Function at 0x180138b54
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
sar al, cl
push rbx
shrd bp, bp, 0x84
ror bpl, cl
push rsi
push rdi
cmovl rbx, r15
push r12
rcl r12w, 0x8a
push r13
test r12b, 0x3e
rol dil, 0x22
push r14
sal rbx, cl
shl bx, cl
lea rbp, [rsp - 0x240]
sub rsp, 0x340
bts r12w, r14w
jmp 0x180138b99
mov rax, qword [0x180086020]
sub dil, r9b
movzx bx, dh
jmp 0x180138bac
xor rax, rsp
mov qword [rbp + 0x230], rax
adc di, 0x3989
stc
mov r12, r8
movsx rbx, bp
mov rdi, rcx
cmp r11d, r10d
xor bl, dil
rol ebx, cl
movabs rbx, 0x200000000801
stc
cmp rdx, rcx
jmp 0x180138be1
je 0x180138c40
mov al, byte [rdx]
jmp 0x180138bef
sub al, 0x2f
cmp r8d, 0x74ce7ffc
stc
jmp 0x180138bfe
cmp al, 0x2d
jmp 0x180138c05
ja 0x180138c20
movsx rax, al
stc
cmc
bt rbx, rax
jmp 0x180138c1a
jb 0x180138c40
mov rcx, rdi
call fcn.18009208c
mov rdx, rax
cmp spl, r9b
stc
test rdi, r13
cmp rax, rdi
jmp 0x180138c3a
jne 0x180138be7
mov r8b, byte [rdx]
cmp r8b, 0x3a
jmp 0x180138c4c
jne 0x180138c9f
lea rax, [rdi + 1]
cmc
test r14, 0x178e2b03
cmp sp, 0x3076
cmp rdx, rax
jmp 0x180138c6b
je 0x180138c9f
mov r9, r12
rol ch, 0x5a
or cx, 0x2672
sub r8d, r8d
bsr cx, sp
bswap cx
movzx cx, r12b
sub edx, edx
mov rcx, rdi
jmp 0x180138c95
call fcn.18013883c
jmp 0x1801391d5
sub r8b, 0x2f
xor r14d, r14d
jmp 0x180138cab
cmp r8b, 0x2d
jmp 0x180138cb4
ja 0x180138cd4
movsx rax, r8b
jmp 0x180138cc3
bt rbx, rax
mov al, 1
jmp 0x180138cce
jb 0x180138cdf
mov al, r14b
sar cx, cl
test bp, 0x7071
sub rdx, rdi
movzx ecx, di
mov qword [rsp + 0x40], r14
movsx ecx, dx
xchg cx, cx
inc rdx
bswap ecx
test spl, 0xf5
cmovl cx, r9w
mov qword [rsp + 0x48], r14
bt cx, di
neg al
dec cx
mov cx, bp
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x70]
jmp 0x180138d1e
mov qword [rsp + 0x58], r14
sbb r13, r13
mov qword [rsp + 0x60], r14
cmp r9b, 0x80
clc
cmp r14b, r9b
and r13, rdx
cmp r12b, r9b
mov byte [rsp + 0x68], r14b
xor edx, edx
jmp 0x180138d45
mov qword [rsp + 0x38], r13
jmp 0x180138d4f
call fcn.18012875a
mov rax, qword [rsp + 0x78]
btc ecx, 0xc6
or rcx, rdx
mov ecx, 0xfde9
stc
cmp r10b, 0x12
cmp dword [rax + 0xc], ecx
jmp 0x180138d72
jne 0x180138da7
cmp byte [rbp - 0x78], r14b
je 0x180138d9a
mov rax, qword [rsp + 0x70]
rcr r9w, cl
and dword [rax + 0x3a8], 0xfffffffd
movsx r9d, sp
movzx r9d, r10w
mov r9d, ecx
jmp 0x180138da2
jmp 0x180138e0e
call fcn.18013324d
test eax, eax
jmp 0x180138db3
jne 0x180138df0
cmp byte [rbp - 0x78], r14b
je 0x180138de0
mov rax, qword [rsp + 0x70]
bts r9w, sp
and dword [rax + 0x3a8], 0xfffffffd
xchg r9, r9
jmp 0x180138de0
mov r9d, 1
jmp 0x180138deb
jmp 0x180138e0e
cmp byte [rbp - 0x78], r14b
jmp 0x180138df9
je 0x180138e0b
mov rax, qword [rsp + 0x70]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r14d
lea r8, [rsp + 0x30]
movsxd rcx, esi
mov cx, 0x4b8d
mov rcx, rdi
movzx dx, spl
cdq
cmovbe rdx, rbx
lea rdx, [rsp + 0x40]
jmp 0x180138e31
call fcn.180129488
mov rcx, qword [rsp + 0x50]
bts r8, r8
lea r8, [rbp - 0x20]
stc
test eax, eax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
cmovne rcx, r14
cmc
xor r9d, r9d
stc
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp spl, 0x24
test r15w, cx
cmp rax, 0xffffffffffffffff
jmp 0x180138e75
jne 0x180138ecd
mov r9, r12
sub r8d, r8d
cmp r8w, 0x7d83
xor edx, edx
movsx ecx, cx
movsx rcx, si
xchg cx, cx
mov rcx, rdi
jmp 0x180138e9b
call fcn.18013883c
mov ebx, eax
cmp byte [rsp + 0x68], r14b
jmp 0x180138eac
je 0x180138ec1
mov rcx, qword [rsp + 0x50]
jmp 0x180138ebc
call fcn.1801302d9
mov eax, ebx
jmp 0x180138ec8
