Function at 0x18015c6ba
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
test edx, edi
ror ah, cl
cbw
push rbx
inc bh
push rsi
shrd rbp, rax, 0xbc
movsxd rbx, r12d
dec eax
push rdi
sar rdi, cl
movzx rbp, r11w
push r12
xor bh, bh
bt edi, eax
push r13
btr r12w, r12w
push r14
movsx r12w, al
bsf bx, ax
lea rbp, [rsp - 0x240]
movsx ebx, bx
sal dil, 0x3c
sub rsp, 0x340
shr di, 0x80
sbb bx, r10w
stc
mov rax, qword [0x180094010]
shl ebx, 0xe1
add r12w, 0x17b0
sar dil, cl
xor rax, rsp
bt rdi, 0x4b
movzx di, r14b
shrd r12d, r9d, 0x4f
mov qword [rbp + 0x230], rax
mov r12, r8
mov rdi, rcx
and bh, 0x85
stc
xadd bx, bx
movabs rbx, 0x200000000801
cmp r12d, 0xe28217f
cmc
cmp rdx, rcx
je 0x18015c7a8
mov al, byte [rdx]
test spl, 0xc8
sub al, 0x2f
cmp al, 0x2d
jmp 0x18015c774
ja 0x18015c78f
movsx rax, al
clc
stc
bt rbx, rax
jmp 0x18015c789
jb 0x18015c7a8
mov rcx, rdi
jmp 0x18015c797
call fcn.1800aa97e
mov rdx, rax
cmp rax, rdi
jne 0x18015c765
mov r8b, byte [rdx]
stc
test r8b, 0x6e
cmp r8b, 0x3a
jmp 0x18015c7b9
jne 0x18015c7fc
lea rax, [rdi + 1]
cmp rdx, rax
jmp 0x18015c7cb
je 0x18015c7fc
mov r9, r12
shr ch, cl
sub r8d, r8d
bts cx, r9w
xor edx, edx
cmovp ecx, r8d
bswap cx
movzx ecx, dx
mov rcx, rdi
jmp 0x18015c7f2
call fcn.18015c37e
jmp 0x18015cd52
sub r8b, 0x2f
test r9b, 0x25
xor r14d, r14d
stc
clc
jmp 0x18015c80e
cmp r8b, 0x2d
jmp 0x18015c817
ja 0x18015c836
movsx rax, r8b
stc
clc
bt rbx, rax
not al
mov al, 1
jmp 0x18015c830
jb 0x18015c844
mov al, r14b
movsx rcx, r9w
movzx ecx, bp
bt ecx, 0xad
sub rdx, rdi
mov qword [rsp + 0x40], r14
inc rdx
test r15w, ax
movsx cx, r13b
rol cl, cl
mov qword [rsp + 0x48], r14
bswap ecx
movsx rcx, r12w
btc cx, 0xc1
neg al
mov qword [rsp + 0x50], r14
movsx ecx, r15w
lea rcx, [rsp + 0x70]
jmp 0x18015c87f
mov qword [rsp + 0x58], r14
sbb r13, r13
mov qword [rsp + 0x60], r14
clc
and r13, rdx
cmp r11d, 0x3cd077e6
jmp 0x18015c89c
mov byte [rsp + 0x68], r14b
sub edx, edx
jmp 0x18015c8a8
mov qword [rsp + 0x38], r13
call fcn.18015cda0
mov rax, qword [rsp + 0x78]
btc cx, 0x98
mov ecx, 0xfde9
jmp 0x18015c8cb
cmp dword [rax + 0xc], ecx
jmp 0x18015c8d3
jne 0x18015c909
cmp byte [rbp - 0x78], r14b
jmp 0x18015c8e2
je 0x18015c8fc
mov rax, qword [rsp + 0x70]
and dword [rax + 0x3a8], 0xfffffffd
movsx r9w, al
not r9b
mov r9d, ecx
jmp 0x18015c904
jmp 0x18015c978
call fcn.18015f385
test eax, eax
