92
call fcn.1800a4588
mov rdx, rax
clc
cmp rax, rdi
jmp 0x180159ba3
jne 0x180159b56
mov r8b, byte [rdx]
cmp r8b, 0x3a
jne 0x180159be7
lea rax, [rdi + 1]
cmp rdx, rax
je 0x180159be7
mov r9, r12
sub r8d, r8d
movsx cx, r14b
xor edx, edx
movsx cx, r12b
mov rcx, rdi
jmp 0x180159bdd
call fcn.18015977a
jmp 0x18015a124
sub r8b, 0x2f
xor r14d, r14d
jmp 0x180159bf6
cmp r8b, 0x2d
jmp 0x180159bff
ja 0x180159c15
movsx rax, r8b
bt rbx, rax
mov al, 1
jb 0x180159c1b
mov al, r14b
movsxd rcx, eax
sub rdx, rdi
mov qword [rsp + 0x40], r14
xchg cl, cl
setl ch
inc rdx
mov qword [rsp + 0x48], r14
neg al
not cl
jmp 0x180159c3c
mov qword [rsp + 0x50], r14
movsx ecx, dx
movsx rcx, r13w
cmovo ecx, ebx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], r14
sbb r13, r13
cmp bpl, 0x69
test r11w, r10w
cmp r15b, r8b
mov qword [rsp + 0x60], r14
cmc
stc
and r13, rdx
cmp dl, 0xb4
mov byte [rsp + 0x68], r14b
test r8b, 0x40
sub edx, edx
jmp 0x180159c80
mov qword [rsp + 0x38], r13
call fcn.18015a17b
mov rax, qword [rsp + 0x78]
rcr cx, cl
mov ecx, 0xfde9
cmp dword [rax + 0xc], ecx
jne 0x180159ccd
cmp byte [rbp - 0x78], r14b
jmp 0x180159ca9
je 0x180159cc0
mov rax, qword [rsp + 0x70]
btr r9w, r15w
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ecx
jmp 0x180159cc8
jmp 0x180159d45
call fcn.18015c687
test eax, eax
jmp 0x180159cd9
jne 0x180159d17
cmp byte [rbp - 0x78], r14b
jmp 0x180159ce8
je 0x180159d07
mov rax, qword [rsp + 0x70]
xchg r9, r9
sar r9b, cl
and dword [rax + 0x3a8], 0xfffffffd
xchg r9b, r9b
mov r9w, r12w
mov r9d, 1
jmp 0x180159d12
jmp 0x180159d45
cmp byte [rbp - 0x78], r14b
jmp 0x180159d20
je 0x180159d3c
mov rax, qword [rsp + 0x70]
add r9, r14
and dword [rax + 0x3a8], 0xfffffffd
movsxd rdx, ecx
mov r9w, r10w
mov r9d, r14d
movzx ecx, cx
movsxd r8, r12d
lea r8, [rsp + 0x30]
mov rcx, rdi
lea rdx, [rsp + 0x40]
jmp 0x180159d57
call fcn.180158c57
mov rcx, qword [rsp + 0x50]
lea r8, [rbp - 0x20]
cmc
cmp dil, 0x9c
test eax, eax
jmp 0x180159d71
mov dword [rsp + 0x28], r14d
jmp 0x180159d7b
mov qword [rsp + 0x20], r14
jmp 0x180159d85
cmovne rcx, r14
sub r9d, r9d
test r8b, r14b
cmp r9b, 0x4c
sub edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jmp 0x180159da7
jne 0x180159df2
mov r9, r12
shr rcx, cl
sub r8d, r8d
sub edx, edx
mov rcx, rdi
jmp 0x180159dc0
call fcn.18015977a
mov ebx, eax
stc
test r8w, r15w
cmp byte [rsp + 0x68], r14b
jmp 0x180159dd6
je 0x180159deb
mov rcx, qword [rsp + 0x50]
jmp 0x180159de6
call fcn.180158be0
mov eax, ebx
jmp 0x18015a124
mov rsi, qword [r12 + 8]
xadd cl, cl
ror ecx, cl
btr cx, 0xfb
sub rsi, qword [r12]
or cl, bh
cmc
sar rsi, 3
bsr ecx, r8d
sub edx, edx
bswap cx
movsx ecx, si
movsx cx, dh
mov qword [rbp - 0x50], r14
movsx rcx, sp
jmp 0x180159e2e
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x48], r14
jmp 0x180159e3b
mov qword [rbp - 0x40], r14
jmp 0x180159e44
mov qword [rbp - 0x38], r14
jmp 0x180159e4d
mov qword [rbp - 0x30], r14
jmp 0x180159e56
mov byte [rbp - 0x28], r14b
jmp 0x180159e5f
call fcn.18015a17b
mov rax, qword [rbp - 0x68]
shr ecx, 0x58
test ax, 0x337a
mov ecx, 0xfde9
clc
