Function at 0x18012ca99
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
bt bp, 0x58
push r12
cdqe
push r13
push r14
sub r12b, 0x9b
lea rbp, [rsp - 0x240]
jmp 0x18012cacc
sub rsp, 0x340
sub ah, bh
mov rax, qword [0x180080010]
sbb r12b, r12b
xor rax, rsp
mov qword [rbp + 0x230], rax
bsr r12d, r11d
movsx rdi, r15w
sub r12w, ax
mov r12, r8
bswap bx
xor di, 0x7a21
rcr bl, 0x62
mov rdi, rcx
movabs rbx, 0x200000000801
cmp r12b, 0xf
test si, bx
cmp rdx, rcx
je 0x18012cb5a
mov al, byte [rdx]
sub al, 0x2f
stc
clc
cmp al, 0x2d
ja 0x18012cb41
movsx rax, al
bt rbx, rax
jmp 0x18012cb3b
jb 0x18012cb5a
mov rcx, rdi
call fcn.1800905fd
mov rdx, rax
cmp rax, rdi
jmp 0x18012cb54
jne 0x18012cb20
mov r8b, byte [rdx]
cmc
test dl, r8b
cmp r8b, r11b
cmp r8b, 0x3a
jmp 0x18012cb6d
jne 0x18012cbae
lea rax, [rdi + 1]
cmp rdx, rax
jmp 0x18012cb7f
je 0x18012cbae
mov r9, r12
cmp r9b, 0x10
rcl ch, cl
sub r8d, r8d
neg cl
sub ch, 0xb8
sub edx, edx
movsx ecx, r13w
movsx cx, r10b
mov rcx, rdi
call fcn.18012c72d
jmp 0x18012d0c3
sub r8b, 0x2f
test rax, rsp
cmc
sub r14d, r14d
cmp r8b, 0x2d
ja 0x18012cbd8
movsx rax, r8b
bt rbx, rax
mov al, 1
jmp 0x18012cbd2
jb 0x18012cbdf
mov al, r14b
shld ecx, esi, 0x86
sub rdx, rdi
mov qword [rsp + 0x40], r14
xchg rcx, rcx
cmovg ecx, r8d
inc rdx
bsf rcx, rcx
btc rcx, rsi
neg cx
mov qword [rsp + 0x48], r14
neg al
mov qword [rsp + 0x50], r14
jmp 0x18012cc11
lea rcx, [rsp + 0x70]
jmp 0x18012cc1b
mov qword [rsp + 0x58], r14
jmp 0x18012cc25
sbb r13, r13
cmc
cmp ch, ah
mov qword [rsp + 0x60], r14
and r13, rdx
stc
mov byte [rsp + 0x68], r14b
jmp 0x18012cc40
sub edx, edx
mov qword [rsp + 0x38], r13
call fcn.18012d11b
mov rax, qword [rsp + 0x78]
mov ecx, 0xfde9
cmp r14, rbp
cmp r10b, 0x3d
cmp dword [rax + 0xc], ecx
jne 0x18012cc95
cmp byte [rbp - 0x78], r14b
je 0x18012cc8d
mov rax, qword [rsp + 0x70]
bsf r9w, r10w
rcl r9b, cl
clc
and dword [rax + 0x3a8], 0xfffffffd
cmovle r9d, r13d
mov r9w, r14w
mov r9d, ecx
jmp 0x18012cd08
call fcn.18012f6cb
test eax, eax
jmp 0x18012cca1
jne 0x18012ccdc
cmp byte [rbp - 0x78], r14b
jmp 0x18012ccb0
je 0x18012cccc
mov rax, qword [rsp + 0x70]
add r9b, r15b
shl r9w, cl
and dword [rax + 0x3a8], 0xfffffffd
xchg r9b, r9b
mov r9d, 1
jmp 0x18012ccd7
jmp 0x18012cd08
cmp byte [rbp - 0x78], r14b
jmp 0x18012cce5
je 0x18012cd05
mov rax, qword [rsp + 0x70]
cmc
bswap r8d
and dword [rax + 0x3a8], 0xfffffffd
movzx rdx, bx
cdq
jmp 0x18012cd05
mov r9d, r14d
lea r8, [rsp + 0x30]
movzx dx, r9b
movzx rdx, r13w
mov rcx, rdi
mov dx, bp
movsx rdx, r13w
cwd
lea rdx, [rsp + 0x40]
call fcn.18012bc5e
mov rcx, qword [rsp + 0x50]
rcl r8w, cl
lea r8, [rbp - 0x20]
test eax, eax
mov dword [rsp + 0x28], r14d
jmp 0x18012cd45
mov qword [rsp + 0x20], r14
cmovne rcx, r14
test dil, 0x62
sub r9d, r9d
test spl, r10b
clc
test r10w, 0x5ba0
sub edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jmp 0x18012cd73
jne 0x18012cdbd
mov r9, r12
ror cl, cl
sub r8d, r8d
xor edx, edx
mov rcx, rdi
jmp 0x18012cd8b
call fcn.18012c72d
mov ebx, eax
jmp 0x18012cd97
cmp byte [rsp + 0x68], r14b
je 0x18012cdb1
mov rcx, qword [rsp + 0x50]
jmp 0x18012cdac
call fcn.18012bbd3
mov eax, ebx
jmp 0x18012cdb8
jmp 0x18012d0c3
mov rsi, qword [r12 + 8]
sub rsi, qword [r12]
btc rcx, r14
xchg cx, cx
sar rsi, 3
clc
xadd cx, cx
shr rcx, 0x51
sub edx, edx
mov qword [rbp - 0x50], r14