jmp 0x18015c915
jne 0x18015c953
cmp byte [rbp - 0x78], r14b
jmp 0x18015c924
je 0x18015c943
mov rax, qword [rsp + 0x70]
ror r9, cl
xchg r9b, r9b
or r9, 0x403215f7
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x18015c94e
jmp 0x18015c978
cmp byte [rbp - 0x78], r14b
jmp 0x18015c95c
je 0x18015c975
mov rax, qword [rsp + 0x70]
btr dx, bp
and dword [rax + 0x3a8], 0xfffffffd
xchg r9b, dl
mov r9d, r14d
lea r8, [rsp + 0x30]
movzx cx, r10b
mov rcx, rdi
movsx dx, ch
cdq
lea rdx, [rsp + 0x40]
jmp 0x18015c994
call fcn.18015b8ce
mov rcx, qword [rsp + 0x50]
lea r8, [rbp - 0x20]
cmc
test eax, eax
jmp 0x18015c9aa
mov dword [rsp + 0x28], r14d
jmp 0x18015c9b4
mov qword [rsp + 0x20], r14
jmp 0x18015c9be
cmovne rcx, r14
sub r9d, r9d
cmp r15b, 0x27
sub edx, edx
jmp 0x18015c9d0
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp r11b, 0xeb
cmp rax, 0xffffffffffffffff
jne 0x18015ca39
mov r9, r12
bsr cx, r11w
movsxd rcx, r10d
shl rcx, 0x55
sub r8d, r8d
bsr cx, cx
or cl, r13b
xor edx, edx
not ecx
mov rcx, rdi
jmp 0x18015ca0c
call fcn.18015c37e
mov ebx, eax
cmp byte [rsp + 0x68], r14b
je 0x18015ca2d
mov rcx, qword [rsp + 0x50]
jmp 0x18015ca28
call fcn.18015b867
mov eax, ebx
jmp 0x18015ca34
jmp 0x18015cd52
mov rsi, qword [r12 + 8]
add cl, 0x1b
sub rsi, qword [r12]
bt rcx, 0xbb
btc cx, r13w
sar rsi, 3
sub edx, edx
movsx ecx, ax
movzx cx, r8b
setnp ch
mov qword [rbp - 0x50], r14
setge cl
movzx cx, r13b
movsx ecx, r14w
lea rcx, [rbp - 0x70]
jmp 0x18015ca79
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
jmp 0x18015ca8a
mov qword [rbp - 0x30], r14
mov byte [rbp - 0x28], r14b
jmp 0x18015ca97
call fcn.18015cda0
mov rax, qword [rbp - 0x68]
test bpl, r11b
btr ecx, edx
stc
mov ecx, 0xfde9
clc
cmp r10b, bpl
cmp r13b, 0x6e
cmp dword [rax + 0xc], ecx
jmp 0x18015cabc
jne 0x18015caf4
cmp byte [rbp - 0x58], r14b
jmp 0x18015cacb
je 0x18015caec
mov rax, qword [rbp - 0x70]
bsr r9w, bp
sar r9, cl
test r11b, 4
and dword [rax + 0x3a8], 0xfffffffd
movsx r9d, sp
mov r9d, ecx
jmp 0x18015cb75
call fcn.18015f385
test eax, eax
jmp 0x18015cb00
jne 0x18015cb40
cmp byte [rbp - 0x58], r14b
jmp 0x18015cb0f
je 0x18015cb35
mov rax, qword [rbp - 0x70]
stc
btr r9w, r10w
dec r9b
and dword [rax + 0x3a8], 0xfffffffd
movsx r9d, bp
movzx r9, cx
not r9w
mov r9d, 1
jmp 0x18015cb75
cmp byte [rbp - 0x58], r14b
jmp 0x18015cb49
je 0x18015cb69
mov rax, qword [rbp - 0x70]