test r9b, 0x66
cmp dword [rax + 0xc], ecx
jmp 0x180159e81
jne 0x180159eb3
cmp byte [rbp - 0x58], r14b
jmp 0x180159e90
je 0x180159ea6
mov rax, qword [rbp - 0x70]
sar r9b, 0x8f
stc
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ecx
jmp 0x180159eae
jmp 0x180159f2c
call fcn.18015c687
test eax, eax
jne 0x180159ef2
cmp byte [rbp - 0x58], r14b
je 0x180159ee2
mov rax, qword [rbp - 0x70]
sal r9b, 0xc3
xadd r9w, r9w
adc r9b, 0x20
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x180159eed
jmp 0x180159f2c
cmp byte [rbp - 0x58], r14b
je 0x180159f1d
mov rax, qword [rbp - 0x70]
rol r8d, cl
sub r9d, ecx
sub r8b, 0xaa
and dword [rax + 0x3a8], 0xfffffffd
movzx ecx, r9w
sets dh
movzx dx, r10b
mov r9d, r14d
jmp 0x180159f2c
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xc]
jmp 0x180159f3e
call fcn.180158f74
mov r14, qword [rbp - 0x40]
sub edx, edx
and cx, 0x450f
test eax, eax
seto ch
bswap cx
mov rcx, r14
jmp 0x180159f5e
cmovne rcx, rdx
clc
cmc
cmp byte [rcx], 0x2e
jne 0x180159fbc
mov al, byte [rcx + 1]
test ax, r9w
jmp 0x180159f79
test al, al
jmp 0x180159f80
jne 0x180159fa6
cmp byte [rbp - 0x28], dl
jmp 0x180159f8e
je 0x18015a012
mov rcx, r14
jmp 0x180159f9c
call fcn.180158be0
jmp 0x18015a012
cmp al, 0x2e
jmp 0x180159fad
jne 0x180159fbc
cmp byte [rcx + 2], dl
je 0x180159f86
mov r9, r12
mov r8b, 0x7f
mov r8, r13
movzx rdx, dx
mov dx, bp
mov rdx, rdi
call fcn.18015977a
mov r13d, eax
jmp 0x180159fdd
test eax, eax
jmp 0x180159fe4
jne 0x18015a0d1
cmp byte [rbp - 0x28], al
jmp 0x180159ff2
je 0x18015a005
mov rcx, r14
jmp 0x18015a000
call fcn.180158be0
mov r13, qword [rsp + 0x38]
cmovge cx, sp
not cl
mov ecx, esp
lea rdx, [rbp - 0x20]
movzx cx, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
sub r14d, r14d
test eax, eax
jmp 0x18015a02e
jne 0x180159e10
mov rax, qword [r12]
cmovge rdx, r14
xor dl, r9b
mov rdx, qword [r12 + 8]
sub rdx, rax
test cx, bx
sar rdx, 3
cmp r8w, di
cmp rsi, rdx
jmp 0x18015a05a
je 0x18015a098
sub rdx, rsi
movzx r8, dx
movsxd rcx, ecx
movzx r9d, bp
lea rcx, [rax + rsi*8]
xchg r9d, r8d
movzx r8w, r13b
lea r9, [0x1800732b8]
cmovbe r8w, r13w
movzx r8w, cl
movsx r8, di
lea r8d, [r14 + 8]
call fcn.18015f4e5
mov rcx, rbx
jmp 0x18015a0a0
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], r14b
jmp 0x18015a0b0
je 0x18015a0c5
mov rcx, qword [rsp + 0x50]
jmp 0x18015a0c0
call fcn.180158be0
sub eax, eax
jmp 0x18015a0cc
jmp 0x18015a124
cmp byte [rbp - 0x28], 0
jmp 0x18015a0da
je 0x18015a0ed
mov rcx, r14
jmp 0x18015a0e8
call fcn.180158be0
mov rcx, rbx
jmp 0x18015a0f5
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], 0
jmp 0x18015a105
je 0x18015a11a
mov rcx, qword [rsp + 0x50]
jmp 0x18015a115
call fcn.180158be0
mov eax, r13d
add cl, r15b
sal ch, 0xbd
stc
mov rcx, qword [rbp + 0x230]
test r8b, 0xee
clc
cmp sil, spl
xor rcx, rsp
call fcn.18014946c
add rsp, 0x340
pop r14
mov si, ax
bswap di
pop r13
movsx rdi, r12w
cmove r12, rbp
movzx rdi, r12w
pop r12
mov dil, 0x48
pop rdi
movsx rsi, r8w
pop rsi
setbe bl
movsx rbp, r14w
mov bpl, 0x7f
pop rbx
not bpl
movsxd rbp, ebp
pop rbp
jmp 0x18015a17a
ret