mov cx, dx
movsx ecx, di
xchg cx, cx
lea rcx, [rbp - 0x70]
jmp 0x18012cdf2
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
jmp 0x18012ce03
mov qword [rbp - 0x30], r14
jmp 0x18012ce0c
mov byte [rbp - 0x28], r14b
jmp 0x18012ce15
call fcn.18012d11b
mov rax, qword [rbp - 0x68]
shl cx, cl
stc
cmp dl, r10b
mov ecx, 0xfde9
test ecx, 0x33f11c3d
cmp dword [rax + 0xc], ecx
jmp 0x18012ce38
jne 0x18012ce72
cmp byte [rbp - 0x58], r14b
jmp 0x18012ce47
je 0x18012ce65
mov rax, qword [rbp - 0x70]
stc
and dword [rax + 0x3a8], 0xfffffffd
xchg r9b, r9b
movsx r9, bp
mov r9w, 0x3d96
mov r9d, ecx
jmp 0x18012ce6d
jmp 0x18012cee8
call fcn.18012f6cb
test eax, eax
jmp 0x18012ce7e
jne 0x18012cebd
cmp byte [rbp - 0x58], r14b
jmp 0x18012ce8d
je 0x18012ceb2
mov rax, qword [rbp - 0x70]
add r9b, 0x1f
setle r9b
cmovne r9w, r9w
and dword [rax + 0x3a8], 0xfffffffd
movsxd r9, eax
movsx r9, sp
mov r9d, 1
jmp 0x18012cee8
cmp byte [rbp - 0x58], r14b
jmp 0x18012cec6
je 0x18012cee2
mov rax, qword [rbp - 0x70]
and dword [rax + 0x3a8], 0xfffffffd
movsx dx, r15b
xchg r9w, r9w
cwd
mov r9d, r14d
setge dl
lea r8, [rsp + 0x30]
movsx ecx, di
movzx rdx, ax
lea rdx, [rbp - 0x50]
movzx ecx, sp
movzx cx, r9b
lea rcx, [rbp + 0xc]
jmp 0x18012cf09
call fcn.18012bf40
mov r14, qword [rbp - 0x40]
sub edx, edx
and cx, 0x275
movzx rcx, sp
stc
test eax, eax
cmovb ecx, r8d
mov rcx, r14
cmovne rcx, rdx
cmp r14b, 0xf4
cmp byte [rcx], 0x2e
jmp 0x18012cf37
jne 0x18012cf83
mov al, byte [rcx + 1]
test al, al
jmp 0x18012cf47
jne 0x18012cf6d
cmp byte [rbp - 0x28], dl
jmp 0x18012cf55
je 0x18012cfd2
mov rcx, r14
jmp 0x18012cf63
call fcn.18012bbd3
jmp 0x18012cfd2
cmp al, 0x2e
jmp 0x18012cf74
jne 0x18012cf83
cmp byte [rcx + 2], dl
je 0x18012cf4d
mov r9, r12
movsx dx, dh
mov r8, r13
mov rdx, rdi
jmp 0x18012cf95
call fcn.18012c72d
mov r13d, eax
test eax, eax
jmp 0x18012cfa4
jne 0x18012d07c
cmp byte [rbp - 0x28], al
jmp 0x18012cfb2
je 0x18012cfc5
mov rcx, r14
jmp 0x18012cfc0
call fcn.18012bbd3
mov r13, qword [rsp + 0x38]
jmp 0x18012cfd2
lea rdx, [rbp - 0x20]
mov cx, dx
mov rcx, rbx
jmp 0x18012cfe1
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
sub r14d, r14d
cmc
test eax, eax
jmp 0x18012cff2
jne 0x18012cdda
mov rax, qword [r12]
cmp bl, spl
mov rdx, qword [r12 + 8]
cmc
sub rdx, rax
stc
clc
jmp 0x18012d00f
sar rdx, 3
stc
test rbp, rbp
cmp rsi, rdx
jmp 0x18012d01f
je 0x18012d04d
sub rdx, rsi
lea rcx, [rax + rsi*8]
movsx r9w, cl
lea r9, [0x180062108]
movzx r8d, cx
mov r8b, 0x29
lea r8d, [r14 + 8]
jmp 0x18012d048
call fcn.180132663
mov rcx, rbx
jmp 0x18012d055
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], r14b
je 0x18012d075
mov rcx, qword [rsp + 0x50]
jmp 0x18012d070
call fcn.18012bbd3
sub eax, eax
jmp 0x18012d0c3
cmp byte [rbp - 0x28], 0
jmp 0x18012d085
je 0x18012d098
mov rcx, r14
jmp 0x18012d093
call fcn.18012bbd3
mov rcx, rbx
jmp 0x18012d0a0
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], 0
je 0x18012d0c0
mov rcx, qword [rsp + 0x50]
jmp 0x18012d0bb
call fcn.18012bbd3
mov eax, r13d
mov rcx, qword [rbp + 0x230]
cmp r12w, 0x64b0
cmc
xor rcx, rsp
jmp 0x18012d0d9
call fcn.18011c3a9
add rsp, 0x340
movzx ebp, cx
pop r14
pop r13
movsx rsi, r10w
mov rbx, rsp
mov bpl, 0x5d
pop r12
movsx bp, r9b
not edi
bswap bp
pop rdi
mov bp, bx
jmp 0x18012d10e
pop rsi
pop rbx
movzx bp, cl
pop rbp
jmp 0x18012d11a
ret