btc rcx, 0x1e
neg dx
and dword [rax + 0x3a8], 0xfffffffd
xchg cx, cx
movzx r9, dx
mov r9d, r14d
cmovge r8w, sp
movzx cx, dl
lea r8, [rsp + 0x30]
movsx cx, bl
movsx rcx, cx
movsx ecx, r9w
lea rdx, [rbp - 0x50]
cmove ecx, r13d
lea rcx, [rbp + 0xc]
jmp 0x18015cb97
call fcn.18015bbb2
mov r14, qword [rbp - 0x40]
rcl cx, 0xe0
sbb cl, r9b
sub edx, edx
or ch, 0xee
bts ecx, r12d
cmp r14b, 0x78
test eax, eax
mov rcx, r14
cmovne rcx, rdx
cmp byte [rcx], 0x2e
jmp 0x18015cbc5
jne 0x18015cc12
mov al, byte [rcx + 1]
clc
test al, al
jmp 0x18015cbd6
jne 0x18015cbfc
cmp byte [rbp - 0x28], dl
jmp 0x18015cbe4
je 0x18015cc59
mov rcx, r14
jmp 0x18015cbf2
call fcn.18015b867
jmp 0x18015cc59
cmp al, 0x2e
jne 0x18015cc12
cmp byte [rcx + 2], dl
jmp 0x18015cc0c
je 0x18015cbdc
mov r9, r12
bswap edx
mov r8, r13
mov rdx, rdi
jmp 0x18015cc22
call fcn.18015c37e
mov r13d, eax
test eax, eax
jmp 0x18015cc31
jne 0x18015cd0a
cmp byte [rbp - 0x28], al
jmp 0x18015cc3f
je 0x18015cc52
mov rcx, r14
jmp 0x18015cc4d
call fcn.18015b867
mov r13, qword [rsp + 0x38]
xchg dl, ch
lea rdx, [rbp - 0x20]
bswap cx
movzx rcx, r15w
movsx cx, bpl
mov rcx, rbx
jmp 0x18015cc71
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r14d, r14d
test eax, eax
jne 0x18015ca53
mov rax, qword [r12]
movsx rdx, si
inc rdx
mov rdx, qword [r12 + 8]
sub rdx, rax
stc
sar rdx, 3
stc
clc
cmp rsi, rdx
jmp 0x18015cca4
je 0x18015ccd6
sub rdx, rsi
movzx r8, di
mov ch, 0x16
bswap ecx
lea rcx, [rax + rsi*8]
lea r9, [0x180074bd8]
xchg r8, r8
movzx r8, r14w
lea r8d, [r14 + 8]
jmp 0x18015ccd1
call fcn.180162141
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], r14b
jmp 0x18015cce9
je 0x18015ccfe
mov rcx, qword [rsp + 0x50]
jmp 0x18015ccf9
call fcn.18015b867
xor eax, eax
jmp 0x18015cd05
jmp 0x18015cd52
cmp byte [rbp - 0x28], 0
je 0x18015cd21
mov rcx, r14
jmp 0x18015cd1c
call fcn.18015b867
mov rcx, rbx
jmp 0x18015cd29
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], 0
jmp 0x18015cd39
je 0x18015cd49
mov rcx, qword [rsp + 0x50]
call fcn.18015b867
mov eax, r13d
rcr cx, cl
movsxd rcx, edi
mov rcx, qword [rbp + 0x230]
stc
jmp 0x18015cd5f
xor rcx, rsp
call fcn.18014c161
add rsp, 0x340
pop r14
movzx r13d, r11w
movzx r13, r8w
pop r13
pop r12
bswap di
not bl
pop rdi
movsx si, bpl
cmova si, si
movsx ebx, r8w
pop rsi
mov bh, 0x6f
movsx bp, r14b
pop rbx
pop rbp
jmp 0x18015cd9f
ret