jmp 0x1801391d5
mov rsi, qword [r12 + 8]
btr ecx, ecx
sub rsi, qword [r12]
sar rsi, 3
movzx cx, bpl
xor edx, edx
movsxd rcx, r10d
jmp 0x180138eee
mov qword [rbp - 0x50], r14
movsxd rcx, ebx
bswap cx
lea rcx, [rbp - 0x70]
jmp 0x180138f01
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
jmp 0x180138f0e
mov qword [rbp - 0x38], r14
jmp 0x180138f17
mov qword [rbp - 0x30], r14
jmp 0x180138f20
mov byte [rbp - 0x28], r14b
call fcn.18012875a
mov rax, qword [rbp - 0x68]
add ch, 0x6d
mov ecx, 0xfde9
cmp dword [rax + 0xc], ecx
jmp 0x180138f3d
jne 0x180138f70
cmp byte [rbp - 0x58], r14b
jmp 0x180138f4c
je 0x180138f68
mov rax, qword [rbp - 0x70]
inc r9w
and dword [rax + 0x3a8], 0xfffffffd
movsx r9, cx
movsxd r9, esp
mov r9d, ecx
jmp 0x180138fd8
call fcn.18013324d
test eax, eax
jmp 0x180138f7c
jne 0x180138faa
cmp byte [rbp - 0x58], r14b
je 0x180138f9f
mov rax, qword [rbp - 0x70]
and dword [rax + 0x3a8], 0xfffffffd
mov r9b, 0xcf
movsx r9w, dil
mov r9d, 1
jmp 0x180138fd8
cmp byte [rbp - 0x58], r14b
jmp 0x180138fb3
je 0x180138fcb
mov rax, qword [rbp - 0x70]
and dword [rax + 0x3a8], 0xfffffffd
cdq
xchg r8b, dl
movsxd rcx, r9d
mov r9d, r14d
movsx edx, bx
cwd
cmovns cx, r10w
lea r8, [rsp + 0x30]
cdq
movzx ecx, bp
lea rdx, [rbp - 0x50]
movsxd rcx, r8d
xchg ch, ch
movzx ecx, r12w
lea rcx, [rbp + 0xc]
call fcn.180138061
mov r14, qword [rbp - 0x40]
and cl, 0x69
sub edx, edx
shl cx, 0x9d
test eax, eax
bswap cx
mov cl, 0x55
setp ch
mov rcx, r14
jmp 0x180139016
cmovne rcx, rdx
cmp byte [rcx], 0x2e
jne 0x180139074
mov al, byte [rcx + 1]
cmp r8w, 0x7512
jmp 0x180139031
test al, al
jmp 0x180139038
jne 0x18013905e
cmp byte [rbp - 0x28], dl
jmp 0x180139046
je 0x1801390c7
mov rcx, r14
jmp 0x180139054
call fcn.1801302d9
jmp 0x1801390c7
cmp al, 0x2e
jne 0x180139074
cmp byte [rcx + 2], dl
jmp 0x18013906e
je 0x18013903e
mov r9, r12
mov dl, r11b
mov r8, r13
mov rdx, rdi
jmp 0x180139085
call fcn.18013883c
mov r13d, eax
jmp 0x180139093
test eax, eax
jmp 0x18013909a
jne 0x180139187
cmp byte [rbp - 0x28], al
jmp 0x1801390a8
je 0x1801390bb
mov rcx, r14
jmp 0x1801390b6
call fcn.1801302d9
mov r13, qword [rsp + 0x38]
setge dl
movzx rdx, bx
lea rdx, [rbp - 0x20]
mov rcx, rbx
jmp 0x1801390d3
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r14d, r14d
test spl, bpl
test r12b, 0xdd
test eax, eax
jmp 0x1801390ea
jne 0x180138ee2
mov rax, qword [r12]
add dh, 0x21
mov rdx, qword [r12 + 8]
sub rdx, rax
clc
sar rdx, 3
test spl, 8
stc
cmp rsi, rdx
jmp 0x180139111
je 0x18013914e
sub rdx, rsi
setge r8b
movsxd rcx, ebp
mov r9b, 0x41
lea rcx, [rax + rsi*8]
movsx r9, sp
bswap r9w
movzx r8d, si
lea r9, [0x1800612e4]
movzx r8w, bpl
lea r8d, [r14 + 8]
jmp 0x180139149
call fcn.1801452c2
mov rcx, rbx
jmp 0x180139156
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], r14b
jmp 0x180139166
je 0x18013917b
mov rcx, qword [rsp + 0x50]
jmp 0x180139176
call fcn.1801302d9
sub eax, eax
jmp 0x180139182
jmp 0x1801391d5
cmp byte [rbp - 0x28], 0
jmp 0x180139190
je 0x1801391a3
mov rcx, r14
jmp 0x18013919e
call fcn.1801302d9
mov rcx, rbx
jmp 0x1801391ab
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], 0
jmp 0x1801391bb
je 0x1801391d0
mov rcx, qword [rsp + 0x50]
jmp 0x1801391cb
call fcn.1801302d9
mov eax, r13d
shr cl, cl
mov rcx, qword [rbp + 0x230]
clc
xor rcx, rsp
call fcn.1801152b0
add rsp, 0x340
mov si, sp
pop r14
sete r13b
pop r13
sets bpl
mov r12w, ax
pop r12
movzx rsi, r10w
movsxd rbp, ecx
mov di, 0x50e0
pop rdi
movsx rbx, r11w
pop rsi
movsx rbp, sp
pop rbx
pop rbp
jmp 0x18013921d
ret